菜单
Decode QR codes from images during quishing and phishing investigations using the Analysi QR Code integration. Use when triaging phishing alerts with QR codes, extracting URLs from embedded images, or building quishing investigation workflows.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
AbuseIPDB IP reputation lookups for SOC alert triage via Analysi. Use when checking IP abuse confidence scores, investigating brute force or scanning activity, or enriching alerts with crowd-sourced threat intelligence.
Active Directory LDAP user attribute lookups and identity context queries during SOC alert triage. Use when investigating user accounts, group memberships, authentication anomalies, lockouts, privileged access, or correlating alerts with AD data via Analysi.
Write and debug Cy language scripts for automation and workflow composition. Use when working with .cy files, Security Tasks, writing Cy programs, or debugging Cy syntax errors.
Investigate security alerts, analyze IOCs, triage incidents, and perform threat analysis. Covers SIEM alerts, SOC workflows, malware, phishing, brute force, web attacks, network traffic, and log analysis. Use when building cybersecurity Tasks/Workflows or performing incident response.
Echo EDR endpoint detection and response for SOC alert triage. Use when investigating endpoint threats, checking process activity, retrieving host attributes, analyzing behavioral indicators, or correlating endpoint telemetry with alert data via Analysi.
DNS resolution, reverse lookups, and mail/TXT/NS/SOA queries via Analysi's Global DNS for SOC triage. Use when investigating suspicious domains, resolving IPs to hostnames, checking SPF/DKIM/DMARC in phishing analysis, or correlating network indicators with domain infrastructure.
| name | qrcode-integration |
| description | Decode QR codes from images during quishing and phishing investigations using the Analysi QR Code integration. Use when triaging phishing alerts with QR codes, extracting URLs from embedded images, or building quishing investigation workflows. |
| version | 0.1.0 |
Decode QR codes from base64-encoded images to extract embedded URLs, text, and other payloads during phishing/quishing alert triage. The integration uses OpenCV locally — no external API calls, no rate limits, no authentication.
| Reference | Read when | Consult for |
|---|---|---|
references/actions-reference.md | Calling any QR code action | Parameters, return schemas, Cy examples, error handling, known limitations, data_samples template |
references/investigation-patterns.md | Building quishing triage workflows | Decision trees, multi-integration chaining (DNS, unshorten, WHOIS, Tor), Cy task templates |
decode_qr_code (see actions-reference.md § Basic Decode)unshortenme, global_dns, whois_rdap, tor (see investigation-patterns.md)decode_qr_code returns null (not an error) when no QR code is detected — always null-check before processingValidationError exception (caught by try/catch)