Explore the full catalog
Explore skills, repositories and creators
Search the catalog or browse with filters. Checks are automated signals, not a safety guarantee.
Page 110 · 50 results shown
Skill
andrej-karpathy-perspective
alchaincyf/nuwa-skill · examples/andrej-karpathy-perspective
Andrej Karpathy的思维框架与表达方式。基于20+篇博文、16段深度访谈、100+条X帖子的系统蒸馏， 提炼6个核心心智模型、8条决策启发式、完整的中文输出适配和经典句式速查。 用途：作为思维顾问，用Karpathy的视角分析AI技术可靠性、学习方法、行业趋势、产品设计。 当用户提到「用Karpathy的视角」「Karpathy会怎么看」「卡帕西」「karpathy模式」时使用。 也适用于：Software 2.0/3.0讨论、vibe coding话题、神经网络训练、AI炒作判断、LLM能力边界。 即使用户只是说「从工程现实主义角度」「march of nines」「构建即理解」「锯齿状智能」也可触发。 不在用户只是普通问AI相关问题时触发——只在明确想要Karpathy式思维框架时激活。
Repository stars: 37,757 · Incomplete scan
Skill
taleb-perspective
alchaincyf/nuwa-skill · examples/taleb-perspective
塔勒布(Nassim Nicholas Taleb)的思维框架与表达方式。基于40+个来源的深度调研， 提炼6个核心心智模型、9条决策启发式和完整的表达DNA。 用途：作为思维顾问，用塔勒布的视角分析问题、审视决策、质疑主流叙事。 当用户提到「用塔勒布的视角」「塔勒布会怎么看」「塔勒布模式」「反脆弱视角」「taleb perspective」时使用。 即使用户只是说「会不会黑天鹅」「这个有尾部风险吗」「skin in the game」「有没有反脆弱的方法」「杠铃策略怎么用」也可触发。 不要在用户只是做一般风险评估或问「靠不靠谱」时触发——只在涉及极端风险、反脆弱、预防原则等塔勒布核心概念时激活。
Repository stars: 37,757 · Incomplete scan
Skill
sun-yuchen-perspective
alchaincyf/nuwa-skill · examples/sun-yuchen-perspective
孙宇晨（Justin Sun / 孙割）的思维框架与行为逻辑。基于6个维度（著作、深度采访、表达DNA、 他者视角、决策记录、时间线）共1500+行调研素材的深度蒸馏， 提炼6个核心心智模型、8条决策启发式、5种割味造句公式和完整的表达DNA。 用途：作为思维顾问，用孙宇晨的视角分析营销策略、注意力经济、危机公关、叙事操控、蹭热点方法论。 割味十足的角色扮演——自大、暴论、碰瓷、数字轰炸、成功学底色。 当用户提到「用孙宇晨的视角」「孙割会怎么做」「孙宇晨模式」「Justin Sun perspective」「割神」时使用。 即使用户只是说「帮我用孙割的角度想想」「如果孙宇晨会怎么操作」「切换到割神」「用割的视角」也应触发。
Repository stars: 37,757 · Incomplete scan
Skill
naval-perspective
alchaincyf/nuwa-skill · examples/naval-perspective
Naval Ravikant的思维操作系统。基于著作、播客、推文、决策记录和外部批评的深度调研， 提炼5个核心心智模型、8条决策启发式和完整的表达DNA。 激活后沉浸式扮演Naval，直接以「我」的视角回应问题。 当用户提到「用Naval的视角」「Naval会怎么看」「纳瓦尔模式」「Naval perspective」「切换到Naval」时使用。 即使用户只是说「这份工作有杠杆吗」「什么是specific knowledge」「什么是真正的财富」「欲望太多怎么办」「无需许可的路径」也可触发。 不要在用户只是问「我该怎么选择」「帮我想清楚」等一般性决策问题时触发——只在涉及杠杆/特定知识/欲望管理/财富定义等Naval核心概念时激活。
Repository stars: 37,757 · Incomplete scan
Skill
mrbeast-perspective
alchaincyf/nuwa-skill · examples/mrbeast-perspective
MrBeast（Jimmy Donaldson）的内容创造操作系统。基于泄露的36页内部培训手册、 6个深度播客、决策记录和外部批评的深度调研，提炼6个核心心智模型、8条决策启发式、 完整的标题/缩略图/Hook/节奏公式，和4个可运行的内容分析脚本。 激活后沉浸式扮演MrBeast，直接以「我」的视角给出内容创作建议。 当用户提到「用MrBeast的视角」「MrBeast会怎么做」「Beast模式」「mrbeast perspective」时使用。 即使用户只是说「视频CTR怎么提升」「标题不够吸引人」「retention曲线怎么优化」「缩略图要改吗」也应触发。 不要在用户只是说「内容创作建议」「怎么做内容」等一般性问题时触发——只在涉及视频优化、标题/缩略图/Hook/留存率等YouTube方法论时激活。
Repository stars: 37,757 · Incomplete scan
Skill
trump-perspective
alchaincyf/nuwa-skill · examples/trump-perspective
唐纳德·特朗普（Donald Trump）的思维框架与行为逻辑。基于著作、长访谈、辩论、 心理分析、前幕僚回忆录、重大决策记录共6个维度的深度调研（320KB+原始资料）， 提炼6个核心心智模型、8条决策启发式和完整的表达DNA。 用途：（1）思维顾问——用特朗普视角分析谈判、权力、传播问题； （2）行为预判——解读他的公开行为背后的逻辑，预判下一步动作； （3）角色扮演——模拟特朗普在特定场景下的决策和表达。 当用户提到「用懂王视角」「特朗普会怎么看」「懂王逻辑」「trump perspective」 「懂王会怎么做」「从特朗普角度分析」「预测特朗普」时触发。
Repository stars: 37,757 · Incomplete scan
Skill
zhang-yiming-perspective
alchaincyf/nuwa-skill · examples/zhang-yiming-perspective
张一鸣（字节跳动/TikTok创始人）的思维框架与表达方式。基于6个维度（著作、深度访谈、 表达DNA、他者视角、决策记录、时间线）的调研，涵盖32个访谈片段、12个重大决策案例， 提炼5个核心心智模型、7条决策启发式和完整的表达DNA。 用途：作为思维顾问，用张一鸣的视角分析产品、组织、全球化、人才和个人成长问题。 当用户提到「用张一鸣的视角」「张一鸣会怎么看」「一鸣的思路」「zhang yiming perspective」时使用。 即使用户只是说「帮我用张一鸣的角度想想」「如果是字节会怎么做」「切换到张一鸣」也应触发。 即使用户说「字节怎么看」「头条的逻辑」「一鸣怎么选择」「一鸣」也应触发。
Repository stars: 37,757 · Incomplete scan
Skill
feynman-perspective
alchaincyf/nuwa-skill · examples/feynman-perspective
理查德·费曼的思维框架与表达方式。基于40+个一手来源的深度调研， 提炼5个核心心智模型、8条决策启发式和完整的表达DNA。 用途：作为思维顾问，用费曼的视角分析问题、审视决策、提供反馈。 当用户提到「用费曼的视角」「费曼会怎么看」「费曼模式」「feynman perspective」「费曼学习法」时使用。 即使用户只是说「这是不是cargo cult」「命名不等于理解」「能不能做个演示替代论证」「我真的理解了还是只记住了名字」也可触发。 不要在用户只是说「帮我解释一下」「用简单的话说」等一般性请求时触发——只在涉及费曼式验证（货物崇拜检测、命名vs理解、反自欺）时激活。
Repository stars: 37,757 · Incomplete scan
Skill
zhangxuefeng-perspective
alchaincyf/nuwa-skill · examples/zhangxuefeng-perspective
张雪峰的思维框架与表达方式。基于5本著作、15+篇权威媒体深度采访、 30+条一手语录、11个关键决策记录和完整人生时间线的深度调研， 提炼5个核心心智模型、8条决策启发式和完整的表达DNA。 用途：作为思维顾问，用张雪峰的视角分析教育选择、职业规划、阶层流动等问题。 当用户提到「用张雪峰的视角」「张雪峰会怎么看」「张雪峰模式」「雪峰视角」时使用。 即使用户只是说「帮我用张雪峰的角度想想」「如果张雪峰会怎么说」「切换到张雪峰」也应触发。
Repository stars: 37,757 · Incomplete scan
Skill
paul-graham-perspective
alchaincyf/nuwa-skill · examples/paul-graham-perspective
Paul Graham的思维框架与表达方式。基于200+篇essays、12个播客/访谈、 Twitter/X分析、7位核心批评者视角和完整人生时间线的深度调研， 提炼5个核心心智模型、8条决策启发式和完整的表达DNA。 用途：作为思维顾问，用PG的视角分析创业、写作、产品和人生选择。 当用户提到「用PG的视角」「Paul Graham会怎么看」「PG模式」「paul graham perspective」时使用。 即使用户只是说「帮我用PG的角度想想」「如果PG会怎么做」「切换到PG」也应触发。
Repository stars: 37,757 · Incomplete scan
Skill
ilya-sutskever-perspective
alchaincyf/nuwa-skill · examples/ilya-sutskever-perspective
Ilya Sutskever的思维框架与表达方式。基于12段一手对话、9篇学术论文、10小时宣誓证词、 27篇推荐阅读清单和14个权威二手来源的深度调研， 提炼6个核心心智模型、8条决策启发式和完整的表达DNA。 用途：作为思维顾问，用Ilya的视角分析AI技术方向、安全策略、研究品味。 当用户提到「用Ilya的视角」「Ilya会怎么看」「Ilya模式」「ilya perspective」 「sutskever perspective」时使用。 即使用户只是说「帮我用Ilya的角度想想」「如果Ilya会怎么做」「切换到Ilya」也应触发。
Repository stars: 37,757 · Incomplete scan
Skill
book-to-skill
virgiliojr94/book-to-skill · Root skill
Converts books and documents (PDF, EPUB, DOCX, HTML, Markdown, plain text, RTF, MOBI/AZW with Calibre) into structured agent skills, extracting frameworks, mental models, principles, techniques, and anti-patterns. Use when the user wants to study a document through GitHub Copilot CLI, Amp, Claude Code, Hermes Agent, OpenCode, or OpenClaw, apply an author's frameworks while working, or build a reusable knowledge base from a file.
Repository stars: 37,217 · Incomplete scan
Skill
securing-kubernetes-on-cloud
mukul975/Anthropic-Cybersecurity-Skills · skills/securing-kubernetes-on-cloud
Hardens managed Kubernetes clusters on EKS, AKS, and GKE by implementing Pod Security Standards, network policies, workload identity (IRSA for EKS, Workload Identity for GKE, Managed Identities for AKS), RBAC scoping, image admission controls, and runtime security monitoring. Use when deploying a new managed Kubernetes cluster with security requirements or hardening an existing EKS, AKS, or GKE cluster after an audit or pentest finding.
Repository stars: 35,755 · Incomplete scan
Skill
extracting-credentials-from-memory-dump
mukul975/Anthropic-Cybersecurity-Skills · skills/extracting-credentials-from-memory-dump
Extracts cached credentials, password hashes, Kerberos tickets, and authentication tokens from Windows memory dumps using Volatility 3, Mimikatz, and pypykatz. Use when performing memory forensics or incident response on an LSASS or full memory dump and you need to recover credentials or Kerberos material for investigation.
Repository stars: 35,755 · Incomplete scan
Skill
building-vulnerability-aging-and-sla-tracking
mukul975/Anthropic-Cybersecurity-Skills · skills/building-vulnerability-aging-and-sla-tracking
Implement a vulnerability aging dashboard and SLA tracking system that measures time-to-remediation against severity-based deadlines (e.g. 14 days critical, 30 days high, 60 days medium, 90 days low), with automated escalations and compliance metrics reporting. Use when designing SLA policies, building aging/remediation dashboards, or proving compliance with remediation timelines.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-network-deception-with-honeypots
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-network-deception-with-honeypots
Deploy and manage network honeypots using OpenCanary, T-Pot, or Cowrie to detect unauthorized access, lateral movement, and attacker reconnaissance.
Repository stars: 35,755 · Incomplete scan
Skill
performing-ios-app-security-assessment
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-ios-app-security-assessment
Performs comprehensive iOS application security assessments using Frida for dynamic instrumentation, Objection for runtime exploration, SSL pinning bypass for traffic interception, keychain extraction for credential analysis, and IPA static analysis for binary-level review. Use when conducting authorized iOS penetration tests, evaluating mobile app security posture against OWASP MASTG, or assessing iOS app data protection and transport security controls. Activates for requests involving iOS app pentesting, Frida-based iOS instrumentation, mobile app SSL pinning bypass, or IPA reverse engineering.
Repository stars: 35,755 · Incomplete scan
Skill
remediating-s3-bucket-misconfiguration
mukul975/Anthropic-Cybersecurity-Skills · skills/remediating-s3-bucket-misconfiguration
Provides step-by-step procedures for remediating Amazon S3 bucket misconfigurations that expose sensitive data: enabling S3 Block Public Access, auditing bucket policies and ACLs, enforcing encryption, configuring access logging, and deploying automated remediation with AWS Config and Lambda. Use when AWS Config or Security Hub flags public or unencrypted S3 buckets, or preparing audit evidence for storage security controls.
Repository stars: 35,755 · Incomplete scan
Skill
performing-windows-artifact-analysis-with-eric-zimmerman-tools
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools
Performs comprehensive Windows forensic artifact analysis using Eric Zimmerman's open-source EZ Tools suite (KAPE, MFTECmd, PECmd, LECmd, JLECmd, Timeline Explorer) to parse registry hives, prefetch files, event logs, and file system metadata. Use during DFIR investigations that need a timeline of program execution, file access, and persistence built from Windows artifacts.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-aws-guardduty-findings-automation
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-aws-guardduty-findings-automation
Build automated AWS GuardDuty finding response pipelines using EventBridge and Lambda to trigger real-time incident response, automatically quarantine compromised resources, and route security notifications. Use when designing automated remediation playbooks for GuardDuty findings across VPC Flow Logs, CloudTrail, DNS, EKS, or S3 data events, or when reducing mean time to respond to cloud threats.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-zero-trust-network-access-with-zscaler
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-zero-trust-network-access-with-zscaler
Configures Zero Trust Network Access using Zscaler Private Access (ZPA) to broker identity-based, context-aware connections between authenticated users and internal applications through the Zscaler Zero Trust Exchange, without placing users on the corporate network. Use when replacing traditional VPN architectures with ZTNA, or when brokering secure per-application access for remote and hybrid users via Zscaler.
Repository stars: 35,755 · Incomplete scan
Skill
analyzing-cobalt-strike-beacon-configuration
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-cobalt-strike-beacon-configuration
Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure, malleable profiles, and operator tradecraft.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-dns-exfiltration-with-dns-query-analysis
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-dns-exfiltration-with-dns-query-analysis
Detect data exfiltration via DNS tunneling (tools like iodine, dnscat2, dns2tcp) by analyzing query entropy, subdomain length, query volume to single domains, TXT/CNAME/NULL record abuse, and oversized response payloads using passive DNS monitoring and statistical/ML methods. Use when hunting for covert DNS-based data exfiltration or building a passive DNS anomaly detection capability.
Repository stars: 35,755 · Incomplete scan
Skill
performing-active-directory-penetration-test
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-active-directory-penetration-test
Conduct a focused Active Directory penetration test using BloodHound, Impacket, Certipy, Rubeus, and NetExec to enumerate domain objects, discover attack paths, exploit Kerberos weaknesses, escalate privileges via ADCS/DCSync, and demonstrate domain compromise. Use when running an authorized AD pentest from a standard domain user foothold toward Domain Admin or Enterprise Admin.
Repository stars: 35,755 · Incomplete scan
Skill
performing-indicator-lifecycle-management
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-indicator-lifecycle-management
Tracks IOCs through discovery, enrichment/validation (VirusTotal, Shodan, passive DNS), deployment to SIEM/IDS watchlists, hit-rate and false-positive monitoring, confidence-score decay, and automated expiration using MISP/OpenCTI and STIX. Use when building or maintaining a threat intelligence indicator lifecycle process, aging out stale IOCs, or reducing analyst fatigue from low-quality indicators.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-siem-use-case-tuning
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-siem-use-case-tuning
Tune SIEM detection rules in Splunk and Elastic to reduce false positives by analyzing alert volumes, creating context-aware exclusion lists, adjusting thresholds against environmental baselines, and measuring precision/recall efficacy metrics. Use when a SOC is drowning in noisy alerts and needs to tune correlation searches or detection rules, or when measuring and reporting alert-to-incident conversion rates.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-attack-surface-management
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-attack-surface-management
Implements external attack surface management (EASM) using Shodan, Censys, and ProjectDiscovery tools (subfinder, httpx, nuclei) for asset discovery, subdomain enumeration, service fingerprinting, and exposure scoring. Includes a weighted risk scoring algorithm based on OWASP attack surface analysis methodology and the Relative Attack Surface Quotient (RSQ). Use when building continuous ASM programs or performing external reconnaissance for security assessments.
Repository stars: 35,755 · Incomplete scan
Skill
performing-log-source-onboarding-in-siem
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-log-source-onboarding-in-siem
Perform structured log source onboarding into SIEM platforms (Splunk, Elastic, Sentinel, QRadar, or similar) by prioritizing sources with a tiered value framework, configuring collectors, building parsers, normalizing fields to a common schema (e.g. CIM), and validating data quality. Use when planning or executing the integration of new log sources — such as Active Directory, firewalls, EDR, VPN, DNS, or cloud audit logs — into a SIEM for security monitoring and detection.
Repository stars: 35,755 · Incomplete scan
Skill
performing-ssl-certificate-lifecycle-management
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-ssl-certificate-lifecycle-management
Automates the full SSL/TLS certificate lifecycle, including generating Certificate Signing Requests, issuing, deploying, monitoring, renewing, and revoking X.509 certificates, using Python and ACME protocol tools. Use when managing certificate issuance or renewal, preventing certificate-expiry outages, or building automated PKI/ACME workflows.
Repository stars: 35,755 · Incomplete scan
Skill
escaping-containers-to-host
mukul975/Anthropic-Cybersecurity-Skills · skills/escaping-containers-to-host
Exploits privileged pods, host mounts, runC CVEs, and exposed Docker sockets to break out of a container and reach the underlying host during an authorized container-security assessment. Use when executing an approved breakout test, demonstrating the real impact of a privileged or hostPath workload, or validating that escape mitigations actually hold. Keywords: container breakout, privileged, hostPath, docker.sock, runC CVE-2019-5736, CVE-2024-21626, release_agent, nsenter. Do not use for defensive detection of these techniques - use detecting-container-escape-attempts.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-zero-trust-with-beyondcorp
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-zero-trust-with-beyondcorp
Configures Google BeyondCorp Enterprise Identity-Aware Proxy (IAP) as the access enforcement point for web applications, defining Access Context Manager access levels from device trust and network attributes, and auditing the resulting policies for compliance. Use when eliminating perimeter/VPN trust for GCP resources or internal apps, or when setting up identity- and device-posture-based access controls on Google Cloud.
Repository stars: 35,755 · Incomplete scan
Skill
performing-gcp-security-assessment-with-forseti
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-gcp-security-assessment-with-forseti
Performing comprehensive security assessments of Google Cloud Platform environments using Forseti Security, Security Command Center, and gcloud CLI to audit IAM policies, firewall rules, storage permissions, and compliance against CIS GCP Foundations Benchmark.
Repository stars: 35,755 · Incomplete scan
Skill
testing-for-json-web-token-vulnerabilities
mukul975/Anthropic-Cybersecurity-Skills · skills/testing-for-json-web-token-vulnerabilities
Tests JWT implementations for algorithm confusion, "none" algorithm bypass, kid/jku parameter injection, and weak secret exploitation using jwt_tool and Burp Suite's JWT Editor extension, aiming to achieve authentication bypass and privilege escalation. Use when assessing JWT-based auth/session management, OAuth2/OIDC token handling, or SSO systems during a security engagement.
Repository stars: 35,755 · Incomplete scan
Skill
configuring-pfsense-firewall-rules
mukul975/Anthropic-Cybersecurity-Skills · skills/configuring-pfsense-firewall-rules
Configures pfSense firewall rules, NAT policies, IPsec/OpenVPN tunnels, and traffic shaping to enforce network segmentation and control traffic between zones such as DMZ, internal, guest, and IoT. Use when deploying a pfSense perimeter or internal firewall, setting up port-forwarding NAT, configuring site-to-site or remote-access VPNs, or applying QoS/bandwidth policies.
Repository stars: 35,755 · Incomplete scan
Skill
automating-ioc-enrichment
mukul975/Anthropic-Cybersecurity-Skills · skills/automating-ioc-enrichment
Automates the enrichment of raw indicators of compromise with multi-source threat intelligence context using SOAR platforms, Python pipelines, or TIP playbooks to reduce analyst triage time and standardize enrichment outputs. Use when building automated enrichment workflows integrated with SIEM alerts, email submission pipelines, or bulk IOC processing from threat feeds. Activates for requests involving SOAR enrichment, Cortex XSOAR, Splunk SOAR, TheHive, Python enrichment pipelines, or automated IOC processing.
Repository stars: 35,755 · Incomplete scan
Skill
analyzing-api-gateway-access-logs
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-api-gateway-access-logs
Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts. Uses pandas for statistical analysis of request patterns and anomaly detection. Use when investigating API abuse or building API-specific threat detection rules.
Repository stars: 35,755 · Incomplete scan
Skill
hunting-for-dns-tunneling-with-zeek
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-for-dns-tunneling-with-zeek
Detects DNS tunneling and covert-channel data exfiltration by analyzing Zeek dns.log for high-entropy subdomain queries, excessive query volume, abnormally long query lengths, and unusual DNS record types (TXT/NULL/CNAME). Use when hunting for DNS-based data exfiltration or C2 covert channels in network traffic, or when triaging suspicious DNS query volume/patterns surfaced by Zeek logs.
Repository stars: 35,755 · Incomplete scan
Skill
performing-privilege-escalation-on-linux
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-privilege-escalation-on-linux
Guides manual enumeration and automated tooling to escalate from a low-privilege Linux user to root by exploiting misconfigurations, vulnerable services, kernel exploits, and weak permissions, mapped to MITRE ATT&CK. Use during authorized red team engagements or penetration tests once initial low-privilege access on a Linux host is obtained and root-level access is needed.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-rbac-hardening-for-kubernetes
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-rbac-hardening-for-kubernetes
Hardens Kubernetes RBAC by designing least-privilege Roles and ClusterRoles, auditing RoleBindings, eliminating cluster-admin sprawl, separating service accounts, and integrating an external OIDC identity provider. Use when tightening cluster access control, removing excessive ClusterRoleBindings, or hardening service-account permissions against escalation and lateral movement. Keywords: RBAC, Role, ClusterRole, RoleBinding, least privilege, service account, OIDC, cluster-admin. Do not use for discovering existing escalation paths - use auditing-kubernetes-rbac-privilege-escalation.
Repository stars: 35,755 · Incomplete scan
Skill
reverse-engineering-malware-with-ghidra
mukul975/Anthropic-Cybersecurity-Skills · skills/reverse-engineering-malware-with-ghidra
Reverse engineers malware binaries using NSA's Ghidra disassembler and decompiler to study internal logic, cryptographic routines, C2 protocols, and evasion techniques at the assembly and pseudo-C level. Use when static or dynamic analysis flags suspicious functionality needing deeper code review, such as reversing C2 protocols, encryption algorithms, custom obfuscation, or a sample's exploit mechanism.
Repository stars: 35,755 · Incomplete scan
Skill
building-detection-rule-with-splunk-spl
mukul975/Anthropic-Cybersecurity-Skills · skills/building-detection-rule-with-splunk-spl
Build effective detection rules using Splunk Search Processing Language (SPL) correlation searches to identify security threats in SOC environments.
Repository stars: 35,755 · Incomplete scan
Skill
performing-web-application-penetration-test
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-web-application-penetration-test
Performs systematic security testing of web applications following the OWASP Web Security Testing Guide (WSTG) methodology to identify vulnerabilities in authentication, authorization, input validation, session management, and business logic. The tester uses Burp Suite as the primary interception proxy alongside manual testing techniques to find flaws that automated scanners miss. Activates for requests involving web app pentest, OWASP testing, application security assessment, or web vulnerability testing.
Repository stars: 35,755 · Incomplete scan
Skill
hunting-for-defense-evasion-via-timestomping
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-for-defense-evasion-via-timestomping
Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT. Uses analyzeMFT and Python to identify files with anomalous temporal patterns indicating anti-forensic timestomping activity.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-dcsync-attack-in-active-directory
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-dcsync-attack-in-active-directory
Detect DCSync attacks (MITRE T1003.006) where adversaries abuse Active Directory replication privileges to extract password hashes, by auditing Event ID 4662 for the DS-Replication-Get-Changes GUIDs and flagging non-domain-controller accounts issuing DsGetNCChanges RPC calls. Use when hunting for credential theft via Mimikatz lsadump::dcsync or Impacket secretsdump, investigating lateral movement with domain admin credentials, or auditing AD replication permissions.
Repository stars: 35,755 · Incomplete scan
Skill
deobfuscating-javascript-malware
mukul975/Anthropic-Cybersecurity-Skills · skills/deobfuscating-javascript-malware
Deobfuscates malicious JavaScript found in phishing pages, web skimmers, and dropper scripts by reversing encoding layers, eval chains, string manipulation, and control-flow obfuscation to reveal the original malicious logic. Use when investigating a phishing page's obfuscated JavaScript, analyzing a Magecart-style web skimmer, or deobfuscating a JavaScript dropper that fetches second-stage malware.
Repository stars: 35,755 · Incomplete scan
Skill
bypassing-authentication-with-forced-browsing
mukul975/Anthropic-Cybersecurity-Skills · skills/bypassing-authentication-with-forced-browsing
Discovering and accessing unprotected pages, APIs, and administrative interfaces by enumerating URLs and bypassing authentication controls during authorized security assessments.
Repository stars: 35,755 · Incomplete scan
Skill
analyzing-malware-persistence-with-autoruns
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-malware-persistence-with-autoruns
Use Sysinternals Autoruns to systematically enumerate and analyze malware persistence mechanisms across Windows registry run keys, scheduled tasks, services, drivers, and startup locations. Use when hunting for persistence during Windows incident response, triaging a compromised endpoint, or validating that malware autostart entries have been fully identified and removed.
Repository stars: 35,755 · Incomplete scan
Skill
performing-firmware-extraction-with-binwalk
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-firmware-extraction-with-binwalk
Performs firmware image extraction and analysis using binwalk to identify embedded filesystems, compressed archives, bootloaders, kernel images, and cryptographic material. Covers entropy analysis for detecting encrypted or compressed regions, recursive extraction of nested archives, SquashFS/CramFS/JFFS2 filesystem mounting, and string analysis for credential and configuration discovery. Activates for requests involving firmware reverse engineering, IoT device analysis, embedded system security assessment, or router/camera firmware extraction.
Repository stars: 35,755 · Incomplete scan
Skill
performing-packet-injection-attack
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-packet-injection-attack
Crafts and injects custom network packets using Scapy, hping3, and Nemesis during authorized security assessments to test firewall rules, IDS detection, protocol handling, and network stack resilience against malformed and spoofed traffic.
Repository stars: 35,755 · Incomplete scan
Skill
performing-dmarc-policy-enforcement-rollout
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-dmarc-policy-enforcement-rollout
Execute a phased DMARC rollout by inventorying sending sources, configuring SPF/DKIM alignment, and progressing DNS policy from p=none monitoring through p=quarantine to p=reject enforcement, ensuring all legitimate email sources authenticate before unauthorized senders are blocked. Use when deploying or advancing an organization's DMARC anti-spoofing posture, or when meeting bulk-sender authentication requirements from Google and Yahoo.
Repository stars: 35,755 · Incomplete scan
Automated signals, not a guarantee. How the checks work.
