Skip to content

Back to the catalog

mukul975/Anthropic-Cybersecurity-Skills
github.comrepo

mukul975/Anthropic-Cybersecurity-Skills

A community-maintained GitHub repo providing 818 structured, YAML-frontmatter skill files (e.g. Volatility3 memory forensics, Kerberoasting hunting, cloud breach scoping) that AI coding agents like Claude Code, GitHub Copilot, or Cursor can load to follow senior-analyst-level security workflows. Each skill is mapped against MITRE ATT&CK v19.1, MITRE ATLAS, MITRE D3FEND, NIST CSF 2.0, NIST AI RMF, and the newly released MITRE Fight Fraud Framework (F3), and follows the agentskills.io progressive-disclosure standard for token-efficient agent discovery. Covers offensive (red-team C2, phishing simulation, exploitation), defensive (DFIR, threat hunting, Sigma detections), cloud, and AI-security domains.

TL;DR 818-skill, framework-mapped cybersecurity playbook library built for AI coding agents (agentskills.io standard).
Open original ↗
Document

What it is

mukul975/Anthropic-Cybersecurity-Skills is a community GitHub repo of agentskills.io-format security skills. Despite the "Anthropic" in the name, the page's own banner states it is "an independent, community-created project. Not affiliated with Anthropic PBC." The summary's framework and domain coverage is accurate, but the page surfaces several things a summary of the library's contents cannot.

Provenance and trust signals

  • Naming is misleading by design — the repo carries Anthropic's name in the title but is unaffiliated. Treat it as an unvetted community project, not a first-party Anthropic resource.
  • Offensive / dual-use content. The repo explicitly includes "red-team C2, phishing simulation, exploitation" intended for authorized testing only. Point an agent at it knowing it can surface offensive TTPs; scope its use to systems you own or have written permission to test.
  • Bundled promotion. The page is also a funnel for a third-party product, Casky.ai: a 60-question "academic study" survey (supervised by SRH Berlin, rewarded with "50 Casky Tokens") and a hosted "playground" that claims to "run live cybersecurity skill exercises against real targets." Evaluate the repo's skill files independently of these offers.

What to do

Install verbatim as the page gives it:

npx skills add mukul975/Anthropic-Cybersecurity-Skills
git clone https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
cd Anthropic-Cybersecurity-Skills

Works with Claude Code, GitHub Copilot, OpenAI Codex CLI, Cursor, Gemini CLI, and other agentskills.io platforms. Each skill costs ~30 tokens to scan (frontmatter only), 500–2,000 to load fully — relevant to context budgeting if you attach the whole library.

Verification claims worth checking

  • ATT&CK mappings validated against v19.1 via mitreattack-python: 290 distinct techniques (146 base + 144 sub) across Enterprise, ICS, Mobile, "zero revoked or deprecated IDs."
  • All 123 F3 v1.1 technique IDs verified against the upstream STIX bundle. Note the MITRE Fight Fraud Framework (F3) is dated April 9, 2026 — a very recent framework, so downstream tooling support is thin.

Caveats

The skill count is inconsistent within the page itself — the header and intro say 818, while the domain and framework tables repeatedly say 817. Framework coverage is partial by design: ATT&CK (805) and NIST CSF (804) are near-universal, but D3FEND (139), AI RMF (97), F3 (94), and ATLAS (93) apply to only a minority of skills. All validation claims are self-reported by the author; none are independently audited.

Organisations named here

  • agentskills.io
  • MITRE D3FEND

Technologies named here

  • Volatility3
  • Sigma rules
  • MITRE ATT&CK Navigator
  • mitreattack-python
  • Casky.ai Playground
  • npx skills
  • MITRE ATT&CK
  • MITRE ATLAS
  • NIST CSF
  • Model Context Protocol
  • Claude Code
  • GitHub Copilot
  • NIST AI RMF
  • MITRE Fight Fraud Framework

Techniques named here

  • Credential Dumping
  • Kerberoasting
  • Memory forensics analysis
  • D3FEND Model/Preprocessing Sequence Meta-Data mapping
  • Positioning
  • Monetization
  • Add Beneficiary
  • Wire Transfer
  • Adversary-in-the-Browser
  • Defense Evasion split

Related in Blue Team & Detection