# Anthropic-Cybersecurity-Skills

> A library of 800+ security how-to skills that AI coding agents can load and follow

- Repository: https://github.com/mukul975/Anthropic-Cybersecurity-Skills
- Category: Agent skills & plugins
- Stars: 34,869 · Forks: 4,241 · Language: Python · License: Apache-2.0
- Experience: Some experience
- Page: https://ir.adyog.com/repos/mukul975/anthropic-cybersecurity-skills/

A general-purpose AI agent can write code, but it often lacks the habits of a security analyst: which tool to run on a memory dump, what to check first, how to confirm a result. This repo packages that kind of practitioner guidance as skills an agent can read when a task calls for it.

Each skill follows the agentskills.io open standard. It has YAML frontmatter so the agent can find the right skill quickly, structured Markdown with prerequisites and steps, and reference files for deeper detail. The skills span dozens of domains, from cloud, SOC and threat hunting to malware analysis, OT/ICS and AI security. The README's counts vary slightly (817 or 818 skills, 29 or 34 domains).

Skills are mapped to the frameworks that fit them: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF and MITRE's Fight Fraud Framework. The README contrasts it with repos of wordlists, payloads or exploit code, since this one targets the agent's decision workflow. It is a community project, not affiliated with Anthropic. It includes offensive and dual-use techniques meant only for authorized testing, research, defense and education.

## What it does

- **Many skills across many domains**: Covers cloud security, SOC operations, threat hunting, threat intelligence, web app security, digital forensics, malware analysis, red teaming, container security and more.
- **Mapped to six frameworks**: Each skill carries mappings relevant to it, such as ATT&CK technique IDs, NIST CSF categories, D3FEND countermeasures, ATLAS and AI RMF for AI topics, and F3 for fraud.
- **agentskills.io format**: Skills use YAML frontmatter plus structured Markdown and reference files, so any compatible agent platform can discover and use them.
- **Works with many agents**: The README lists Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI and other agentskills.io-compatible tools.
- **Fraud and AI security coverage**: Includes 94 fraud-relevant skills mapped to MITRE F3 and a set of AI security skills on LLM red-teaming, prompt injection and MCP security.

## What you could build

- Ask a coding agent to walk through a memory forensics investigation using a vetted step-by-step skill.
- Build detection and threat hunting workflows tied to specific MITRE ATT&CK techniques.
- Run authorized penetration tests or red-team exercises with an agent following structured playbooks.
- Draft incident response and ransomware playbooks with an agent that knows the standard steps.
- Study how security tasks map to ATT&CK, NIST CSF and D3FEND by reading the skill files.

## Who it's for

Suits security practitioners, students and developers who already use an AI coding agent and want it to handle security tasks; know the agent's skills system and only test systems you are authorized to.

## Get started

Install the skills with npx into your agent, or clone the repo and point your agent at the skills folder. Then ask your agent a security task and let it pick the matching skill.

```
npx skills add mukul975/Anthropic-Cybersecurity-Skills
```
```
git clone https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
```
```
cd Anthropic-Cybersecurity-Skills
```

Tags: cybersecurity, agent-skills, mitre-attack, threat-hunting, claude-code