New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Hardening Windows Endpoint With Cis Benchmark

by mukul975 in mukul975/Anthropic-Cybersecurity-Skills

Hardens Windows endpoints using CIS (Center for Internet Security) Benchmark recommendations to reduce attack surface, enforce security baselines, and meet compliance requirements.

Apache-2.0Auto-check passedSecurity

Install Hardening Windows Endpoint With Cis Benchmark

skills CLI
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hardening-windows-endpoint-with-cis-benchmark -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills hardening-windows-endpoint-with-cis-benchmark --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/hardening-windows-endpoint-with-cis-benchmark .claude/skills/hardening-windows-endpoint-with-cis-benchmark && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
hardening-windows-endpoint-with-cis-benchmark
GitHub stars
34k
Token cost
~2.2k tokens
SKILL.md length
611 words
Files
8 (incl. scripts, references, assets)
Skills in repo
644
Repo updated
First seen
Licence
Apache-2.0

At a glance

Hardens Windows endpoints using CIS (Center for Internet Security) Benchmark recommendations to reduce attack surface, enforce security baselines, and meet compliance requirements.

  • Works in 6 steps: Select CIS Benchmark Profile Level → Import CIS GPO Baselines → Apply Key CIS Benchmark Categories → …
  • Deploying new Windows workstations
  • SKILL.md covers When to Use, Prerequisites, Workflow and Key Concepts, plus 2 more sections
  • Runs Python scripts from its folder

What it does

Hardening Windows Endpoint With Cis Benchmark is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Hardens Windows endpoints using CIS (Center for Internet Security) Benchmark recommendations to reduce attack surface, enforce security baselines, and meet compliance requirements. Use when deploying new Windows workstations or servers, remediating audit findings, or establishing organization-wide security baselines. Activates for requests involving Windows hardening, CIS benchmarks, GPO security baselines, or endpoint configuration compliance.

Its SKILL.md is about 2.2k tokens, which your agent loads only when the skill is triggered. The skill folder holds 10 other files, including scripts, reference files and assets (for example `assets/template.md`, `references/api-reference.md` and `references/standards.md`).

It sits in Security, covering Threat modeling and Audit readiness. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.

When your agent uses it

  • Deploying new Windows workstations
  • Remediating audit findings
  • Establishing organization-wide security baselines

Example prompts

  • “Use the hardening-windows-endpoint-with-cis-benchmark skill to harden Windows endpoints using CIS (Center for Internet Security) Benchmark…”
  • “/hardening-windows-endpoint-with-cis-benchmark”

Requirements

  • Python 3

Workflow steps

6 steps, taken from the step headings in SKILL.md.

  1. Select CIS Benchmark Profile Level
  2. Import CIS GPO Baselines
  3. Apply Key CIS Benchmark Categories
  4. Validate with CIS-CAT Assessment
  5. Document Exceptions and Compensating Controls
  6. Continuous Compliance Monitoring

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 2 files in scripts/ (Python), which the agent can run.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Hardening Windows Endpoint With Cis Benchmark loads about 2.2k tokens when it runs, and up to ~4.4k if it reads all its reference files. Until then it costs about 124 tokens; SKILL.md has 611 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~124
When it runs · the whole SKILL.md, loaded when a task matches
~2.2k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~4.4k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 611 words, ~2,222 tokens.

Download SKILL.mdSave it as .claude/skills/hardening-windows-endpoint-with-cis-benchmark/SKILL.md (or your agent's skills folder). This skill also uses 7 other files; get the full folder from GitHub.
name
hardening-windows-endpoint-with-cis-benchmark
description
Hardens Windows endpoints using CIS (Center for Internet Security) Benchmark recommendations to reduce attack surface, enforce security baselines, and meet compliance requirements. Use when deploying new Windows workstations or servers, remediating audit findings, or establishing organization-wide security baselines. Activates for requests involving Windows hardening, CIS benchmarks, GPO security baselines, or endpoint configuration compliance.
domain
cybersecurity
subdomain
endpoint-security
tags
endpoint, hardening, windows-security, CIS-benchmark, GPO, baseline-configuration
version
1.0.0
author
mahipal
license
Apache-2.0
nist_csf
PR.PS-01, PR.PS-02, DE.CM-01, PR.IR-01
mitre_attack
T1055, T1547, T1059, T1036

Hardening Windows Endpoint with CIS Benchmark

When to Use

Use this skill when:

  • Deploying new Windows 10/11 or Server 2019/2022 endpoints that require security hardening
  • Establishing organization-wide security baselines using CIS Level 1 or Level 2 profiles
  • Remediating findings from compliance audits (PCI DSS, HIPAA, SOC 2) that reference CIS benchmarks
  • Validating existing endpoint configurations against current CIS benchmark versions

Do not use this skill for Linux endpoints (use hardening-linux-endpoint-with-cis-benchmark) or for cloud-native workloads that require CIS cloud benchmarks.

Prerequisites

  • Windows 10/11 Enterprise or Windows Server 2019/2022 target endpoints
  • Active Directory Group Policy Management Console (GPMC) for enterprise deployment
  • CIS-CAT Pro Assessor or CIS-CAT Lite for automated benchmark assessment
  • Administrative access to target endpoints or domain controller
  • Current CIS Benchmark PDF for the target Windows version (download from cisecurity.org)

Workflow

Step 1: Select CIS Benchmark Profile Level

CIS provides two profile levels for Windows endpoints:

Level 1 (L1) - Corporate/Enterprise Environment:

  • Practical hardening settings that can be applied to most organizations
  • Minimal impact on functionality and user experience
  • Covers: password policy, audit policy, user rights, security options, Windows Firewall

Level 2 (L2) - High Security/Sensitive Data:

  • Includes all L1 settings plus additional restrictions
  • May impact usability (disabling autorun, restricting remote desktop, enhanced audit logging)
  • Appropriate for systems handling PII, PHI, PCI data, or classified information

Select profile based on data classification and risk tolerance of the endpoint.

Step 2: Import CIS GPO Baselines

CIS provides pre-built GPO templates (Build Kits) for each benchmark version:

powershell
# Download CIS Build Kit from CIS WorkBench (requires CIS SecureSuite membership)
# Extract the GPO backup to a staging directory

# Import the CIS GPO into Active Directory
Import-GPO -BackupGpoName "CIS Microsoft Windows 11 Enterprise v3.0.0 L1" `
  -TargetName "CIS-Win11-L1-Baseline" `
  -Path "C:\CIS-GPO-Backups\Win11-Enterprise" `
  -CreateIfNeeded

# Link GPO to target OU
New-GPLink -Name "CIS-Win11-L1-Baseline" `
  -Target "OU=Workstations,DC=corp,DC=example,DC=com" `
  -LinkEnabled Yes
Step 3: Apply Key CIS Benchmark Categories

Account Policies (Section 1):

Password Policy:
  - Minimum password length: 14 characters (1.1.4)
  - Maximum password age: 365 days (1.1.3)
  - Password complexity: Enabled (1.1.5)
  - Store passwords using reversible encryption: Disabled (1.1.6)

Account Lockout Policy:
  - Account lockout threshold: 5 invalid logon attempts (1.2.1)
  - Account lockout duration: 15 minutes (1.2.2)
  - Reset account lockout counter after: 15 minutes (1.2.3)

Local Policies - Audit Policy (Section 17):

Audit Policy Configuration:
  - Audit Credential Validation: Success and Failure (17.1.1)
  - Audit Security Group Management: Success (17.2.5)
  - Audit Logon: Success and Failure (17.5.1)
  - Audit Process Creation: Success (17.6.1)
  - Audit Removable Storage: Success and Failure (17.6.4)

Security Options (Section 2.3):

  - Interactive logon: Do not display last user name: Enabled (2.3.7.1)
  - Interactive logon: Machine inactivity limit: 900 seconds (2.3.7.3)
  - Network access: Do not allow anonymous enumeration of SAM accounts: Enabled (2.3.10.2)
  - Network security: LAN Manager authentication level: Send NTLMv2 response only (2.3.11.7)
  - UAC: Run all administrators in Admin Approval Mode: Enabled (2.3.17.6)

Windows Firewall (Section 9):

  - Domain Profile: Firewall state: On (9.1.1)
  - Domain Profile: Inbound connections: Block (9.1.2)
  - Private Profile: Firewall state: On (9.2.1)
  - Public Profile: Firewall state: On (9.3.1)
  - Public Profile: Inbound connections: Block (9.3.2)
Step 4: Validate with CIS-CAT Assessment
powershell
# Run CIS-CAT Pro Assessor against target endpoint
# CIS-CAT produces an HTML/XML report with pass/fail per recommendation

.\Assessor-CLI.bat `
  -b "benchmarks\CIS_Microsoft_Windows_11_Enterprise_Benchmark_v3.0.0-xccdf.xml" `
  -p "Level 1 (L1) - Corporate/Enterprise Environment" `
  -rd "C:\CIS-Reports" `
  -nts

# Review report for failed controls
# Score target: 95%+ for L1, 90%+ for L2 (due to operational exceptions)
Step 5: Document Exceptions and Compensating Controls

For each CIS recommendation that cannot be applied:

  1. Document the specific recommendation ID and title
  2. State the business justification for the exception
  3. Define the compensating control that addresses the residual risk
  4. Set a review date (quarterly) to reassess the exception
  5. Obtain sign-off from the information security officer

Example exception:

Recommendation: 2.3.7.3 - Interactive logon: Machine inactivity limit: 900 seconds
Exception: Kiosk systems in manufacturing floor require 1800 seconds
Compensating Control: Physical badge-access to manufacturing area, CCTV monitoring
Review Date: 2026-06-01
Approved By: CISO
Step 6: Continuous Compliance Monitoring

Configure recurring CIS-CAT scans via scheduled tasks or SCCM:

powershell
# Create scheduled task for weekly CIS-CAT assessment
$action = New-ScheduledTaskAction -Execute "C:\CIS-CAT\Assessor-CLI.bat" `
  -Argument "-b benchmarks\CIS_Win11_v3.0.0-xccdf.xml -p Level1 -rd C:\CIS-Reports -nts"
$trigger = New-ScheduledTaskTrigger -Weekly -DaysOfWeek Sunday -At 2am
$principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -RunLevel Highest
Register-ScheduledTask -TaskName "CIS-Benchmark-Scan" -Action $action `
  -Trigger $trigger -Principal $principal

Feed results into SIEM for drift detection and dashboard reporting.

Show full SKILL.md (253 more words)Show less

Key Concepts

TermDefinition
CIS BenchmarkConsensus-based security configuration guide developed by CIS with input from government, industry, and academia
Level 1 ProfilePractical security baseline suitable for most organizations with minimal operational impact
Level 2 ProfileExtended security baseline for high-security environments that may reduce functionality
CIS-CATCIS Configuration Assessment Tool that automates benchmark compliance checking
Build KitPre-configured GPO templates provided by CIS that implement benchmark recommendations
ScoringCIS recommendations are either Scored (compliance-measurable) or Not Scored (best-practice guidance)

Tools & Systems

  • CIS-CAT Pro Assessor: Automated benchmark compliance scanner (requires CIS SecureSuite license)
  • Microsoft Security Compliance Toolkit (SCT): Microsoft's own GPO baselines (complementary to CIS)
  • Group Policy Management Console (GPMC): Enterprise GPO deployment and management
  • LGPO.exe: Microsoft tool for applying GPOs to standalone (non-domain) systems
  • Nessus/Tenable: Vulnerability scanner with CIS benchmark audit files

Common Pitfalls

  • Applying L2 to all endpoints: Level 2 restrictions (disabling Autoplay, restricting Remote Desktop) break workflows on standard workstations. Reserve L2 for endpoints handling sensitive data.
  • Not testing GPOs in pilot OU: Deploy CIS GPOs to a test OU with representative hardware/software before organization-wide rollout to avoid breaking line-of-business applications.
  • Ignoring CIS benchmark version updates: CIS benchmarks update with each Windows feature release. Running an outdated benchmark misses new security settings and generates false compliance reports.
  • Forgetting local admin accounts: CIS benchmarks assume domain-joined endpoints. Standalone systems require LGPO.exe or Microsoft Intune for baseline enforcement.
  • No exception process: Applying 100% of CIS recommendations is rarely feasible. Without a formal exception process, teams either ignore hardening or break applications.

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 7 other files (scripts, references, assets) in skills/hardening-windows-endpoint-with-cis-benchmark of mukul975/Anthropic-Cybersecurity-Skills.

  • SKILL.md
  • LICENSE
  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py

Open the folder on GitHubat commit 54a7988

Compare with similar skills

Hardening Windows Endpoint With Cis Benchmark next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Hardening Windows Endpoint With Cis Benchmark compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Hardening Windows Endpoint With Cis Benchmark this skillmukul975/Anthropic-Cybersecurity-Skills34k—~2.2kAutomated safety check: PassApache-2.0
X Raypashov/skills1.2k1 repos~10kAutomated safety check: PassMIT
Xray Pre Auditccashwell/evm-cortex131—~25kAutomated safety check: PassMIT
Hack23 Isms ComplianceHack23/cia239—~1.9kAutomated safety check: PassApache-2.0
Isms Audit Expertdavila7/claude-code-templates33k1 repos~3.1kAutomated safety check: PassMIT
Fp Checkvibeeval/vibecosystem532—~1.6kAutomated safety check: PassMIT

Similar skills

  • X Ray

    pashov/skills

    Generates an x-ray.md pre-audit report covering overview, enhanced threat model (protocol-type profiling, git-weighted attack surfaces, temporal risk analysis, composability dependency mapping)…

    1.2k GitHub starsUsed in 1 repo~10k tokens
    SecurityAuto-check passed

  • Xray Pre Audit

    ccashwell/evm-cortex

    A skill your agent uses when preparing for a security audit, performing reconnaissance on a new codebase, or creating a protocol overview.

    131 GitHub stars~25k tokensUpdated 11 days ago
    SecurityAuto-check passed

  • Hack23 Isms Compliance

    Hack23/cia

    Hack23 ISMS organization-wide compliance requirements, policy enforcement, audit preparation

    239 GitHub stars~1.9k tokensUpdated yesterday
    Legal & ComplianceAuto-check passed

  • Isms Audit Expert

    davila7/claude-code-templates

    Senior ISMS Audit Expert for internal and external information security management system auditing.

    33k GitHub starsUsed in 1 repo~3.1k tokens
    SecurityAuto-check passed

  • Fp Check

    vibeeval/vibecosystem

    Systematic false positive verification for security findings.

    532 GitHub stars~1.6k tokensUpdated 2 mo ago
    SecurityAuto-check passed

  • Architecting Security

    telagod/code-abyss

    安全架构与治理：威胁建模 (STRIDE/PASTA/LINDDUN)、零信任身份架构、IAM/SSO/MFA/PAM、合规框架 (SOC2/PCI/HIPAA/GDPR)、DLP、隐私工程、安全控制设计。Use when designing security architecture, threat modeling new systems, implementing zero-trust…

    244 GitHub stars~712 tokensUpdated 2 mo ago
    SecurityAuto-check passed

More from mukul975/Anthropic-Cybersecurity-Skills

All 644 skills in this repo

  • Campaign Attribution Evidence Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    Auto-check passed

  • Go Malware Analysis in Ghidra

    mukul975/Anthropic-Cybersecurity-Skills

    Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • LNK and Jump List Forensics

    mukul975/Anthropic-Cybersecurity-Skills

    Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • Malware Persistence Analysis with Autoruns

    mukul975/Anthropic-Cybersecurity-Skills

    Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

    34k GitHub stars~1.2k tokensUpdated 1 mo ago
    Auto-check passed

  • NTFS MFT Deleted File Recovery

    mukul975/Anthropic-Cybersecurity-Skills

    Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.

    34k GitHub stars~2.7k tokensUpdated 1 mo ago
    Auto-check passed

  • Network Covert Channel Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.

    34k GitHub stars~2k tokensUpdated 1 mo ago
    Auto-check passed

Categories

Questions about Hardening Windows Endpoint With Cis Benchmark

What does Hardening Windows Endpoint With Cis Benchmark do?

Hardens Windows endpoints using CIS (Center for Internet Security) Benchmark recommendations to reduce attack surface, enforce security baselines, and meet compliance requirements. Hardening Windows Endpoint With Cis Benchmark is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Hardens Windows endpoints using CIS (Center for Internet Security) Benchmark recommendations to reduce attack surface, enforce security baselines, and meet compliance requirements.

When should I use Hardening Windows Endpoint With Cis Benchmark?

Hardening Windows Endpoint With Cis Benchmark fits situations like: deploying new Windows workstations; remediating audit findings; establishing organization-wide security baselines.

How do I install Hardening Windows Endpoint With Cis Benchmark in Claude Code?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hardening-windows-endpoint-with-cis-benchmark -a claude-code`. Or copy the skill folder (skills/hardening-windows-endpoint-with-cis-benchmark in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/hardening-windows-endpoint-with-cis-benchmark in your project. Claude Code loads it when a task matches its description.

How do I install Hardening Windows Endpoint With Cis Benchmark in Codex?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hardening-windows-endpoint-with-cis-benchmark -a codex`. Or copy the skill folder (skills/hardening-windows-endpoint-with-cis-benchmark in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/hardening-windows-endpoint-with-cis-benchmark in your project. Codex loads it when a task matches its description.

Can I use Hardening Windows Endpoint With Cis Benchmark in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hardening-windows-endpoint-with-cis-benchmark -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/hardening-windows-endpoint-with-cis-benchmark, .gemini/skills/hardening-windows-endpoint-with-cis-benchmark, .github/skills/hardening-windows-endpoint-with-cis-benchmark and .opencode/skills/hardening-windows-endpoint-with-cis-benchmark in your project.

What does Hardening Windows Endpoint With Cis Benchmark need to run?

Going by SKILL.md and its folder, Hardening Windows Endpoint With Cis Benchmark needs Python for the scripts in its folder. Our summary lists: Python 3.

Does Hardening Windows Endpoint With Cis Benchmark access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Hardening Windows Endpoint With Cis Benchmark safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Hardening Windows Endpoint With Cis Benchmark use?

Hardening Windows Endpoint With Cis Benchmark is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Hardening Windows Endpoint With Cis Benchmark use?

About 2.2k tokens (SKILL.md is roughly 8.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 2.2k tokens, read only when the agent opens those files.

What are the alternatives to Hardening Windows Endpoint With Cis Benchmark?

Skills that share tags, products or a category with Hardening Windows Endpoint With Cis Benchmark: X Ray (pashov/skills, 1.2k stars), Xray Pre Audit (ccashwell/evm-cortex, 131 stars), Hack23 Isms Compliance (Hack23/cia, 239 stars) and Isms Audit Expert (davila7/claude-code-templates, 33k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Hardening Windows Endpoint With Cis Benchmark?

mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 34,116 GitHub stars. The repository holds 644 skills in this directory. The repository was last updated on August 31, 2026.

Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.