Explore the full catalog
Explore skills, repositories and creators
Search the catalog or browse with filters. Checks are automated signals, not a safety guarantee.
Page 111 · 50 results shown
Skill
performing-cloud-incident-containment-procedures
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-cloud-incident-containment-procedures
Execute cloud-native incident containment across AWS, Azure, and GCP using platform CLIs to revoke or disable compromised IAM credentials, isolate resources with security groups and network ACLs, and preserve forensic evidence via snapshots. Use when responding to a cloud security incident that requires stopping lateral movement while keeping evidence intact for later investigation.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-azure-defender-for-cloud
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-azure-defender-for-cloud
Enable Microsoft Defender for Cloud (CSPM + CWPP) across VMs, containers, SQL, storage, and Key Vault, using Azure Policy for evaluation, Log Analytics for telemetry, Azure Arc for hybrid coverage, and Logic Apps for automated response. Use for Azure security monitoring, adaptive remediation, or regulatory compliance assessment; not for non-Azure-only protection or identity defense (Defender for Identity).
Repository stars: 35,755 · Incomplete scan
Skill
auditing-kubernetes-rbac-privilege-escalation
mukul975/Anthropic-Cybersecurity-Skills · skills/auditing-kubernetes-rbac-privilege-escalation
Finds over-permissive RBAC roles and service-account token abuse paths in a Kubernetes cluster using kubectl auth can-i, rbac-police, kubectl-who-can, and rakkess, tracing which subjects can escalate toward cluster-admin. Use when reviewing who can escalate privileges in a cluster, hunting exploitable RoleBindings during an authorized review, or validating least privilege after an RBAC change. Keywords: RBAC, ClusterRoleBinding, service account token, auth can-i, rbac-police, escalate, bind, impersonate. Do not use for designing and applying hardened RBAC - use implementing-rbac-hardening-for-kubernetes.
Repository stars: 35,755 · Incomplete scan
Skill
performing-purple-team-atomic-testing
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-purple-team-atomic-testing
Executes Atomic Red Team tests mapped to MITRE ATT&CK via Invoke-AtomicRedTeam PowerShell, generates ATT&CK Navigator coverage heatmaps, correlates results against Sigma rules, and runs detection validation loops to measure blue team visibility. Use for purple team exercises, atomic test execution, ATT&CK coverage assessment, or detection engineering validation.
Repository stars: 35,755 · Incomplete scan
Skill
performing-memory-forensics-with-volatility3
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-memory-forensics-with-volatility3
Analyze volatile memory (RAM) dumps using the Volatility 3 framework to extract running processes, network connections, loaded modules, credentials, and encryption keys, and to detect process hollowing, DLL injection, or hidden processes/rootkits. Use during incident response on a compromised or suspect system when disk-based forensics alone is insufficient and volatile evidence of malware or intrusion must be recovered from memory.
Repository stars: 35,755 · Incomplete scan
Skill
modeling-threats-with-opencti
mukul975/Anthropic-Cybersecurity-Skills · skills/modeling-threats-with-opencti
Deploy OpenCTI (Filigran) via Docker Compose and use the pycti Python client to model threat actors, intrusion sets, campaigns, and indicators as a STIX 2.1 knowledge graph with relationships (uses, attributed-to, targets). Use when building a centralized threat-intel knowledge base, correlating IOCs from multiple feeds into one adversary graph, or producing STIX bundles for detection engineering.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-deepfake-audio-in-vishing-attacks
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-deepfake-audio-in-vishing-attacks
Detect AI-generated deepfake audio used in voice phishing (vishing) by extracting spectral features (MFCC, spectral centroid, spectral contrast, zero-crossing rate) and classifying samples with machine learning models, supporting batch audio analysis, confidence scoring, and forensic reporting. Use for deepfake voice detection, vishing investigations, AI-generated speech analysis, voice cloning detection, or audio authenticity verification.
Repository stars: 35,755 · Incomplete scan
Skill
exploiting-server-side-request-forgery
mukul975/Anthropic-Cybersecurity-Skills · skills/exploiting-server-side-request-forgery
Identifying and exploiting SSRF vulnerabilities to access internal services, cloud metadata, and restricted network resources during authorized penetration tests.
Repository stars: 35,755 · Incomplete scan
Skill
hunting-credential-stuffing-attacks
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-credential-stuffing-attacks
Detects credential stuffing attacks by analyzing authentication logs for login velocity anomalies, ASN diversity, password spray patterns, and geographic distribution of failed logins. Uses statistical analysis on Splunk or raw log data. Use when investigating account takeover campaigns or building detection rules for auth abuse.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-opa-gatekeeper-for-policy-enforcement
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-opa-gatekeeper-for-policy-enforcement
Deploys OPA Gatekeeper via Helm as a Kubernetes admission controller and writes ConstraintTemplates with Rego plus instantiated Constraints to validate, mutate, or deny resource requests at admission time. Use when enforcing custom policy-as-code at admission on Kubernetes v1.24+, blocking non-compliant workloads before scheduling, or expressing a rule that built-in controls cannot. Keywords: Gatekeeper, ConstraintTemplate, Constraint, Rego, admission webhook, audit, mutation. Do not use for the standard pod security profiles that Pod Security Admission already covers - use implementing-pod-security-admission-controller.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-aws-security-hub-compliance
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-aws-security-hub-compliance
Deploy AWS Security Hub, backed by AWS Config, to aggregate findings from GuardDuty, Inspector, Macie, Firewall Manager, and Prowler across multi-account AWS Organizations, enable standards like CIS AWS Foundations and PCI DSS, and automate remediation via EventBridge and Lambda. Use for centralizing AWS compliance monitoring or executive compliance dashboards; not for threat detection (GuardDuty) or data classification (Macie).
Repository stars: 35,755 · Incomplete scan
Skill
implementing-api-schema-validation-security
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-api-schema-validation-security
Implements API schema validation using OpenAPI Specification and JSON Schema documents, enforced both at the API gateway (runtime) and during development (shift-left), to lock down request/response contracts and reject unknown properties. Use when preventing injection attacks (SQLi, XSS, XXE), blocking mass assignment, or stopping data leakage through unvalidated API responses.
Repository stars: 35,755 · Incomplete scan
Skill
building-threat-intelligence-feed-integration
mukul975/Anthropic-Cybersecurity-Skills · skills/building-threat-intelligence-feed-integration
Builds automated threat intelligence feed integration pipelines connecting STIX/TAXII feeds, open-source threat intel, and commercial TI platforms into SIEM and security tools for real-time IOC matching and alerting. Use when SOC teams need to operationalize threat intelligence by automating feed ingestion, normalization, scoring, and distribution to detection systems.
Repository stars: 35,755 · Incomplete scan
Skill
conducting-external-reconnaissance-with-osint
mukul975/Anthropic-Cybersecurity-Skills · skills/conducting-external-reconnaissance-with-osint
Conduct external recon using OSINT techniques to map an organization's external attack surface without touching target systems, gathering DNS records, certificate transparency logs, search results, social media, code repositories, and breach databases into a target profile. Use for the passive info-gathering phase of a pentest, external footprinting, or collecting employee/email intel for a social engineering campaign.
Repository stars: 35,755 · Incomplete scan
Skill
performing-mobile-device-forensics-with-cellebrite
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-mobile-device-forensics-with-cellebrite
Acquire and analyze mobile device data using Cellebrite UFED Touch/4PC, UFED Physical Analyzer, and open-source alternatives (ALEAPP, iLEAPP, MEAT, libimobiledevice) to extract communications, call logs, location data, and application artifacts. Use when extracting or recovering deleted evidence from smartphones or tablets during criminal, corporate, or employee-misuse investigations.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-api-gateway-security-controls
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-api-gateway-security-controls
Configures API gateways such as Kong, AWS API Gateway, Azure APIM, or Apigee as a centralized security enforcement point, covering authentication enforcement, rate limiting and throttling, request validation, IP allowlisting, TLS termination, and threat protection. Use when securing API traffic at the gateway layer, setting up gateway-level authentication and quota management, or centralizing API protection before requests reach backend services.
Repository stars: 35,755 · Incomplete scan
Skill
assessing-vector-and-embedding-weaknesses
mukul975/Anthropic-Cybersecurity-Skills · skills/assessing-vector-and-embedding-weaknesses
Test RAG vector stores (Pinecone, Qdrant, Weaviate, Chroma, pgvector, FAISS) for embedding inversion, cross-tenant data leakage, and data poisoning per OWASP LLM08:2025. Use when performing an authorized security assessment of a RAG pipeline's retrieval layer or auditing multi-tenant vector-store isolation.
Repository stars: 35,755 · Incomplete scan
Skill
performing-gcp-penetration-testing-with-gcpbucketbrute
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-gcp-penetration-testing-with-gcpbucketbrute
Performs authorized GCP security testing using GCPBucketBrute to enumerate publicly accessible storage buckets, combined with gcloud CLI IAM enumeration to find privilege escalation paths and audit service account permissions. Use when penetration testing a GCP project for exposed buckets, overly permissive IAM bindings, or service account key exposure.
Repository stars: 35,755 · Incomplete scan
Skill
hunting-for-data-staging-before-exfiltration
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-for-data-staging-before-exfiltration
Detect data-staging activity (MITRE ATT&CK T1074) by analyzing EDR/Sysmon process-creation and file-system telemetry (Event ID 4688, Sysmon 1/11) for 7-Zip/RAR/tar archive creation, unusual temp or hidden folder access, and anomalous consolidation of files from multiple directories. Use when hunting for pre-exfiltration staging behavior, building detection rules for archiver abuse, or validating monitoring coverage for T1074.
Repository stars: 35,755 · Incomplete scan
Skill
moving-laterally-with-netexec
mukul975/Anthropic-Cybersecurity-Skills · skills/moving-laterally-with-netexec
Use NetExec (nxc) to validate credentials, enumerate SMB shares/users/policy, password-spray safely across lockout thresholds, execute commands, and dump SAM/LSA/NTDS credentials across SMB, WinRM, LDAP, MSSQL, SSH, and other protocol modules. Use during authorized internal penetration tests to find lateral-movement paths after obtaining credentials or hashes, or to conduct controlled password spraying and post-exploitation on in-scope hosts.
Repository stars: 35,755 · Incomplete scan
Skill
performing-cloud-log-forensics-with-athena
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-cloud-log-forensics-with-athena
Uses AWS Athena to query CloudTrail, VPC Flow Logs, S3 access logs, and ALB logs for forensic investigation. Covers CREATE TABLE DDL with partition projection, forensic SQL queries for detecting unauthorized access, data exfiltration, lateral movement, and privilege escalation. Use when investigating AWS security incidents or building cloud-native forensic workflows at scale.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-zero-trust-dns-with-nextdns
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-zero-trust-dns-with-nextdns
Configure NextDNS as an encrypted (DoH/DoT) zero trust DNS resolver that blocks malicious, phishing, and cryptojacking domains via real-time threat intelligence, detects DNS rebinding and CNAME cloaking, and enforces organizational DNS policy across endpoints. Use when deploying DNS-layer threat blocking and acceptable-use enforcement, or when extending zero trust controls (including Windows 11 Zero Trust DNS) to the DNS resolution path.
Repository stars: 35,755 · Incomplete scan
Skill
exploiting-jwt-algorithm-confusion-attack
mukul975/Anthropic-Cybersecurity-Skills · skills/exploiting-jwt-algorithm-confusion-attack
Exploits JWT algorithm confusion where the server's verification library trusts the alg named in the token header, by switching RS256 to HS256 (signing with the RSA public key as HMAC secret), setting alg to none, or injecting kid/jku/x5u headers to supply an attacker-controlled key. Use when testing RS256 JWT auth for algorithm downgrade, alg:none bypass, or key-confusion signature forgery.
Repository stars: 35,755 · Incomplete scan
Skill
analyzing-web-server-logs-for-intrusion
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-web-server-logs-for-intrusion
Parse Apache and Nginx access logs to detect SQL injection attempts, local file inclusion, directory traversal, web scanner fingerprints, and brute-force patterns. Uses regex-based pattern matching against OWASP attack signatures, GeoIP enrichment for source attribution, and statistical anomaly detection for request frequency and response size outliers.
Repository stars: 35,755 · Incomplete scan
Skill
analyzing-ios-app-security-with-objection
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-ios-app-security-with-objection
Runtime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals at runtime, and validate/bypass client-side protections during authorized mobile assessments.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-vulnerability-sla-breach-alerting
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-vulnerability-sla-breach-alerting
Build an automated SLA breach alerting system for vulnerability remediation, including a database schema for SLA tracking, breach detection logic, notification dispatch, a scheduled check runner, and a KPI/compliance metrics dashboard. Use when implementing severity-based SLA timelines (critical/high/medium/low), detecting and escalating SLA breaches, or building vulnerability remediation compliance reporting.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-siem-use-cases-for-detection
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-siem-use-cases-for-detection
Implements SIEM detection use cases by designing correlation rules, threshold alerts, and behavioral analytics mapped to MITRE ATT&CK techniques across Splunk, Elastic, and Sentinel. Use when SOC teams need to expand detection coverage, formalize use case lifecycle management, or build a detection library aligned to organizational threat profile.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-iso-27001-information-security-management
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-iso-27001-information-security-management
Guides implementation of an ISO/IEC 27001:2022 Information Security Management System (ISMS) end to end: gap analysis and scoping, risk assessment methodology, Annex A control selection, Statement of Applicability (SoA) creation, and continuous improvement. Use when scoping a new ISMS, preparing for ISO 27001 certification or audit, or selecting and documenting Annex A controls for a compliance program.
Repository stars: 35,755 · Incomplete scan
Skill
performing-api-inventory-and-discovery
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-api-inventory-and-discovery
Performs API inventory and discovery to identify all API endpoints in an organization's environment including documented, undocumented, shadow, zombie, and deprecated APIs. The tester uses passive traffic analysis, active scanning, DNS enumeration, JavaScript analysis, and cloud resource inventory to build a comprehensive API catalog. Maps to OWASP API9:2023 Improper Inventory Management. Activates for requests involving API discovery, shadow API detection, API inventory audit, or attack surface mapping.
Repository stars: 35,755 · Incomplete scan
Skill
performing-arp-spoofing-attack-simulation
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-arp-spoofing-attack-simulation
Simulates ARP spoofing/cache-poisoning attacks in authorized lab or pentest environments using arpspoof, Ettercap, and Scapy to demonstrate man-in-the-middle risk and validate Dynamic ARP Inspection, port security, and network monitoring detections. Use when testing whether switches, IDS/IPS, or a SIEM detect ARP spoofing under written authorization; do not use on production networks without explicit approval.
Repository stars: 35,755 · Incomplete scan
Skill
conducting-gdpr-compliance-assessment
mukul975/Anthropic-Cybersecurity-Skills · skills/conducting-gdpr-compliance-assessment
Conduct comprehensive GDPR compliance assessments by evaluating data processing activities against EU Regulation 2016/679, including Article 30 records of processing, lawful basis validation, data subject rights implementation, Data Protection Impact Assessments (DPIAs) under Article 35, breach notification procedures, international transfer safeguards (SCCs, adequacy decisions), and technical/organizational measures under Article 32. Use when processing personal data of EU residents, preparing for supervisory authority audits, implementing privacy-by-design for new systems, scoping compliance gaps for M&A due diligence, assessing third-party processors, or responding to data subject access requests at scale. Incorporates 2026 guidance from ICO, EDPB, and post-Data (Use and Access) Act 2025 UK-GDPR considerations. Do not use for implementing specific Article 32 controls — use implementing-gdpr-data-protection-controls; or for DSAR automation — use implementing-gdpr-data-subject-access-request.
Repository stars: 35,755 · Incomplete scan
Skill
performing-dns-enumeration-and-zone-transfer
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-dns-enumeration-and-zone-transfer
Enumerates DNS records, attempts zone transfers, brute-forces subdomains, and maps DNS infrastructure during authorized reconnaissance to identify attack surface, misconfigurations, and information disclosure in target domains.
Repository stars: 35,755 · Incomplete scan
Skill
performing-deception-technology-deployment
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-deception-technology-deployment
Deploys deception technology including honeypots, honeytokens, and decoy systems to detect attackers who have bypassed perimeter defenses, providing high-fidelity alerts with near-zero false positive rates. Use when SOC teams need early warning of lateral movement, credential abuse, or internal reconnaissance by deploying convincing traps across the network.
Repository stars: 35,755 · Incomplete scan
Skill
designing-adversary-engagement-with-mitre-engage
mukul975/Anthropic-Cybersecurity-Skills · skills/designing-adversary-engagement-with-mitre-engage
Plan, run, and measure an adversary engagement operation using the MITRE Engage framework so that deployed deception is driven by strategy instead of deployed ad hoc. Covers the Engage Matrix (Prepare, Expose, Affect, Elicit, Understand), the 10-Step Operational Process, mapping engagement Activities to the ATT&CK techniques they expose, and defining measurable Goals and Operational Objectives. Use when a team has honeypots, honeytokens, or canary tokens but no coordinating strategy, when leadership asks "should we engage attackers and how", when building a deception/denial program, when writing an adversary engagement operation plan, or when deciding which deception Activities to deploy against a specific threat actor. Keywords: MITRE Engage, adversary engagement, cyber deception strategy, denial and deception, Engage Matrix, EAC, EGO, Expose Affect Elicit, deception program, honeypot strategy, engagement operation.
Repository stars: 35,755 · Incomplete scan
Skill
performing-authenticated-vulnerability-scan
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-authenticated-vulnerability-scan
Plan and run authenticated (credentialed) vulnerability scans with scanners such as Nessus, Qualys, OpenVAS, or Rapid7 InsightVM, using SSH, SMB, WinRM, or SNMPv3 credentials to inspect installed software, patches, and configurations on Linux, Windows, and network devices. Use when a scan must catch vulnerabilities unauthenticated scanning misses, or when choosing and managing credential types for a credentialed scan.
Repository stars: 35,755 · Incomplete scan
Skill
building-threat-intelligence-enrichment-in-splunk
mukul975/Anthropic-Cybersecurity-Skills · skills/building-threat-intelligence-enrichment-in-splunk
Build automated IOC enrichment pipelines in Splunk Enterprise Security by ingesting threat feeds into KV Store collections and correlating them against security events via lookup tables, modular inputs, and the Threat Intelligence Framework. Use when wiring threat intel into Splunk correlation searches to flag IOC matches and cut SOC triage time.
Repository stars: 35,755 · Incomplete scan
Skill
analyzing-threat-actor-ttps-with-mitre-attack
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-threat-actor-ttps-with-mitre-attack
Systematically map threat actor behavior and observed IOCs to the MITRE ATT&CK framework, build technique coverage heatmaps with the ATT&CK Navigator, identify detection gaps, and produce actionable threat intelligence reports across the Enterprise, Mobile, and ICS matrices. Use when analyzing threat actor TTPs, correlating IOCs to specific ATT&CK techniques, or assessing defensive detection coverage against adversary behavior.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-command-and-control-over-dns
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-command-and-control-over-dns
Detect command-and-control (C2) traffic tunneled over DNS from tools like Iodine, dnscat2, dns2tcp, and Cobalt Strike DNS beacon, using Shannon entropy analysis of query subdomains, ML-based DGA classification, passive DNS correlation, and Zeek/Suricata signatures. Use when investigating suspected DNS tunneling, classifying DGA domains, detecting DNS beaconing, or building DNS anomaly rules for a SOC/SIEM.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-beaconing-patterns-with-zeek
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-beaconing-patterns-with-zeek
Performs statistical analysis of Zeek conn.log connection intervals to detect C2 beaconing patterns. Uses the ZAT library to load Zeek logs into Pandas DataFrames, calculates inter-arrival time standard deviation, and flags periodic connections with low jitter. Use when hunting for command-and-control callbacks in network data.
Repository stars: 35,755 · Incomplete scan
Skill
analyzing-powershell-empire-artifacts
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-powershell-empire-artifacts
Detect PowerShell Empire post-exploitation framework artifacts in Windows Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103), including the default launcher string, Base64-encoded WebClient/FromBase64String payloads, known module invocations (Invoke-Mimikatz, Invoke-Kerberoast), and staging URL patterns. Use when hunting for or confirming Empire C2 activity in Windows event logs.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-continuous-security-validation-with-bas
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-continuous-security-validation-with-bas
Deploys Breach and Attack Simulation (BAS) platforms such as SafeBreach, AttackIQ, Picus, Cymulate, Pentera, or SCYTHE to continuously validate endpoint, network, email-gateway, SIEM, and incident-response effectiveness by safely emulating MITRE ATT&CK techniques. Use when moving beyond point-in-time pentesting to continuous control validation, or standing up automated adversary emulation.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-devsecops-security-scanning
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-devsecops-security-scanning
Integrates SAST, DAST, and SCA into CI/CD pipelines using Semgrep for SAST, Trivy for SCA and container scanning, OWASP ZAP for DAST, and Gitleaks for secrets detection. Use when setting up automated security scanning in CI/CD, shifting security left, meeting compliance mandates (SOC 2, PCI-DSS, ISO 27001), or gating deployments on critical vulnerabilities.
Repository stars: 35,755 · Incomplete scan
Skill
deploying-ransomware-canary-files
mukul975/Anthropic-Cybersecurity-Skills · skills/deploying-ransomware-canary-files
Deploys and monitors ransomware canary files using Python's watchdog library, placing decoy files mimicking high-value targets (financial records, credentials, database exports) where ransomware enumerates first, and alerting via email, Slack, or syslog on any read/modify/rename/delete. Use for early-warning ransomware detection on file servers, NAS, or endpoints, or to supplement EDR where agents can't be deployed.
Repository stars: 35,755 · Incomplete scan
Skill
testing-for-business-logic-vulnerabilities
mukul975/Anthropic-Cybersecurity-Skills · skills/testing-for-business-logic-vulnerabilities
Manually identifies flaws in application business logic - price manipulation, multi-step workflow bypass, and privilege escalation - by intercepting and modifying requests with Burp Suite, going beyond what automated vulnerability scanners detect. Use for e-commerce checkout/cart flows, voucher and rewards systems, or any assessment where scanners find little but business rules need scrutiny.
Repository stars: 35,755 · Incomplete scan
Skill
building-detection-rules-with-sigma
mukul975/Anthropic-Cybersecurity-Skills · skills/building-detection-rules-with-sigma
Builds vendor-agnostic detection rules using the Sigma rule format for threat detection across SIEM platforms including Splunk, Elastic, and Microsoft Sentinel. Use when creating portable detection logic from threat intelligence, mapping rules to MITRE ATT&CK techniques, or converting community Sigma rules into platform-specific queries using sigmac or pySigma backends.
Repository stars: 35,755 · Incomplete scan
Skill
exploiting-smb-vulnerabilities-with-metasploit
mukul975/Anthropic-Cybersecurity-Skills · skills/exploiting-smb-vulnerabilities-with-metasploit
Identifies and exploits SMB protocol vulnerabilities using Metasploit Framework during authorized penetration tests to demonstrate risks from unpatched Windows systems, misconfigured shares, and weak authentication in enterprise networks.
Repository stars: 35,755 · Incomplete scan
Skill
performing-content-security-policy-bypass
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-content-security-policy-bypass
Analyze Content-Security-Policy headers and bypass them to achieve cross-site scripting by exploiting unsafe-inline/unsafe-eval, whitelisted JSONP endpoints, base-uri and form-action gaps, and nonce/hash weaknesses, then exfiltrate data even without script-src control. Use during web application security assessments or bug bounty hunting when XSS is found but blocked by CSP, or when auditing CSP header configuration for weaknesses.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-mimikatz-execution-patterns
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-mimikatz-execution-patterns
Detect Mimikatz credential-dumping activity via command-line pattern matching, LSASS access signatures, binary/hash indicators, and in-memory detection of known Mimikatz modules. Use when threat hunting for T1003 credential access, triaging EDR/SIEM alerts on LSASS access, scoping compromise during incident response, or validating detection coverage in a purple team exercise.
Repository stars: 35,755 · Incomplete scan
Skill
scanning-network-with-nmap-advanced
mukul975/Anthropic-Cybersecurity-Skills · skills/scanning-network-with-nmap-advanced
Performs advanced network recon using Nmap's Scripting Engine (NSE), timing controls, firewall/IDS evasion, and structured output parsing to discover hosts, enumerate service versions, detect vulnerabilities, and fingerprint OSes. Use during authorized penetration tests or enterprise asset-discovery assessments needing scan evasion, NSE vulnerability checks, or output fed into a vulnerability management pipeline.
Repository stars: 35,755 · Incomplete scan
Skill
performing-service-account-audit
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-service-account-audit
Audit service accounts across enterprise infrastructure to identify orphaned, over-privileged, and non-compliant accounts. This skill covers discovery of service accounts in Active Directory, cloud pl
Repository stars: 35,755 · Incomplete scan
Automated signals, not a guarantee. How the checks work.
