817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains · Apache 2.0
This repository provides 754 structured cybersecurity skill definitions organized across 26 security domains, designed to be loaded into AI agents via the agentskills.io open standard. Each skill is a machine-readable file containing methodology, tool guidance, and cross-framework identifiers covering MITRE ATT&CK v19.1, NIST CSF 2.0, MITRE ATLAS v5.4, MITRE D3FEND v1.3, and NIST AI RMF 1.0 simultaneously. A concrete example maps the skill `analyzing-network-traffic-of-malware` to ATT&CK technique T1071, NIST CSF category DE.CM, ATLAS technique AML.T0047, D3FEND technique D3-NTA, and AI RMF subcategory MEASURE-2.6 in a single file. The library installs via npx or git clone and works directly with Claude Code, GitHub Copilot, OpenAI Codex CLI, Cursor, and Gemini CLI. Security analysts, red teamers, and DevSecOps engineers building agentic workflows benefit most, as the skills cover domains including penetration testing, malware analysis, threat hunting, OSINT, incident response, and cloud security. The ATT&CK mappings are validated against the official mitreattack-python library with no revoked or deprecated technique IDs.
- ✓Open-source license (Apache-2.0)
- ✓Actively maintained (<30d)
- ✓Healthy fork ratio
- ✓Clear description
- ✓Topics declared
- ✓Documented (README)
git clone https://github.com/mukul975/Anthropic-Cybersecurity-Skills && cp Anthropic-Cybersecurity-Skills/*.md ~/.claude/agents/24 items in this repository
Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.
Detect dangerous ACL misconfigurations in Active Directory using ldap3
Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.
Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect
Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups' TTPs for detection-gap analysis. Use to compare threat-actor technique coverage, find gaps in detection engineering, or produce Navigator visualizations for threat-intel reporting.
Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query
Analyzes bootkit and advanced rootkit malware infecting the Master
Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX, JSON, or SQLite output). Use during incident response, insider-threat investigations, or criminal cases when you need to reconstruct a user's web activity from a browser profile.
Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts into confidence-weighted attribution assessments. Use when an incident investigation needs a defensible attribution confidence level.
Monitor Certificate Transparency logs using crt.sh and Certstream to
Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and time-series anomaly detection. Use when investigating suspected cloud data exfiltration or building related detection rules.
Extract and analyze Cobalt Strike beacon configuration from PE files
Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to extract HTTP/DNS transforms, URIs, headers, sleep/jitter, and injection behavior, then generate network detection signatures. Use when reverse-engineering a captured malleable profile or building detections against Cobalt Strike Beacon traffic.
Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom
Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain
Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining metadata and embedded artifacts, keyword searching, and building investigation timelines with visual reports. Use for structured analysis of a forensic disk image or when stakeholders need visual reports from evidence.
Analyzes DNS query logs to detect data exfiltration via DNS tunneling,
Investigate compromised Docker containers by analyzing images, layers,
Parse and analyze email headers (Received chain, Return-Path, Message-ID)
Perform static and symbolic analysis of Solidity smart contracts using
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo
Detect and analyze heap spray attacks in memory dumps using Volatility3
Subagents overview
<p align="center"> <img src="assets/banner.png" alt="Anthropic Cybersecurity Skills" width="100%"> </p> <div align="center"> # Anthropic Cybersecurity Skills ### The largest open-source cybersecurity skills library for AI agents [](https://mahipal.engineer/survey?utm_source=github_badge&utm_medium=readme&utm_campaign=gars2026) [](LICENSE) [](#whats-inside--34-security-domains) [](#six-frameworks-one-skill-library) [](https://ctid.mitre.org/fraud/) [](#whats-inside--34-security-domains) [](#compatible-platforms) [](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/stargazers) [](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/network/members) [](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/commits/main) [](https://agentskills.io) [](CONTRIBUTING.md) [](https://casky.ai/?utm_source=github&utm_medium=readme&utm_campaign=cohort_launch#waitlist) [](https://github.com/NousResearch/hermes-agent) **818 production-grade cybersecurity skills · 34 security domains · 6 framework mappings · 26+ AI platforms** [Get Started](#quick-start) · [What's Inside](#whats-inside--34-security-domains) · [Frameworks](#six-frameworks-one-skill-library) · [Platforms](#compatible-platforms) · [Contributing](#contributing) </div> --- > ⚠️ **Community Project** — This is an independent, community-created project. Not affiliated with Anthropic PBC. > > 🔐 **Authorized & lawful use only.** This library includes offensive and dual-use techniques (e.g. red-team C2, phishing simulation, exploitation) intended for **authorized penetration testing, security research, defense, and education**. Only use them against systems you own or have **explicit written permission** to test, and comply with all applicable laws and rules of engagement. You are solely responsible for how you use these skills. See [SECURITY.md](SECURITY.md) and [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md). ## Give any AI agent the security skills of a senior analyst A junior analyst knows which Volatility3 plugin to run on a suspicious memory dump, which Sigma rules catch Kerberoasting, and how to scope a cloud breach across three providers. **Your AI agent doesn't — unless you give it these skills.** This repo contains **818 structured cybersecurity skills** spanning **34 security domains**, each following the [agentskills.io](https://agentskills.io) open standard. The library maps across **six industry frameworks** — MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, MITRE D3FEND, NIST AI RMF, and the MITRE Fight Fraud Framework (F3) — with each skill mapped to the frameworks **relevant to its type** (a forensics skill carries ATT&CK + CSF; an AI-security skill adds ATLAS and AI RMF). Clone it, point your agent at it, and your next security investigation gets expert-level guidance in seconds. ## Six frameworks, one skill library Each skill maps to the frameworks that fit its subject — ATT&CK and NIST CSF are near-universal, while ATLAS, AI RMF, D3FEND, and F3 apply where they're relevant. **Framework coverage across the 817 skills:** MITRE ATT&CK **805** · NIST CSF 2.0 **804** · MITRE D3FEND **139** · NIST AI RMF **97** · MITRE F3 **94** · MITRE ATLAS **93**. | Framework | Version | Framework scope | What it maps | |---|---|---|---| | [MITRE ATT&CK](https://attack.mitre.org) | v19.1 | 15 tactics · Enterprise/Mobile/ICS | Adversary behaviors and TTPs | | [NIST CSF 2.0](https://www.nist.gov/cyberframework) | 2.0 | 6 functions · 22 categories · 106 subcategories | Organizational security posture | | [MITRE ATLAS](https://atlas.mitre.org) | 2026.07 | 101 techniques · 77 sub-techniques | AI/ML adversarial threats | | [MITRE D3FEND](https://d3fend.mitre.org) | v1.4.0 | 270 techniques | Defensive countermeasures | | [NIST AI RMF](https://airc.nist.gov/AI_RMF) | 1.0 | 4 functions (Govern/Map/Measure/Manage) | AI risk management | | [MITRE F3 (Fight Fraud Framework)](https://ctid.mitre.org/fraud/) | v1.1 (2026-04-09) | 8 tactics · 123 techniques · 94 fraud-relevant skills | Cyber-enabled financial fraud TTPs | **Example — each skill maps only to the frameworks relevant to it (one may hit all six, another just a couple):** | Skill | ATT&CK | NIST CSF | ATLAS | D3FEND | AI RMF | F3 | |---|---|---|---|---|---|---| | `analyzing-network-traffic-of-malware` | T1071 | DE.CM | AML.T0047 | D3-NTA | MEASURE-2.6 | — | | `detecting-business-email-compromise` | T1566 | DE.AE | — | — | — | F1005.006 · monetization | ### 🆕 MITRE Fight Fraud Framework (F3) — 94 fraud-relevant skills [](https://ctid.mitre.org/fraud/) The **[MITRE Fight Fraud Framework (F3)](https://ctid.mitre.org/fraud/)** was released **April 9, 2026** by MITRE's Center for Threat-Informed Defense (CTID), co-developed with JPMorganChase, Citigroup, Lloyds Banking Group, Standard Chartered, CrowdStrike, Verizon Business, FS-ISAC, and others. It is an ATT&CK-compatible TTP catalog for **cyber-enabled financial fraud** — filling the gap ATT&CK leaves after initial compromise. F3 v1.1 adds **two fraud-specific tactics** that ATT&CK does not enumerate: - **Positioning** (`FA0001`) — actions taken after access to collect/manipulate data and prepare the fraud (synthetic-identity seeding, account warming, beneficiary setup, SIM-swap pre-positioning, banking-session hijack). - **Monetization** (`FA0002`) — converting stolen assets into usable funds (money-mule layering, APP fraud, crypto off-ramping, card cash-out, refund/chargeback abuse). Fraud-specific techniques use `F1XXX` IDs (e.g. `F1005.003` Add Beneficiary, `F1025.003` Wire Transfer, `F1007` Adversary-in-the-Browser); reused ATT&CK techniques keep their `T1XXX` IDs. Mappings live in each skill's `mitre_f3:` frontmatter block — all 123 F3 v1.1 technique IDs were verified against the upstream STIX bundle. See [`docs/mitre-f3-mapping.md`](docs/mitre-f3-mapping.md) for the schema. ### MITRE ATT&CK v19.1 — 805/817 skills mapped Every skill carries a `mitre_attack` frontmatter list validated against **MITRE ATT&CK v19.1** (the latest release) using the official `mitreattack-python` library — 290 distinct techniques and sub-techniques (146 base + 144 sub) across Enterprise, ICS, and Mobile. Zero revoked or deprecated IDs. v19.1's restructured Defense Evasion (now split into **Stealth** and **Defense Impairment**) is reflected below. | Tactic | ID | Skills | |--------|----|--------| | Reconnaissance | TA0043 | 103 | | Resource Development | TA0042 | 22 | | Initial Access | TA0001 | 467 | | Execution | TA0002 | 350 | | Persistence | TA0003 | 444 | | Privilege Escalation | TA0004 | 464 | | Stealth | TA0005 | 442 | | Defense Impairment | TA0112 | 92 | | Credential Access | TA0006 | 202 | | Discovery | TA0007 | 237 | | Lateral Movement | TA0008 | 68 | | Collection | TA0009 | 172 | | Command and Control | TA0011 | 123 | | Exfiltration | TA0010 | 82 | | Impact | TA0040 | 50 | ## Quick start ```bash # Option 1: npx (recommended) npx skills add mukul975/Anthropic-Cybersecurity-Skills # Option 2: Git clone git clone https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git cd Anthropic-Cybersecurity-Skills ``` Works immediately with Claude Code, GitHub Copilot, OpenAI Codex CLI, Cursor, Gemini CLI, and any [agentskills.io](https://agentskills.io)-compatible platform. ## 🌍 GARS-2026 — Global Agentic AI Readiness Survey I'm running a global academic study measuring how ready security professionals, developers, and enterprise teams actually are for agentic AI — MCP servers, tool calling, governance, and human-in-the-loop workflows. **If you use this repo, your response would be a genuinely valuable data point.** 📋 **Take the survey (10 min):** [Survey Link](https://mahipal.engineer/survey?utm_source=github_repo&utm_medium=readme&utm_campaign=gars2026) - 60 questions · Anonymous · Supervised by SRH Berlin - You get **50 Casky Tokens** for early access to [casky.ai](https://casky.ai) - Results published open access under CC-BY 4.0 ## 🚀 Try it on the Playground Experience Casky.ai hands-on — no setup required. **[→ Launch Playground on Casky.ai](https://casky.ai/?utm_source=github&utm_medium=readme&utm_campaign=cohort_launch#waitlist)** The playground lets you: - Run live cybersecurity skill exercises against real targets - See AI agents execute structured skills in real time - Explore MITRE ATT&CK mapped workflows interactively - Test threat hunting, DFIR, and penetration testing scenarios No installation. No configuration. Just open and start. ## Why this exists The cybersecurity workforce gap hit **4.8 million unfilled roles** globally in 2024 (ISC2). AI agents can help clos
What people ask about Anthropic-Cybersecurity-Skills
What is mukul975/Anthropic-Cybersecurity-Skills?
+
mukul975/Anthropic-Cybersecurity-Skills is subagents for the Claude AI ecosystem. 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains · Apache 2.0 It has 32.6k GitHub stars and its last recorded update is dated 2026-08-31.
How do I install Anthropic-Cybersecurity-Skills?
+
You can install Anthropic-Cybersecurity-Skills by cloning the repository (https://github.com/mukul975/Anthropic-Cybersecurity-Skills) or following the README instructions on GitHub. ClaudeWave also provides quick install blocks on this page.
Is mukul975/Anthropic-Cybersecurity-Skills safe to use?
+
Our security agent has analyzed mukul975/Anthropic-Cybersecurity-Skills and assigned a Trust Score of 100/100 (tier: Verified). See the full breakdown of passed checks and flags on this page.
Who maintains mukul975/Anthropic-Cybersecurity-Skills?
+
mukul975/Anthropic-Cybersecurity-Skills is maintained by mukul975. The last recorded GitHub activity is dated 2026-08-31, with 45 open issues.
Are there alternatives to Anthropic-Cybersecurity-Skills?
+
Yes. On ClaudeWave you can browse similar subagents at /categories/agents, sorted by popularity or recent activity.
Deploy Anthropic-Cybersecurity-Skills to your cloud
Ship this repo to production in minutes. Each platform spins up its own environment with editable env vars.
Maintain this repo? Add a badge to your README
Drop the badge into your GitHub README to show it's tracked on ClaudeWave. Each badge links back to this page and reflects the live Trust Score.
[](https://claudewave.com/repo/mukul975-anthropic-cybersecurity-skills)<a href="https://claudewave.com/repo/mukul975-anthropic-cybersecurity-skills"><img src="https://claudewave.com/api/badge/mukul975-anthropic-cybersecurity-skills" alt="Featured on ClaudeWave: mukul975/Anthropic-Cybersecurity-Skills" width="320" height="64" /></a>More Subagents
The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.
The agent that grows with you
Java 面试 & 后端通用面试指南，覆盖计算机基础、数据库、分布式、高并发、系统设计与 AI 应用开发
Build Agentic workflows, RAG pipelines, with rich AI model and tool support on one collaborative workspace. Deploy on cloud, VPC, or self-hosted, so teams move from prototype to production without rebuilding the stack.
The agent engineering platform.
Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote.