← Back to the directory

mukul975/Anthropic-Cybersecurity-Skills

Loading README…

Framework	Version	Framework scope	What it maps
MITRE ATT&CK	v19.1	15 tactics · Enterprise/Mobile/ICS	Adversary behaviors and TTPs
NIST CSF 2.0	2.0	6 functions · 22 categories · 106 subcategories	Organizational security posture
MITRE ATLAS	2026.07	101 techniques · 77 sub-techniques	AI/ML adversarial threats
MITRE D3FEND	v1.4.0	270 techniques	Defensive countermeasures
NIST AI RMF	1.0	4 functions (Govern/Map/Measure/Manage)	AI risk management
MITRE F3 (Fight Fraud Framework)	v1.1 (2026-04-09)	8 tactics · 123 techniques · 94 fraud-relevant skills	Cyber-enabled financial fraud TTPs

Skill	ATT&CK	NIST CSF	ATLAS	D3FEND	AI RMF	F3
`analyzing-network-traffic-of-malware`	T1071	DE.CM	AML.T0047	D3-NTA	MEASURE-2.6	—
`detecting-business-email-compromise`	T1566	DE.AE	—	—	—	F1005.006 · monetization

Tactic	ID	Skills
Reconnaissance	TA0043	103
Resource Development	TA0042	22
Initial Access	TA0001	467
Execution	TA0002	350
Persistence	TA0003	444
Privilege Escalation	TA0004	464
Stealth	TA0005	442
Defense Impairment	TA0112	92
Credential Access	TA0006	202
Discovery	TA0007	237
Lateral Movement	TA0008	68
Collection	TA0009	172
Command and Control	TA0011	123
Exfiltration	TA0010	82
Impact	TA0040	50

Domain	Skills	Key capabilities
Cloud Security	66	AWS, Azure, GCP hardening · CSPM · cloud attack emulation · cloud forensics
SOC Operations	63	Playbooks · escalation workflows · Graph-log detection · tabletop exercises
Threat Hunting	58	Hypothesis-driven hunts · LOTL detection · EVTX hunting · fleet hunting
Threat Intelligence	52	STIX/TAXII · MISP · OpenCTI · feed integration · actor profiling
Web Application Security	46	OWASP Top 10 · SQLi · XSS · SSRF · deserialization
Network Security	43	IDS/IPS · firewall rules · VLAN segmentation · traffic analysis
Digital Forensics	41	Disk imaging · memory forensics · Hayabusa/KAPE/Plaso timelines
Identity & Access Management	40	Entra ID/ROADtools · device-code phishing · PAM · zero trust identity
Malware Analysis	39	Static/dynamic analysis · reverse engineering · sandboxing
Red Teaming	35	ADCS/Certipy · BloodHound CE · Sliver/Havoc C2 · NTLM relay
Container Security	33	K8s RBAC · image scanning · Falco · container escape
OT/ICS Security	29	Modbus · DNP3 · IEC 62443 · historian defense · SCADA
API Security	28	GraphQL · REST · OWASP API Top 10 · WAF bypass
Incident Response	26	Breach containment · ransomware response · IR playbooks
Vulnerability Management	25	Nessus · scanning workflows · patch prioritization · CVSS
Penetration Testing	23	Network · web · cloud · mobile · NetExec lateral movement
DevSecOps	18	CI/CD security · Trivy IaC/image scanning · code signing
Zero Trust Architecture	18	BeyondCorp · CISA maturity model · microsegmentation
Endpoint Security	17	EDR · LOTL detection · fileless malware · persistence hunting
Phishing Defense	16	Email authentication · BEC detection · phishing IR
Cryptography	16	TLS · Ed25519 · post-quantum migration · key management
AI Security	14	LLM red-teaming (garak/PyRIT) · prompt injection · MCP/agentic security · guardrails
Mobile Security	13	Android/iOS analysis · mobile pentesting · MDM forensics
Ransomware Defense	13	Precursor detection · response · recovery · encryption analysis
Compliance & Governance	10	NIST 800-30/RMF · CMMC · HIPAA · TPRM · CIS benchmarks
Supply Chain Security	8	SBOMs · dependency confusion · malicious-package triage · SLSA/Sigstore
Threat Detection	7	Credential dumping · golden-ticket forgery · pass-the-ticket · LOLBAS · UEBA insider signals
Hardware & Firmware Security	6	CHIPSEC/UEFI audit · Secure Boot bypass · TPM attestation · bootkit hunting
Deception Technology	6	Honeytokens · canarytokens · breach detection
Blockchain Security	2	Ethereum smart-contract vulnerabilities · Foundry audit workflows
Wireless Security	2	Bluetooth Low Energy attack detection · BLE security assessment
Privacy Compliance	2	GDPR data-subject access requests · privacy impact assessments
Data Protection	1	Data loss prevention with Microsoft Purview
Purple Team	1	Atomic Red Team purple-team testing

Tactic	ID	Coverage	Key skills
Reconnaissance	TA0043	Strong	OSINT, subdomain enumeration, DNS recon
Resource Development	TA0042	Moderate	Phishing infrastructure, C2 setup detection
Initial Access	TA0001	Strong	Phishing simulation, exploit detection, forced browsing
Execution	TA0002	Strong	PowerShell analysis, fileless malware, script block logging
Persistence	TA0003	Strong	Scheduled tasks, registry, service accounts, LOTL
Privilege Escalation	TA0004	Strong	Kerberoasting, AD attacks, cloud privilege escalation
Stealth	TA0005	Strong	Obfuscation, rootkit analysis, evasion detection
Defense Impairment	TA0112	Moderate	Impair Defenses (T1562), log/indicator removal, EDR tampering
Credential Access	TA0006	Strong	Mimikatz detection, pass-the-hash, credential dumping
Discovery	TA0007	Moderate	BloodHound, AD enumeration, network scanning
Lateral Movement	TA0008	Strong	SMB exploits, lateral movement detection with Splunk
Collection	TA0009	Moderate	Email forensics, data staging detection
Command and Control	TA0011	Strong	C2 beaconing, DNS tunneling, Cobalt Strike analysis
Exfiltration	TA0010	Strong	DNS exfiltration, DLP controls, data loss detection
Impact	TA0040	Strong	Ransomware defense, encryption analysis, recovery

mukul975/Anthropic-Cybersecurity-Skills

Anthropic Cybersecurity Skills

The largest open-source cybersecurity skills library for AI agents

Give any AI agent the security skills of a senior analyst

Six frameworks, one skill library

🆕 MITRE Fight Fraud Framework (F3) — 94 fraud-relevant skills

MITRE ATT&CK v19.1 — 805/817 skills mapped

Quick start

🌍 GARS-2026 — Global Agentic AI Readiness Survey

🚀 Try it on the Playground

Why this exists

What's inside — 34 security domains

How AI agents use these skills

Skill anatomy

YAML frontmatter (real example)

Markdown body sections

MITRE ATLAS 2026.07 — AI/ML adversarial threats

MITRE D3FEND v1.4.0 — Defensive countermeasures

NIST AI RMF 1.0 + GenAI Profile (AI 600-1)

Compatible platforms

What people are saying

Featured in

Star history

Releases

Contributing

🙏 Thanks to our contributors

Community

Citation

License

Function	Skills	Examples
Govern (GV)	30+	Risk strategy, policy frameworks, roles & responsibilities
Identify (ID)	120+	Asset discovery, threat landscape assessment, risk analysis
Protect (PR)	150+	IAM hardening, WAF rules, zero trust, encryption
Detect (DE)	200+	Threat hunting, SIEM correlation, anomaly detection
Respond (RS)	160+	Incident response, forensics, breach containment
Recover (RC)	40+	Ransomware recovery, BCP, disaster recovery

Where	Type	Link
awesome-agent-skills	Awesome List (1,000+ skills index)	VoltAgent/awesome-agent-skills
awesome-ai-security	Awesome List (AI security tools)	ottosulin/awesome-ai-security
awesome-codex-cli	Awesome List (Codex CLI resources)	RoggeOhta/awesome-codex-cli
SkillsLLM	Skills directory & marketplace	skillsllm.com/skill/anthropic-cybersecurity-skills
Openflows	Signal analysis & tracking	openflows.org
NeverSight skills_feed	Automated skills index	NeverSight/skills_feed