Anthropic Cybersecurity Skills

# Anthropic Cybersecurity Skills

Gives AI agents 818 cybersecurity skills across 34 security domains, each mapped to frameworks such as MITRE ATT&CK and NIST CSF 2.0. For analysts, defenders and security researchers.

Made by mukul975 on GitHub. These notes are Mindket's, written from its README; the project's own files and license are in its repository.

## About

What it is: This kit holds notes on a library of 818 structured cybersecurity skills for AI agents, spread over 34 security domains. A skill is a set of guidance an agent can follow for one task, such as scoping a cloud breach or picking the right memory forensics plugin. The project's code lives in its own repository.

Who it suits: It suits security analysts, defenders, researchers and students who want an AI agent to work from structured security guidance instead of general memory.

```table
Industry | Who uses it | How they use it | Example
Security operations | SOC analysts | Ask the agent to help write or choose detection rules | Which Sigma rules catch Kerberoasting
Incident response | Responders and forensic analysts | Get guidance while investigating a compromised system | Picking a memory forensics plugin for a suspicious dump
Cloud security | Cloud and DevSecOps engineers | Scope an incident that touches several cloud providers | Scoping a breach across three providers
Fraud prevention | Fraud and risk teams | Spot cyber-enabled financial fraud patterns | Detecting business email compromise
Security training | Educators and students | Learn defensive and offensive methods in a lab setting | Practising phishing simulation on systems you own
```

You can skip it if you have no security work, or if you only want one narrow tool rather than a broad library.

Where to use it: The project is built for AI coding and security agents that read skills.

- Claude Code: the project lists it among its topics
- Hermes Agent: marked as compatible in the project's badges
- Other agent platforms: the project says it supports more than 26 of them

```table
Use case | Who | What they get back
Memory dump triage | Forensic analyst | Guidance on which tool and plugin to run first
Detection engineering | SOC analyst | Pointers to rules that catch a named attack technique
Cloud breach scoping | Cloud security engineer | A method for working across several providers
Fraud detection | Risk analyst | Guidance on spotting business email compromise
```

How to set it up: You need an AI agent that can read skills and a copy of the repository on your machine.

- An AI agent that supports the open skills standard the project follows
- Git, to copy the repository

1. Clone the repository to your computer.
2. Point your agent at the cloned skills.
3. Ask your first security question and see which skill the agent picks up.

Example: Ask your agent, "Which Sigma rules would catch Kerberoasting in my logs?" With the skills loaded, it can work from the matching skill's guidance instead of guessing. What you get back depends on your agent and which skill it finds.

For newcomers and experts: If you are new, think of a skill as a checklist your agent reads before it starts a job. Try one small thing first: copy the repository, point your agent at it, and ask a question from your own field.

If you work in security, note how the mappings are organised. A skill's mappings follow its subject. Forensics work gets ATT&CK and NIST CSF, and AI-security work gains ATLAS and AI RMF on top. The trade-off is uneven coverage, as the chart below shows.

```flow
You clone the skills library
Your agent reads the skill it needs
The skill carries its framework mappings
The agent answers your security task
```

Good to know: Read these points before you run anything.

- License: Apache-2.0
- It is an independent community project and is not affiliated with Anthropic PBC
- It includes offensive and dual-use techniques such as red-team C2, phishing simulation and exploitation
- Run those only on systems you own, or on ones where you hold written approval to test
- You are responsible for following the law and the rules of engagement

```chart
Title: Skills mapped per framework
MITRE ATT&CK: 805 skills
NIST CSF 2.0: 804 skills
MITRE D3FEND: 139 skills
NIST AI RMF: 97 skills
MITRE F3: 94 skills
MITRE ATLAS: 93 skills
```

## On GitHub, 15 November 2026

- Stars: 36,154
- Forks: 4,426
- Watching: 273
- Open issues and pull requests: 69
- Language: Python
- License: Apache-2.0
- Topics: ai-agents, claude-code, cloud-security, cybersecurity, devsecops, ethical-hacking, incident-response, infosec, llm, malware-analysis, mcp, mitre-attack

## Links

- Code: https://github.com/mukul975/anthropic-cybersecurity-skills
- Website: https://mahipal.engineer/Anthropic-Cybersecurity-Skills/
- Releases: https://github.com/mukul975/anthropic-cybersecurity-skills/releases
- Issues: https://github.com/mukul975/anthropic-cybersecurity-skills/issues
- Star history: https://www.star-history.com/#mukul975/anthropic-cybersecurity-skills&Date

## Get the code

```
git clone https://github.com/mukul975/anthropic-cybersecurity-skills.git
```

Then follow the setup in its README. Nothing in this kit runs by itself.

README.md  5 KB