Anthropic Cybersecurity Skills

Install

npx skills add mukul975/Anthropic-Cybersecurity-Skills

This is third-party code. Review the repository files before installing.

What it does

Each skill covers one security analyst task: when to apply a technique, what to check first, which tools to run and how to verify the result. Topics include memory and disk forensics, threat hunting in logs, phishing analysis, cloud security, AI system security and financial fraud. Skill metadata lists MITRE ATT&CK techniques, NIST CSF categories and, where relevant, MITRE ATLAS, D3FEND, NIST AI RMF and MITRE F3. Some skills describe offensive techniques for authorized red team work.

Who it is for. For SOC analysts, incident responders and penetration testers who work with agents.

Example request

Analyze this memory dump suspected of Cobalt Strike and list the indicators of compromise

Limitations

The project is independent and not affiliated with Anthropic despite the name. Skills reference third-party tools (Volatility, Splunk, Mimikatz, Impacket and others) that must be installed separately. Offensive techniques are only for systems you own or have written permission to test. The library is large, so install it wholesale only if your agent loads skills on demand.

How to disable. Remove installed skills with npx skills remove or uninstall the cybersecurity-skills plugin via /plugin.

Security check

• Includes offensive techniques such as credential extraction
• Instructions have the agent run security tools on hosts

README in short

The README describes the library of structured security skills and mapping tables for six frameworks, including the recent MITRE Fight Fraud Framework for financial fraud. Installation is one npx skills command or a git clone, and a Claude Code marketplace is also included. It stresses that the project is independent and offensive techniques are for authorized testing. The README also promotes a survey and the Casky.ai playground, which are unrelated to the skills. Apache 2.0 licensed.

SKILL.md

---
name: abusing-dpapi-for-credential-access
description: Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.
domain: cybersecurity
subdomain: red-teaming
tags:
- red-team
- credential-access
- dpapi
- sharpdpapi
- post-exploitation
- active-directory
- windows
- mimikatz
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- DE.CM-01
mitre_attack:
- T1555.004
---
# Abusing DPAPI for Credential Access

> **Legal Notice:** This skill is for authorized penetration testing, red-team engagements, and educational purposes only. Extracting credentials from systems you do not own or lack explicit written authorization to test is illegal and may violate computer fraud and abuse laws. Always operate within a signed rules-of-engagement and document every action.

## Overview

Related