Explore the full catalog
Explore skills, repositories and creators
Search the catalog or browse with filters. Checks are automated signals, not a safety guarantee.
Page 112 · 50 results shown
Skill
detecting-insider-threat-with-ueba
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-insider-threat-with-ueba
Implement User and Entity Behavior Analytics (UEBA) using Elasticsearch/OpenSearch to build behavioral baselines, calculate anomaly scores, perform peer group analysis, and alert on insider threat indicators such as data exfiltration, privilege abuse, and unauthorized access. Use when building or tuning a UEBA pipeline rather than a one-off manual hunt.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-api-rate-limiting-and-throttling
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-api-rate-limiting-and-throttling
Implements API rate limiting and throttling with token bucket, sliding window, and fixed window algorithms, configuring per-user, per-IP, and per-endpoint limits via Redis-backed counters, API gateway plugins, or middleware, and returning proper HTTP 429 responses with Retry-After headers. Use when setting up request quota management or preventing brute force, credential stuffing, and resource exhaustion attacks against APIs.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-container-escape-attempts
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-container-escape-attempts
Detects container escape at runtime across tooling - namespace manipulation, capability abuse, kernel exploits, sensitive host mounts, and anomalous syscalls - and explains which signals matter regardless of whether Falco, Sysdig, auditd, or an EDR is doing the collection. Use when deciding what breakout behaviour to monitor, investigating a suspected Docker or Kubernetes breakout, or comparing escape coverage across runtime sensors. Keywords: container escape, breakout, namespaces, CAP_SYS_ADMIN, privileged, hostPath, kernel exploit, syscall. Do not use for Falco rule syntax itself - use detecting-container-escape-with-falco-rules; for a static configuration sweep use performing-container-escape-detection.
Repository stars: 35,755 · Incomplete scan
Skill
collecting-volatile-evidence-from-compromised-host
mukul975/Anthropic-Cybersecurity-Skills · skills/collecting-volatile-evidence-from-compromised-host
Collect volatile forensic evidence from a compromised host by following the order of volatility, preserving memory, network connections, running processes, and system state with documented chain of custody before they are lost. Use before isolating, shutting down, or remediating a compromised host, especially when fileless or memory-resident malware is suspected, root cause analysis is needed, or the evidence must hold up in legal proceedings.
Repository stars: 35,755 · Incomplete scan
Skill
analyzing-azure-activity-logs-for-threats
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-azure-activity-logs-for-threats
Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative operations, impossible travel, privilege escalation, and resource modifications. Builds KQL queries for threat hunting in Azure environments. Use when investigating suspicious Azure tenant activity or building cloud SIEM detections.
Repository stars: 35,755 · Incomplete scan
Skill
deploying-cloudflare-access-for-zero-trust
mukul975/Anthropic-Cybersecurity-Skills · skills/deploying-cloudflare-access-for-zero-trust
Deploys Cloudflare Access with Cloudflare Tunnel for zero trust access to self-hosted apps, configuring identity-aware policies, device posture checks, and WARP client enrollment as a VPN replacement. Use when replacing VPN with Cloudflare One, exposing internal apps without open inbound ports, or securing contractor/third-party access to specific applications.
Repository stars: 35,755 · Incomplete scan
Skill
analyzing-threat-landscape-with-misp
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-threat-landscape-with-misp
Query a MISP (Malware Information Sharing Platform) instance via PyMISP to compute event statistics, IOC type breakdowns, threat actor galaxy clusters, and tag trends, and generate threat landscape reports with temporal trends. Use when asked to analyze threat intelligence data, summarize top threat actors or malware families, or produce a CTI landscape report from MISP events.
Repository stars: 35,755 · Incomplete scan
Skill
building-c2-redirector-infrastructure
mukul975/Anthropic-Cybersecurity-Skills · skills/building-c2-redirector-infrastructure
Build dumb-pipe and traffic-filtering C2 redirectors with nginx (proxy_pass) and Apache (mod_rewrite), deriving filter rules from a Malleable C2 profile, layering Let's Encrypt TLS, and applying OPSEC controls like domain fronting and UA/geo filtering. Use when standing up red-team C2 that must survive blue-team triage or ensuring only profile-matching implant traffic reaches the hidden team server.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-attack-path-analysis-with-xm-cyber
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-attack-path-analysis-with-xm-cyber
Deploys XM Cyber's continuous exposure management platform to build attack graphs that chain vulnerabilities, misconfigurations, identity risks, and credential weaknesses toward critical assets, identifying the small fraction of exposures sitting on converging "choke points". Use when mapping attack paths across an environment or prioritizing remediation within a continuous threat exposure management (CTEM) program.
Repository stars: 35,755 · Incomplete scan
Skill
performing-second-order-sql-injection
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-second-order-sql-injection
Detect and exploit second-order SQL injection vulnerabilities where malicious input is stored in a database and later executed in an unsafe SQL query during a different application operation.
Repository stars: 35,755 · Incomplete scan
Skill
securing-azure-with-microsoft-defender
mukul975/Anthropic-Cybersecurity-Skills · skills/securing-azure-with-microsoft-defender
Deploys and configures Microsoft Defender for Cloud as a CNAPP for Azure, multi-cloud, and hybrid environments: enabling Defender plans for servers, containers, storage, and databases, configuring recommendations, and managing Secure Score via the unified Defender portal. Use when onboarding workloads to Defender for Cloud or setting up cloud workload protection and threat monitoring.
Repository stars: 35,755 · Incomplete scan
Skill
performing-authenticated-scan-with-openvas
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-authenticated-scan-with-openvas
Configure and execute authenticated (credentialed) vulnerability scans using OpenVAS/Greenbone Vulnerability Management (GVM) with SSH, SMB, or ESXi credentials to detect local vulnerabilities, missing patches, and misconfigurations on target hosts. Use when a host-level scan needs to log into systems for deep inspection, since authenticated scans typically surface 10-50x more findings than unauthenticated scans.
Repository stars: 35,755 · Incomplete scan
Skill
performing-network-traffic-analysis-with-zeek
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-network-traffic-analysis-with-zeek
Deploy Zeek (formerly Bro) as a passive network security monitor to generate structured logs of protocol metadata (HTTP, DNS, TLS, SSH, SMTP, FTP, and more), write custom detection scripts, and integrate outputs with SIEM platforms. Use when standing up continuous, high-fidelity network traffic monitoring for threat detection, anomaly identification, or forensic investigation beyond what raw PCAP analysis provides.
Repository stars: 35,755 · Incomplete scan
Skill
performing-active-directory-vulnerability-assessment
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-active-directory-vulnerability-assessment
Assess Active Directory security posture using PingCastle, BloodHound, and Purple Knight to identify misconfigurations, privilege escalation paths, and attack vectors.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-network-access-control
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-network-access-control
Implements 802.1X port-based network access control using RADIUS authentication, PacketFence NAC, and switch configuration to enforce identity-based access policies, posture assessment, and automatic VLAN assignment for authorized devices. Use when enforcing zero-trust access at the network edge, quarantining non-compliant endpoints, meeting PCI-DSS/HIPAA/SOC 2 access requirements, or onboarding BYOD devices with automated provisioning.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-ebpf-security-monitoring
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-ebpf-security-monitoring
Implements eBPF-based security monitoring using Cilium Tetragon for real-time process execution tracking, network connection observability, file access auditing, and runtime enforcement. Covers TracingPolicy CRD authoring with kprobe/tracepoint hooks, in-kernel filtering via matchArgs/matchBinaries selectors, JSON event export, and integration with SIEM pipelines. Use when building kernel-level runtime security observability for Linux hosts or Kubernetes clusters.
Repository stars: 35,755 · Incomplete scan
Skill
configuring-suricata-for-network-monitoring
mukul975/Anthropic-Cybersecurity-Skills · skills/configuring-suricata-for-network-monitoring
Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for high-throughput, protocol-aware traffic inspection (HTTP, TLS, DNS, SMB) and SIEM integration. Use when running Suricata in IDS or inline IPS mode to detect or block malicious traffic, or when combining signature-based and protocol anomaly detection with file extraction.
Repository stars: 35,755 · Incomplete scan
Skill
securing-container-registry-images
mukul975/Anthropic-Cybersecurity-Skills · skills/securing-container-registry-images
Secures container registry images (ECR, ACR, GCR, Docker Hub) by scanning with Trivy and Grype, signing with Cosign and Sigstore, configuring registry access controls, and building CI/CD pipelines that block unscanned or unsigned images. Use when establishing registry security controls or enforcing scan/signature checks before image promotion.
Repository stars: 35,755 · Incomplete scan
Skill
investigating-ransomware-attack-artifacts
mukul975/Anthropic-Cybersecurity-Skills · skills/investigating-ransomware-attack-artifacts
Forensically preserve memory and disk, collect ransom notes and encrypted file samples, and identify the ransomware variant using tools such as ID Ransomware, Volatility, and Chainsaw/Hayabusa to determine the initial access vector and recovery options. Use immediately after discovering ransomware encryption, when scoping the incident forensically, or when documenting evidence for law enforcement and insurance claims.
Repository stars: 35,755 · Incomplete scan
Skill
securing-aws-iam-permissions
mukul975/Anthropic-Cybersecurity-Skills · skills/securing-aws-iam-permissions
Hardens AWS IAM configurations to enforce least-privilege access, covering IAM policy scoping, permission boundaries, IAM Access Analyzer integration, and credential rotation strategies. Use when reducing the blast radius of compromised AWS identities, auditing overly permissive IAM policies, or setting up permission boundaries and Access Analyzer findings review across cloud accounts.
Repository stars: 35,755 · Incomplete scan
Skill
configuring-oauth2-authorization-flow
mukul975/Anthropic-Cybersecurity-Skills · skills/configuring-oauth2-authorization-flow
Configures secure OAuth 2.0 authorization flows, including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant, covering flow selection, PKCE implementation, token lifecycle management, and scope design per OAuth 2.1. Use when implementing or hardening OAuth 2.0 authentication/authorization for web, mobile, SPA, or machine-to-machine clients.
Repository stars: 35,755 · Incomplete scan
Skill
securing-remote-access-to-ot-environment
mukul975/Anthropic-Cybersecurity-Skills · skills/securing-remote-access-to-ot-environment
Designs and configures secure remote access to OT/ICS environments for operators, engineers, and vendors: jump server architecture, multi-factor authentication, session recording, privileged access management, vendor access controls, and IEC 62443 / NERC CIP-005 compliance. Use when designing OT remote access architecture or configuring a jump server with privileged access management.
Repository stars: 35,755 · Incomplete scan
Skill
performing-red-team-with-covenant
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-red-team-with-covenant
Conducts red team operations using the Covenant C2 framework for authorized adversary simulation, covering listener setup, grunt deployment, task execution, and lateral movement tracking. Use when standing up or operating a Covenant command-and-control server for an authorized red team engagement.
Repository stars: 35,755 · Incomplete scan
Skill
operating-havoc-c2
mukul975/Anthropic-Cybersecurity-Skills · skills/operating-havoc-c2
Deploy a Havoc C2 team server with Yaotl malleable profiles, generate evasive Demon agents using indirect syscalls and sleep obfuscation, and run post-exploitation and pivoting operations. Use during authorized, rules-of-engagement-bound red-team engagements for adversary emulation requiring a full C2 lifecycle (server setup, evasive implant generation, tasking, and lateral pivoting).
Repository stars: 35,755 · Incomplete scan
Skill
detecting-entra-offensive-tools-in-graph-logs
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-entra-offensive-tools-in-graph-logs
Hunt AADGraphActivityLogs and MicrosoftGraphActivityLogs in Microsoft Sentinel/Log Analytics using KQL to fingerprint offensive Entra ID enumeration tools such as ROADtools, AADInternals, and AzureHound, including User-Agent signatures, roadrecon endpoint sweeps, and sign-in correlation. Use when investigating suspicious Microsoft Graph API activity, Entra ID reconnaissance, or building Sentinel analytics rules to detect these tools.
Repository stars: 35,755 · Incomplete scan
Skill
analyzing-network-traffic-of-malware
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-network-traffic-of-malware
Analyzes network traffic generated by malware during sandbox execution or live incident response to identify C2 protocols, data exfiltration channels, payload downloads, and lateral movement patterns using Wireshark, Zeek, and Suricata. Activates for requests involving malware network analysis, C2 traffic decoding, malware PCAP analysis, or network-based malware detection.
Repository stars: 35,755 · Incomplete scan
Skill
securing-github-actions-workflows
mukul975/Anthropic-Cybersecurity-Skills · skills/securing-github-actions-workflows
Hardens GitHub Actions workflows against supply chain attacks, credential theft, and privilege escalation: pinning actions to SHA digests, minimizing GITHUB_TOKEN permissions, protecting secrets, preventing script injection in workflow expressions, and requiring reviewers for workflow changes. Use when hardening GitHub Actions workflows that handle secrets, deploy to production, or run with elevated permissions.
Repository stars: 35,755 · Incomplete scan
Skill
building-identity-governance-lifecycle-process
mukul975/Anthropic-Cybersecurity-Skills · skills/building-identity-governance-lifecycle-process
Design identity governance and lifecycle (IGA) programs on platforms like SailPoint, Saviynt, or Entra ID Governance, covering joiner-mover-leaver (JML) automation, role mining, access requests, periodic recertification, and orphaned-account remediation sourced from an HR feed. Use when automating cross-system JML provisioning, remediating former-employee access, or building lifecycle processes for SOX, HIPAA, or GDPR compliance.
Repository stars: 35,755 · Incomplete scan
Skill
hardening-windows-endpoint-with-cis-benchmark
mukul975/Anthropic-Cybersecurity-Skills · skills/hardening-windows-endpoint-with-cis-benchmark
Hardens Windows endpoints using CIS (Center for Internet Security) Benchmark recommendations to reduce attack surface, enforce security baselines, and meet compliance requirements. Use when deploying new Windows workstations or servers, remediating audit findings, or establishing organization-wide security baselines. Activates for requests involving Windows hardening, CIS benchmarks, GPO security baselines, or endpoint configuration compliance.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-insider-data-exfiltration-via-dlp
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-insider-data-exfiltration-via-dlp
Detects insider data exfiltration by analyzing DLP policy violations, file access patterns, upload volume anomalies, and off-hours activity in endpoint and cloud logs. Uses pandas for behavioral analytics and statistical baselines. Use when investigating insider threats or building user behavior analytics for data loss prevention.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-hardware-security-key-authentication
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-hardware-security-key-authentication
Builds a FIDO2/WebAuthn relying party server with the python-fido2 library, covering registration and authentication ceremonies, YubiKey enrollment, resident key (discoverable credential/passkey) workflows, and user verification policies. Use when implementing phishing-resistant MFA with hardware security keys, building a WebAuthn relying party, enrolling YubiKeys for a workforce, or migrating password-based authentication to passkeys.
Repository stars: 35,755 · Incomplete scan
Skill
performing-automated-malware-analysis-with-cape
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-automated-malware-analysis-with-cape
Deploy and operate the CAPEv2 malware sandbox (a Cuckoo derivative) to run samples in a monitored Windows guest VM, capturing behavioral signatures, dropped files, PCAP network traffic, and family-specific configuration extraction (e.g. Emotet, TrickBot, Cobalt Strike) via cape-parsers. Use when a suspicious file or payload needs automated dynamic analysis, anti-evasion debugger tricks, or config/payload extraction.
Repository stars: 35,755 · Incomplete scan
Skill
hunting-evtx-with-chainsaw
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-evtx-with-chainsaw
Run Chainsaw against collected Windows EVTX files to hunt with the SigmaHQ rule corpus, built-in detection rules, and high-speed keyword/regex search, plus analyze shimcache, SRUM, and event-log gaps, outputting colorized tables, CSV, or JSON. Use during first-response triage for offline, SIEM-free detection over Windows event logs, or to quickly confirm a hunt hypothesis and produce reporting output.
Repository stars: 35,755 · Incomplete scan
Skill
analyzing-office365-audit-logs-for-compromise
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-office365-audit-logs-for-compromise
Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect email forwarding rule creation, inbox delegation, suspicious OAuth app grants, and other indicators of account compromise.
Repository stars: 35,755 · Incomplete scan
Skill
performing-http-parameter-pollution-attack
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-http-parameter-pollution-attack
Executes HTTP Parameter Pollution attacks that inject duplicate request parameters to bypass input validation, WAF rules, and other security controls when front-end and back-end systems parse duplicate parameters differently. Use during web application penetration testing to test for parameter parsing inconsistencies or WAF/validation bypass.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-dragos-platform-for-ot-monitoring
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-dragos-platform-for-ot-monitoring
Deploys and configures Dragos Platform sensors and detection analytics for OT/ICS network monitoring, using industrial protocol parsers and threat-intel packs to detect groups like VOLTZITE, CHERNOVITE, and KAMACITE. Use when standing up OT-specific network detection and response or an OT SOC, or integrating OT monitoring into an enterprise SIEM; not for IT-only or Claroty/Nozomi environments.
Repository stars: 35,755 · Incomplete scan
Skill
performing-dynamic-analysis-of-android-app
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-dynamic-analysis-of-android-app
Performs runtime dynamic analysis of Android applications using Frida, Objection, and Android Debug Bridge to observe application behavior during execution, intercept function calls, modify runtime values, and identify vulnerabilities that static analysis misses. Use when testing Android apps for runtime security flaws, hooking sensitive methods, bypassing client-side protections, or analyzing obfuscated applications. Activates for requests involving Android dynamic analysis, runtime hooking, Frida Android instrumentation, or live app behavior analysis.
Repository stars: 35,755 · Incomplete scan
Skill
deobfuscating-powershell-obfuscated-malware
mukul975/Anthropic-Cybersecurity-Skills · skills/deobfuscating-powershell-obfuscated-malware
Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure. Use during incident response or malware analysis when a PowerShell script is obfuscated with encoding, string manipulation, or invocation tricks and you need to recover the underlying commands, dropped payloads, or C2 endpoints.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-t1055-process-injection-with-sysmon
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-t1055-process-injection-with-sysmon
Detect process injection techniques (T1055) - including DLL injection, process hollowing, and APC injection - by analyzing Sysmon Event IDs 1, 7, 8, 10, and 25 for cross-process memory operations, remote thread creation, and anomalous DLL loads. Use when hunting defense-evasion activity that hides code inside legitimate processes, investigating an EDR alert on suspicious cross-process access, or validating Sysmon coverage for injection detection.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-lateral-movement-with-splunk
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-lateral-movement-with-splunk
Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service (WMI/PsExec/RDP) abuse. Use when hunting for MITRE ATT&CK TA0008 lateral movement activity or investigating suspected pivoting between hosts during an incident, with Splunk as the SIEM.
Repository stars: 35,755 · Incomplete scan
Skill
performing-lateral-movement-detection
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-lateral-movement-detection
Detects lateral movement techniques including Pass-the-Hash, PsExec, WMI execution, RDP pivoting, and SMB-based spreading by correlating Windows Security/Sysmon event logs, network flow data (NetFlow/Zeek), and endpoint telemetry in a SIEM, mapped to MITRE ATT&CK Lateral Movement (TA0008) techniques with sample SPL detection queries. Use when a SOC team needs to detect attackers pivoting between internal systems after initial compromise, trace an attacker's movement path during an incident investigation, or build detection engineering rules for TA0008; not for detecting initial access or external attacks.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-runtime-application-self-protection
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-runtime-application-self-protection
Deploy Runtime Application Self-Protection (RASP) agents to detect and block attacks from within application runtime, covering OpenRASP integration, attack pattern detection, and security policy configuration for Java and Python web applications.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-aes-encryption-for-data-at-rest
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-aes-encryption-for-data-at-rest
Guides implementing AES-256 encryption in GCM mode (FIPS 197) for files and data stores at rest, covering key derivation, IV/nonce management, and authenticated encryption. Use when deploying or configuring encryption for data at rest, establishing controls to meet compliance requirements, or reviewing an implementation during a security assessment.
Repository stars: 35,755 · Incomplete scan
Skill
evaluating-threat-intelligence-platforms
mukul975/Anthropic-Cybersecurity-Skills · skills/evaluating-threat-intelligence-platforms
Evaluates and selects Threat Intelligence Platform (TIP) products based on organizational requirements including feed integration capability, STIX/TAXII support, workflow automation, analyst interface, and total cost of ownership. Use when conducting a TIP procurement, migrating between TIP solutions, or assessing whether the current TIP meets program maturity requirements. Activates for requests involving ThreatConnect, MISP, OpenCTI, Anomali, EclecticIQ, or TIP procurement decisions.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-endpoint-dlp-controls
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-endpoint-dlp-controls
Implements endpoint Data Loss Prevention (DLP) controls to detect and prevent sensitive data exfiltration through email, USB, cloud storage, and printing. Use when deploying DLP agents, creating content inspection policies, or preventing unauthorized data movement from endpoints. Activates for requests involving DLP, data exfiltration prevention, content inspection, or sensitive data protection on endpoints.
Repository stars: 35,755 · Incomplete scan
Skill
analyzing-ethereum-smart-contract-vulnerabilities
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-ethereum-smart-contract-vulnerabilities
Perform static and symbolic analysis of Solidity smart contracts using Slither and Mythril to detect reentrancy, integer overflow, access control, and other vulnerability classes before deployment to Ethereum mainnet.
Repository stars: 35,755 · Incomplete scan
Skill
performing-power-grid-cybersecurity-assessment
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-power-grid-cybersecurity-assessment
Conduct cybersecurity assessments of power grid infrastructure spanning generation, transmission substations, distribution, and EMS control centers, covering NERC CIP compliance verification, IEC 61850 (GOOSE/MMS) substation protocol analysis, and synchrophasor (PMU) network security against threats like Industroyer/CrashOverride. Use for periodic NERC CIP assessments, substation automation or EMS/SCADA security reviews, or regional entity compliance audits; not for non-BES systems or generic OT assessments without power grid specifics.
Repository stars: 35,755 · Incomplete scan
Skill
exploiting-insecure-data-storage-in-mobile
mukul975/Anthropic-Cybersecurity-Skills · skills/exploiting-insecure-data-storage-in-mobile
Identifies and exploits insecure local data storage vulnerabilities in Android and iOS mobile applications including unencrypted databases, world-readable files, insecure SharedPreferences, plaintext credential storage, and improper keychain/keystore usage. Use when performing mobile penetration testing focused on OWASP M9 (Insecure Data Storage) or assessing compliance with MASVS-STORAGE requirements. Activates for requests involving mobile data storage security, local storage exploitation, SharedPreferences analysis, or mobile data leakage assessment.
Repository stars: 35,755 · Incomplete scan
Skill
building-attack-pattern-library-from-cti-reports
mukul975/Anthropic-Cybersecurity-Skills · skills/building-attack-pattern-library-from-cti-reports
Parse cyber threat intelligence reports (Mandiant, CrowdStrike, Talos, Microsoft) with stix2, mitreattack-python, and spaCy to extract adversary behaviors, map them to MITRE ATT&CK technique IDs, and build a searchable STIX 2.1 attack-pattern library with detection templates. Use when cataloging attack patterns from CTI reports for threat-informed detection engineering, or generating Sigma/YARA templates from documented behaviors.
Repository stars: 35,755 · Incomplete scan
Skill
coercing-authentication-with-coercer-petitpotam
mukul975/Anthropic-Cybersecurity-Skills · skills/coercing-authentication-with-coercer-petitpotam
Trigger machine account authentication with PetitPotam (MS-EFSR) and Coercer (MS-RPRN, MS-DFSNM, MS-FSRVP, MS-EVEN) via Coercer's scan/coerce/fuzz modes, feeding the coerced NTLM auth into a relay against AD CS Web Enrollment (ESC8), LDAP (RBCD), or SMB. Use in authorized engagements to complete a coercion-relay chain against a Domain Controller, or to validate coercion detections and signing/EPA mitigations.
Repository stars: 35,755 · Incomplete scan
Automated signals, not a guarantee. How the checks work.
