Claude Code CyberSecurity Skills

Install

/plugin marketplace add Masriyan/Claude-Code-CyberSecurity-Skill
/plugin install cybersecurity@cybersecurity-skills

This is third-party code. Review the repository files before installing.

What it does

The set gives Claude Code structured methodology across 22 security domains: recon and OSINT, vulnerability assessment, exploit development, reverse engineering, malware analysis, threat hunting, incident response, network, web and cloud security, SOC automation, log analysis, crypto analysis, red and blue team, AI and LLM security, mobile, industrial (OT/ICS), GRC, supply chain, threat intelligence and purple team. Each skill is a SKILL.md file with activation triggers, step-by-step methodology, ready commands and report templates, and several skills ship Python scripts. Offensive domains such as exploit development and red team require an authorization confirmation before the agent proceeds. Content is mapped to MITRE ATT&CK, OWASP, NIST and other industry frameworks.

Who it is for. For security professionals: pentesters, SOC analysts, incident responders and defensive engineers working in Claude Code.

Example request

Create a ransomware incident response playbook for our SOC team

Limitations

The set is intended only for authorized testing, research, CTF and education. Some scripts need Python 3.10+ and separate libraries and tools (nmap, YARA, Volatility, Trivy and others); without them those features are skipped. The user is responsible for the legality of use. Some antivirus engines flag payload templates as detections, which the author treats as false positives.

How to disable. Remove the installed skill folders from ~/.claude/skills/ or the project's .claude/skills/ directory. If installed as a plugin, remove it via /plugin.

Security check

• Includes offensive techniques: exploit development, payload generation and red team operations
• Scripts run security tools and network commands on hosts

README in short

The README describes a collection of 22 skills that turn Claude Code into a cybersecurity assistant, split into offensive, defensive and operational domains. Skills install by copying into ~/.claude/skills/ globally or the project's .claude/skills/, or as a plugin via the marketplace.json file. Each skill has YAML frontmatter, activation triggers, methodology, output templates and script references. Scripts mostly use the Python standard library; some need requests, pyyaml, scapy and other packages. MIT license, version 3.1.

SKILL.md

---
name: Reconnaissance & OSINT Automation
description: Passive and active reconnaissance, subdomain enumeration, DNS analysis, technology fingerprinting, and OSINT data correlation for authorized security assessments
version: 3.1.0
author: Masriyan
tags: [cybersecurity, reconnaissance, osint, enumeration, dns, subdomain, fingerprinting]
---

# Reconnaissance & OSINT Automation

## Purpose

Enable Claude to conduct comprehensive reconnaissance and open-source intelligence gathering during authorized security assessments. Claude performs passive and active recon using its native analysis capabilities and orchestrates the included scripts for automation at scale.

> **Authorization Required**: Always confirm written authorization for the target scope before proceeding. Unauthorized reconnaissance is illegal in most jurisdictions.

## Activation Triggers

This skill activates when the user asks about:
- Subdomain enumeration or discovery
- DNS reconnaissance, zone transfers, or DNS record analysis
- OSINT gathering on a domain, organization, or person
- Technology fingerprinting or stack identification
- Port scanning, service detection, or banner grabbing

Related