Anthropic Cybersecurity Skills
A cybersecurity skill library: forensics, incident response, pentesting, cloud and malware analysis mapped to MITRE ATT&CK and NIST
- 35,232 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- Includes offensive techniques such as credential extraction
- Instructions have the agent run security tools on hosts
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/anthropic-cybersecurity-skillsDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Includes offensive techniques such as credential extraction
- Instructions have the agent run security tools on hosts
This is third-party code. Review the repository files before installing.
What it does
Each skill covers one security analyst task: when to apply a technique, what to check first, which tools to run and how to verify the result. Topics include memory and disk forensics, threat hunting in logs, phishing analysis, cloud security, AI system security and financial fraud. Skill metadata lists MITRE ATT&CK techniques, NIST CSF categories and, where relevant, MITRE ATLAS, D3FEND, NIST AI RMF and MITRE F3. Some skills describe offensive techniques for authorized red team work.
Who it is for. For SOC analysts, incident responders and penetration testers who work with agents.
Good fit when
- You need a step-by-step incident or disk image investigation with an agent
- You need detection rules mapped to ATT&CK
- You need to run an authorized penetration test by a methodology
Not a fit when
- You lack written permission to test the target systems
- You need general code hygiene rather than security analyst work
Example request
Analyze this memory dump suspected of Cobalt Strike and list the indicators of compromiseLimitations
The project is independent and not affiliated with Anthropic despite the name. Skills reference third-party tools (Volatility, Splunk, Mimikatz, Impacket and others) that must be installed separately. Offensive techniques are only for systems you own or have written permission to test. The library is large, so install it wholesale only if your agent loads skills on demand.
How to disable. Remove installed skills with npx skills remove or uninstall the cybersecurity-skills plugin via /plugin.
FAQ
Is this an official Anthropic project?
No, it is a community project, as the README states.
Which agents does it support?
Skills follow the agentskills.io format, and the README names Claude Code, GitHub Copilot, Codex CLI, Cursor and Gemini CLI.
How are Anthropic Cybersecurity Skills different from generic security skills?
Each skill describes one analyst task: when to apply the technique, what to check first, which tools to run and how to confirm the result. Topics are forensics, incident response, pentest, cloud and malware, mapped to MITRE ATT&CK and NIST.
How do I install Anthropic Cybersecurity Skills, and is it an official Anthropic project?
npx skills add mukul975/Anthropic-Cybersecurity-Skills installs the set into Claude Code, Copilot, Codex, Cursor and Gemini CLI. The name contains Anthropic, but it is a third-party community repository.
Discussion
No questions or reviews yet.
Related
SkillsClaude Code CyberSecurity Skills
Claude Code CyberSecurity Skill Collection
A set of 22 cybersecurity skills for Claude Code: recon, vulnerability assessment, incident response, red and blue team, malware analysis
A practical security skills base for agents: web, API, privilege escalation, Active Directory, mobile, binaries and crypto
A library of offensive security skills for the Claude Skills system: red team methodology across dozens of areas
CTF Skills
ctf-skills
Skills for solving CTF challenges: web, pwn, crypto, reverse engineering, forensics, OSINT, malware and ML attacks
A security scanner for agent skills: finds prompt injection, data exfiltration and malicious code before you install
A pack of CTF skills: one entry point classifies a challenge and routes it to a focused skill for crypto, forensics, pwn, reverse and OSINT
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Repository stars | Main difference |
|---|---|---|---|
| Anthropic Cybersecurity Skills (this entry) | no | 35,232 | |
| Defending Code Reference Harness | yes | 7,672 | anthropic's reference set for defending code |
| Trail of Bits Skills Curated | yes | 523 | a Claude Code marketplace from Trail of Bits |
| YesWeHack Claude Kit | yes | 354 | a Claude Code plugin that helps write bug bounty reports from |
README in short
The README describes the library of structured security skills and mapping tables for six frameworks, including the recent MITRE Fight Fraud Framework for financial fraud. Installation is one npx skills command or a git clone, and a Claude Code marketplace is also included. It stresses that the project is independent and offensive techniques are for authorized testing. The README also promotes a survey and the Casky.ai playground, which are unrelated to the skills. Apache 2.0 licensed.
README badge
Original SKILL.md
--- name: abusing-dpapi-for-credential-access description: Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host. domain: cybersecurity subdomain: red-teaming tags: - red-team - credential-access - dpapi - sharpdpapi - post-exploitation - active-directory - windows - mimikatz version: '1.0' author: mahipal license: Apache-2.0 nist_csf: - DE.CM-01 mitre_attack: - T1555.004 --- # Abusing DPAPI for Credential Access > **Legal Notice:** This skill is for authorized penetration testing, red-team engagements, and educational purposes only. Extracting credentials from systems you do not own or lack explicit written authorization to test is illegal and may violate computer fraud and abuse laws. Always operate within a signed rules-of-engagement and document every action. ## Overview