Claude Code CyberSecurity Skills
Claude Code CyberSecurity Skill Collection
A set of 22 cybersecurity skills for Claude Code: recon, vulnerability assessment, incident response, red and blue team, malware analysis
- 531 ★ on the repository
- Last commit
Broad access
Why this level
- Includes offensive techniques: exploit development, payload generation and red team operations
- Scripts run security tools and network commands on hosts
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/claude-code-cybersecurity-skill-collectionDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Includes offensive techniques: exploit development, payload generation and red team operations
- Scripts run security tools and network commands on hosts
This is third-party code. Review the repository files before installing.
What it does
The set gives Claude Code structured methodology across 22 security domains: recon and OSINT, vulnerability assessment, exploit development, reverse engineering, malware analysis, threat hunting, incident response, network, web and cloud security, SOC automation, log analysis, crypto analysis, red and blue team, AI and LLM security, mobile, industrial (OT/ICS), GRC, supply chain, threat intelligence and purple team. Each skill is a SKILL.md file with activation triggers, step-by-step methodology, ready commands and report templates, and several skills ship Python scripts. Offensive domains such as exploit development and red team require an authorization confirmation before the agent proceeds. Content is mapped to MITRE ATT&CK, OWASP, NIST and other industry frameworks.
Who it is for. For security professionals: pentesters, SOC analysts, incident responders and defensive engineers working in Claude Code.
Good fit when
- You need methodology and commands for an authorized pentest or incident analysis
- You need to build detection rules, YARA or Sigma, and SOC reports
- You need to analyze logs, PCAP or a suspicious file together with the agent
Not a fit when
- You have no written authorization to test the target
- You need one-off advice without installing a set of skills and scripts
Example request
Create a ransomware incident response playbook for our SOC teamLimitations
The set is intended only for authorized testing, research, CTF and education. Some scripts need Python 3.10+ and separate libraries and tools (nmap, YARA, Volatility, Trivy and others); without them those features are skipped. The user is responsible for the legality of use. Some antivirus engines flag payload templates as detections, which the author treats as false positives.
How to disable. Remove the installed skill folders from ~/.claude/skills/ or the project's .claude/skills/ directory. If installed as a plugin, remove it via /plugin.
FAQ
Are these legal tools?
The set targets authorized testing, CTF, research and education. Offensive skills such as exploit development and red team require confirming authorization for the target before the agent proceeds.
Do I have to install all 22 skills?
No. You can copy only the folders you need into the skills directory, for example incident response and log analysis.
Discussion
No questions or reviews yet.
Related
SkillsA library of offensive security skills for the Claude Skills system: red team methodology across dozens of areas
A cybersecurity skill library: forensics, incident response, pentesting, cloud and malware analysis mapped to MITRE ATT&CK and NIST
A skill and command bundle for authorized bug bounty and external red-team work in Claude Code: methodology, chain templates and reports
Claude Skills for GRC
Claude Skills for Governance, Risk & Compliance (GRC)
A set of governance, risk and compliance skills: ISO 27001, SOC 2, GDPR, HIPAA, PCI DSS, NIST, the EU AI Act and other frameworks
Anthropic's reference set for defending code: threat-model, vuln-scan, triage and patch skills in Claude Code plus an autonomous vulnerability pipeline
A set of skills for external OSINT recon: methodology, tactical arsenal and deep attack-surface analysis for authorized assessments
README in short
The README describes a collection of 22 skills that turn Claude Code into a cybersecurity assistant, split into offensive, defensive and operational domains. Skills install by copying into ~/.claude/skills/ globally or the project's .claude/skills/, or as a plugin via the marketplace.json file. Each skill has YAML frontmatter, activation triggers, methodology, output templates and script references. Scripts mostly use the Python standard library; some need requests, pyyaml, scapy and other packages. MIT license, version 3.1.
README badge
Original SKILL.md
--- name: Reconnaissance & OSINT Automation description: Passive and active reconnaissance, subdomain enumeration, DNS analysis, technology fingerprinting, and OSINT data correlation for authorized security assessments version: 3.1.0 author: Masriyan tags: [cybersecurity, reconnaissance, osint, enumeration, dns, subdomain, fingerprinting] --- # Reconnaissance & OSINT Automation ## Purpose Enable Claude to conduct comprehensive reconnaissance and open-source intelligence gathering during authorized security assessments. Claude performs passive and active recon using its native analysis capabilities and orchestrates the included scripts for automation at scale. > **Authorization Required**: Always confirm written authorization for the target scope before proceeding. Unauthorized reconnaissance is illegal in most jurisdictions. ## Activation Triggers This skill activates when the user asks about: - Subdomain enumeration or discovery - DNS reconnaissance, zone transfers, or DNS record analysis - OSINT gathering on a domain, organization, or person - Technology fingerprinting or stack identification - Port scanning, service detection, or banner grabbing