mukul975/Anthropic-Cybersecurity-Skills
817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI,
ARCHETYPE
Skill Collector
Ten-plus skills loaded on demand. A procedural-knowledge library.
Copy this rig
# review before running: this installs third-party code
$ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills ./rig-anthropic-cybersecurity-skills/skills MCP servers are added to Claude Code at local scope; env vars are shown as YOUR_… placeholders — we never store values. Files are fetched with degit into a separate folder so you can review before merging.
$ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/abusing-dpapi-for-credential-access .claude/skills/abusing-dpapi-for-credential-access $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/abusing-shadow-credentials-for-privesc .claude/skills/abusing-shadow-credentials-for-privesc $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/achieving-cmmc-level-2-compliance .claude/skills/achieving-cmmc-level-2-compliance $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/acquiring-di<redacted> .claude/skills/acquiring-di<redacted> $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-active-directory-acl-abuse .claude/skills/analyzing-active-directory-acl-abuse $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-android-malware-with-apktool .claude/skills/analyzing-android-malware-with-apktool $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-api-gateway-access-logs .claude/skills/analyzing-api-gateway-access-logs $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-apt-group-with-mitre-navigator .claude/skills/analyzing-apt-group-with-mitre-navigator $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-azure-activity-logs-for-threats .claude/skills/analyzing-azure-activity-logs-for-threats $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-bootkit-and-rootkit-samples .claude/skills/analyzing-bootkit-and-rootkit-samples $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-browser-forensics-with-hindsight .claude/skills/analyzing-browser-forensics-with-hindsight $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-campaign-attribution-evidence .claude/skills/analyzing-campaign-attribution-evidence $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-certificate-transparency-for-phishing .claude/skills/analyzing-certificate-transparency-for-phishing $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-cloud-storage-access-patterns .claude/skills/analyzing-cloud-storage-access-patterns $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-cobalt-strike-beacon-configuration .claude/skills/analyzing-cobalt-strike-beacon-configuration $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-cobaltstrike-malleable-c2-profiles .claude/skills/analyzing-cobaltstrike-malleable-c2-profiles $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-command-and-control-communication .claude/skills/analyzing-command-and-control-communication $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-cyber-kill-chain .claude/skills/analyzing-cyber-kill-chain $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-di<redacted> .claude/skills/analyzing-di<redacted> $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-dns-logs-for-exfiltration .claude/skills/analyzing-dns-logs-for-exfiltration $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-docker-container-forensics .claude/skills/analyzing-docker-container-forensics $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-email-headers-for-phishing-investigation .claude/skills/analyzing-email-headers-for-phishing-investigation $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-ethereum-smart-contract-vulnerabilities .claude/skills/analyzing-ethereum-smart-contract-vulnerabilities $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-golang-malware-with-ghidra .claude/skills/analyzing-golang-malware-with-ghidra $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-heap-spray-exploitation .claude/skills/analyzing-heap-spray-exploitation $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-indicators-of-compromise .claude/skills/analyzing-indicators-of-compromise $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-ios-app-security-with-objection .claude/skills/analyzing-ios-app-security-with-objection $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-kubernetes-audit-logs .claude/skills/analyzing-kubernetes-audit-logs $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-linux-audit-logs-for-intrusion .claude/skills/analyzing-linux-audit-logs-for-intrusion $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-linux-elf-malware .claude/skills/analyzing-linux-elf-malware $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-linux-kernel-rootkits .claude/skills/analyzing-linux-kernel-rootkits $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-linux-system-artifacts .claude/skills/analyzing-linux-system-artifacts $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-lnk-file-and-jump-list-artifacts .claude/skills/analyzing-lnk-file-and-jump-list-artifacts $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-macro-malware-in-office-documents .claude/skills/analyzing-macro-malware-in-office-documents $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-malicious-pdf-with-peepdf .claude/skills/analyzing-malicious-pdf-with-peepdf $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-malicious-url-with-urlscan .claude/skills/analyzing-malicious-url-with-urlscan $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-malware-behavior-with-cuckoo-sandbox .claude/skills/analyzing-malware-behavior-with-cuckoo-sandbox $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-malware-family-relationships-with-malpedia .claude/skills/analyzing-malware-family-relationships-with-malpedia $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-malware-persistence-with-autoruns .claude/skills/analyzing-malware-persistence-with-autoruns $ npx degit mukul975/Anthropic-Cybersecurity-Skills/skills/analyzing-malware-sandbox-evasion-techniques .claude/skills/analyzing-malware-sandbox-evasion-techniques
This rig commits no guardrails. Here is the community baseline instead — the deny/ask rules most often found across all 7,204 rigs:
{
"permissions": {
"deny": [
"Read(./.env)",
"Read(**/.env)",
"Read(~/.ssh/**)",
"Bash(rm -rf *)",
"Read(**/*.pem)",
"Bash(rm -rf /)",
"Bash(git push --force:*)",
"Bash(sudo *)",
"Read(.env)",
"Bash(rm -rf /*)",
"Read(./.env.*)",
"Read(~/.aws/**)",
"Bash(git push --force*)",
"Bash(rm -rf:*)",
"Read(**/*.key)",
"Read(**/.env.*)",
"Bash(sudo:*)",
"Bash(git reset --hard*)",
"Bash(git reset --hard:*)",
"Read(.env.*)"
],
"ask": [
"Bash(git push:*)",
"Bash(git push *)",
"Bash(git commit:*)",
"Bash(rm *)",
"Bash(rm:*)",
"Bash(git rebase *)",
"Bash(wget *)",
"Bash(npm publish:*)",
"Bash(git commit *)",
"Bash(gh pr merge *)"
]
}
} Skills (150)
abusing-dpapi-for-credential-accessabusing-shadow-credentials-for-privescachieving-cmmc-level-2-complianceacquiring-di<redacted>analyzing-active-directory-acl-abuseanalyzing-android-malware-with-apktoolanalyzing-api-gateway-access-logsanalyzing-apt-group-with-mitre-navigatoranalyzing-azure-activity-logs-for-threatsanalyzing-bootkit-and-rootkit-samplesanalyzing-browser-forensics-with-hindsightanalyzing-campaign-attribution-evidenceanalyzing-certificate-transparency-for-phishinganalyzing-cloud-storage-access-patternsanalyzing-cobalt-strike-beacon-configurationanalyzing-cobaltstrike-malleable-c2-profilesanalyzing-command-and-control-communicationanalyzing-cyber-kill-chainanalyzing-di<redacted>analyzing-dns-logs-for-exfiltrationanalyzing-docker-container-forensicsanalyzing-email-headers-for-phishing-investigationanalyzing-ethereum-smart-contract-vulnerabilitiesanalyzing-golang-malware-with-ghidraanalyzing-heap-spray-exploitationanalyzing-indicators-of-compromiseanalyzing-ios-app-security-with-objectionanalyzing-kubernetes-audit-logsanalyzing-linux-audit-logs-for-intrusionanalyzing-linux-elf-malwareanalyzing-linux-kernel-rootkitsanalyzing-linux-system-artifactsanalyzing-lnk-file-and-jump-list-artifactsanalyzing-macro-malware-in-office-documentsanalyzing-malicious-pdf-with-peepdfanalyzing-malicious-url-with-urlscananalyzing-malware-behavior-with-cuckoo-sandboxanalyzing-malware-family-relationships-with-malpediaanalyzing-malware-persistence-with-autorunsanalyzing-malware-sandbox-evasion-techniquesanalyzing-memory-dumps-with-volatilityanalyzing-memory-forensics-with-lime-and-volatilityanalyzing-mft-for-deleted-file-recoveryanalyzing-network-covert-channels-in-malwareanalyzing-network-flow-data-with-netflowanalyzing-network-packets-with-scapyanalyzing-network-traffic-for-incidentsanalyzing-network-traffic-of-malwareanalyzing-network-traffic-with-wiresharkanalyzing-office365-audit-logs-for-compromiseanalyzing-outlook-pst-for-email-forensicsanalyzing-packed-malware-with-upx-unpackeranalyzing-pdf-malware-with-pdfidanalyzing-persistence-mechanisms-in-linuxanalyzing-powershell-empire-artifactsanalyzing-powershell-script-block-logginganalyzing-prefetch-files-for-execution-historyanalyzing-ransomware-encryption-mechanismsanalyzing-ransomware-leak-site-intelligenceanalyzing-ransomware-network-indicatorsanalyzing-ransomware-payment-walletsanalyzing-sbom-for-supply-chain-vulnerabilitiesanalyzing-security-logs-with-splunkanalyzing-slack-space-and-file-system-artifactsanalyzing-supply-chain-malware-artifactsanalyzing-threat-actor-ttps-with-mitre-attackanalyzing-threat-actor-ttps-with-mitre-navigatoranalyzing-threat-intelligence-feedsanalyzing-threat-landscape-with-mispanalyzing-tls-certificate-transparency-logsanalyzing-typosquatting-domains-with-dnstwistanalyzing-uefi-bootkit-persistenceanalyzing-usb-device-connection-historyanalyzing-web-server-logs-for-intrusionanalyzing-windows-amcache-artifactsanalyzing-windows-event-logs-in-splunkanalyzing-windows-lnk-files-for-artifactsanalyzing-windows-prefetch-with-pythonanalyzing-windows-registry-for-artifactsanalyzing-windows-shellbag-artifactsassessing-vector-and-embedding-weaknessesattacking-entra-id-with-roadtoolsattacking-oauth-with-device-code-phishingauditing-aws-s3-bucket-permissionsauditing-azure-active-directory-configurationauditing-cloud-with-cis-benchmarksauditing-entra-id-with-aadinternalsauditing-foundry-smart-contract-securityauditing-gcp-iam-permissionsauditing-kubernetes-cluster-rbacauditing-kubernetes-rbac-privilege-escalationauditing-mcp-servers-for-tool-poisoningauditing-terraform-infrastructure-for-securityauditing-tls-certificate-transparency-logsauditing-uefi-firmware-with-chipsecautomating-ioc-enrichmentbenchmarking-kubernetes-with-kube-benchbuilding-adversary-infrastructure-tracking-systembuilding-attack-pattern-library-from-cti-reportsbuilding-automated-malware-submission-pipelinebuilding-c2-infrastructure-with-sliver-frameworkbuilding-c2-redirector-infrastructurebuilding-cloud-siem-with-sentinelbuilding-detection-rule-with-splunk-splbuilding-detection-rules-with-sigmabuilding-devsecops-pipeline-with-gitlab-cibuilding-identity-federation-with-saml-azure-adbuilding-identity-governance-lifecycle-processbuilding-incident-response-dashboardbuilding-incident-response-playbookbuilding-incident-timeline-with-timesketchbuilding-ioc-defanging-and-sharing-pipelinebuilding-ioc-enrichment-pipeline-with-openctibuilding-malware-incident-communication-templatebuilding-patch-tuesday-response-processbuilding-phishing-reporting-button-workflowbuilding-ransomware-playbook-with-cisa-frameworkbuilding-red-team-c2-infrastructure-with-havocbuilding-role-mining-for-rbac-optimizationbuilding-soc-escalation-matrixbuilding-soc-metrics-and-kpi-trackingbuilding-soc-playbook-for-ransomwarebuilding-super-timelines-with-plasobuilding-threat-actor-profile-from-osintbuilding-threat-feed-aggregation-with-mispbuilding-threat-hunt-hypothesis-frameworkbuilding-threat-intelligence-enrichment-in-splunkbuilding-threat-intelligence-feed-integrationbuilding-threat-intelligence-platformbuilding-vulnerability-aging-and-sla-trackingbuilding-vulnerability-dashboard-with-defectdojobuilding-vulnerability-exception-tracking-systembuilding-vulnerability-scanning-workflowbypassing-authentication-with-forced-browsingcoercing-authentication-with-coercer-petitpotamcollecting-indicators-of-compromisecollecting-open-source-intelligencecollecting-threat-intelligence-with-mispcollecting-volatile-evidence-from-compromised-hostconducting-api-security-testingconducting-cloud-incident-responseconducting-cloud-penetration-testingconducting-cyber-ri<redacted>conducting-domain-persistence-with-dcsyncconducting-external-reconnaissance-with-osintconducting-full-scope-red-team-engagementconducting-gdpr-compliance-assessmentconducting-internal-network-penetration-testconducting-internal-reconnaissance-with-bloodhound-ceconducting-malware-incident-response
Similar rigs
obra/superpowers
An agentic skills framework & software development methodology that works.
Skill Collector 3.0k tok ·
anthropics/skills
Public repository for Agent Skills
Skill Collector 1.3k tok ·
anthropics/claude-code
Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflows - all through natural language commands.
Skill Collector 1.4k tok ·
JuliusBrussee/caveman
🪨 why use many token when few token do trick. Viral skill + proxy for coding agents that cuts 65% of tokens by talking like a caveman.
Skill Collector 16.5k tok ·