Explore the full catalog
Explore skills, repositories and creators
Search the catalog or browse with filters. Checks are automated signals, not a safety guarantee.
Page 113 · 50 results shown
Skill
implementing-aws-macie-for-data-classification
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-aws-macie-for-data-classification
Enable and configure Amazon Macie via AWS CLI/Terraform to discover, classify, and protect sensitive data (PII, financial data, credentials) in S3 using ML and pattern matching, including discovery jobs, custom data identifiers, allow lists, and EventBridge-based remediation. Use when setting up S3 data classification, cloud DLP, or auditing S3 for unprotected sensitive data.
Repository stars: 35,755 · Incomplete scan
Skill
exploiting-type-juggling-vulnerabilities
mukul975/Anthropic-Cybersecurity-Skills · skills/exploiting-type-juggling-vulnerabilities
Exploits PHP type juggling vulnerabilities caused by loose (==) comparison operators to bypass authentication, defeat hash verification via magic hashes, and manipulate application logic through type coercion. Use when pentesting PHP applications that compare user input with ==, in_array, or hash functions without strict type checks.
Repository stars: 35,755 · Incomplete scan
Skill
analyzing-ransomware-network-indicators
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-ransomware-network-indicators
Identify ransomware-related network indicators, including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and encryption key exchange, by analyzing Zeek conn.log and NetFlow data. Use when threat hunting for active ransomware network activity or investigating suspected pre-encryption exfiltration during incident response.
Repository stars: 35,755 · Incomplete scan
Skill
testing-websocket-api-security
mukul975/Anthropic-Cybersecurity-Skills · skills/testing-websocket-api-security
Tests WebSocket API implementations for missing upgrade-handshake authentication, Cross-Site WebSocket Hijacking (CSWSH), message injection, insufficient input validation, message-flooding DoS, and information leakage, using Burp Suite's WebSocket interception and the wscat CLI to craft malicious payloads. Use for real-time API penetration testing or CSWSH/authorization-bypass assessments on WebSocket channels.
Repository stars: 35,755 · Incomplete scan
Skill
testing-cors-misconfiguration
mukul975/Anthropic-Cybersecurity-Skills · skills/testing-cors-misconfiguration
Identifying and exploiting Cross-Origin Resource Sharing misconfigurations that allow unauthorized cross-domain data access and credential theft during security assessments.
Repository stars: 35,755 · Incomplete scan
Skill
configuring-certificate-authority-with-openssl
mukul975/Anthropic-Cybersecurity-Skills · skills/configuring-certificate-authority-with-openssl
Build a two-tier PKI Certificate Authority hierarchy (offline Root CA plus issuing Intermediate CA) using OpenSSL and the Python cryptography library, covering certificate extensions, CRL distribution points, OCSP responder configuration, and certificate policy management. Use when standing up an internal CA, issuing or revoking X.509 certificates, or designing PKI trust hierarchies for TLS, code-signing, or client-authentication use cases.
Repository stars: 35,755 · Incomplete scan
Skill
generating-threat-intelligence-reports
mukul975/Anthropic-Cybersecurity-Skills · skills/generating-threat-intelligence-reports
Generates structured cyber threat intelligence reports at strategic, operational, and tactical levels tailored to specific audiences including executives, security operations teams, and technical analysts. Use when producing finished intelligence products from raw collection data, creating sector threat briefings, or delivering post-incident intelligence assessments. Activates for requests involving CTI report writing, threat briefings, intelligence products, finished intelligence, or executive security reporting.
Repository stars: 35,755 · Incomplete scan
Skill
hunting-for-spearphishing-indicators
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-for-spearphishing-indicators
Hunt for spearphishing campaign indicators across email logs, endpoint telemetry, and network data to detect targeted email attacks.
Repository stars: 35,755 · Incomplete scan
Skill
performing-active-directory-compromise-investigation
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-active-directory-compromise-investigation
Investigate Active Directory compromise by analyzing authentication logs, replication metadata, Group Policy changes, and Kerberos ticket anomalies to identify attacker persistence and lateral movement paths.
Repository stars: 35,755 · Incomplete scan
Skill
analyzing-linux-audit-logs-for-intrusion
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-linux-audit-logs-for-intrusion
Uses the Linux Audit framework (auditd) with ausearch and aureport utilities to detect intrusion attempts, unauthorized access, privilege escalation, and suspicious system activity. Covers audit rule configuration, log querying, timeline reconstruction, and integration with SIEM platforms. Activates for requests involving auditd analysis, Linux audit log investigation, ausearch queries, aureport summaries, or host-based intrusion detection on Linux.
Repository stars: 35,755 · Incomplete scan
Skill
analyzing-linux-elf-malware
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-linux-elf-malware
Analyze malicious Linux ELF binaries — botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure — through static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM samples. Use when investigating Linux malware, triaging a suspicious ELF binary, assessing a compromised Linux server, or analyzing container-targeted malware.
Repository stars: 35,755 · Incomplete scan
Skill
operationalizing-misp-threat-feeds
mukul975/Anthropic-Cybersecurity-Skills · skills/operationalizing-misp-threat-feeds
Stand up MISP, enable and cache curated threat feeds (CIRCL, abuse.ch, Feodo Tracker), apply warninglists to suppress false positives, query indicators with PyMISP, and export attributes as auto-generated Suricata/Sigma/Wazuh detection rules. Use when maturing a MISP instance to actively drive detection, curating threat feeds with quality controls, or automating IOC-to-detection pipelines for the SIEM/IDS.
Repository stars: 35,755 · Incomplete scan
Skill
deploying-osquery-for-endpoint-monitoring
mukul975/Anthropic-Cybersecurity-Skills · skills/deploying-osquery-for-endpoint-monitoring
Deploys and configures osquery for real-time endpoint monitoring using SQL-based queries to inspect running processes, open ports, installed software, and system configuration. Use when building visibility into endpoint state, threat hunting across fleet, or implementing compliance monitoring. Activates for requests involving osquery deployment, endpoint visibility, fleet management, or SQL-based endpoint querying.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-memory-protection-with-dep-aslr
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-memory-protection-with-dep-aslr
Implements memory protection mechanisms including DEP (Data Execution Prevention), ASLR (Address Space Layout Randomization), CFG (Control Flow Guard), and other exploit mitigations to prevent memory corruption attacks. Use when hardening endpoints against buffer overflow exploits, ROP chains, and code injection. Activates for requests involving memory protection, exploit mitigation, DEP, ASLR, or CFG configuration.
Repository stars: 35,755 · Incomplete scan
Skill
hunting-for-persistence-via-wmi-subscriptions
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-for-persistence-via-wmi-subscriptions
Hunts for adversary persistence via WMI event subscriptions (MITRE T1546.003) by monitoring the creation of WMI event filters, consumers, and filter-to-consumer bindings that trigger malicious code execution on system events. Use when investigating fileless, trigger-based persistence on Windows hosts or auditing WMI repository contents for malicious event subscriptions.
Repository stars: 35,755 · Incomplete scan
Skill
exploiting-broken-function-level-authorization
mukul975/Anthropic-Cybersecurity-Skills · skills/exploiting-broken-function-level-authorization
Tests APIs for Broken Function Level Authorization (OWASP API5:2023) by identifying admin and privileged endpoints, then reaching them with regular-user credentials via HTTP method switching, URL path manipulation, and parameter tampering. Use when testing whether low-privilege users can invoke admin API functions or otherwise escalate privileges via function-level access control gaps.
Repository stars: 35,755 · Incomplete scan
Skill
configuring-microsegmentation-for-zero-trust
mukul975/Anthropic-Cybersecurity-Skills · skills/configuring-microsegmentation-for-zero-trust
Configures microsegmentation policies to enforce least-privilege workload-to-workload access using tools such as VMware NSX, Illumio, and Calico, preventing lateral movement in zero trust architectures. Use when designing or implementing network microsegmentation as part of a zero trust architecture aligned with NIST SP 800-207.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-patch-management-workflow
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-patch-management-workflow
Patch management is the systematic process of identifying, testing, deploying, and verifying software updates to remediate vulnerabilities across an organization's IT infrastructure. An effective patc
Repository stars: 35,755 · Incomplete scan
Skill
implementing-ransomware-backup-strategy
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-ransomware-backup-strategy
Designs a ransomware-resilient backup strategy using the 3-2-1-1-0 methodology (3 copies, 2 media types, 1 offsite, 1 immutable/air-gapped, 0 restore errors), configuring RPO/RTO-aligned schedules, isolating backup credentials, and automating restore testing. Use when planning ransomware backup resilience or air-gapped/immutable backup architecture.
Repository stars: 35,755 · Incomplete scan
Skill
analyzing-windows-registry-for-artifacts
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-windows-registry-for-artifacts
Extract and analyze Windows Registry hives with tools like RegRipper and Registry Explorer to uncover user activity, installed software, autostart/persistence entries, and evidence of system compromise. Use when investigating registry-based persistence, reconstructing user or system activity, or performing DFIR triage on a Windows image.
Repository stars: 35,755 · Incomplete scan
Skill
performing-network-traffic-analysis-with-tshark
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-network-traffic-analysis-with-tshark
Automate network traffic analysis using tshark (Wireshark CLI) and pyshark to compute protocol distribution statistics, detect suspicious flows such as port scans and beaconing, extract IOCs (IPs, domains, URLs), and identify DNS tunneling patterns from PCAP files. Use when scripted or repeatable analysis of packet captures is needed rather than interactive inspection.
Repository stars: 35,755 · Incomplete scan
Skill
performing-privilege-escalation-assessment
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-privilege-escalation-assessment
Performs privilege escalation assessments on compromised Linux and Windows systems to identify paths from low-privilege access to root or SYSTEM-level control. The tester enumerates misconfigurations, vulnerable services, kernel exploits, SUID binaries, unquoted service paths, and credential stores to demonstrate the full impact of an initial compromise. Activates for requests involving privilege escalation testing, local exploitation, post-compromise escalation, or OS-level security assessment.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-sigstore-for-software-signing
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-sigstore-for-software-signing
Implements Sigstore-based software signing and verification using Cosign keyless signing, Rekor transparency log verification, and Fulcio certificate authority integration to establish cryptographic provenance for container images, binaries, and software artifacts, including OIDC-based identity binding and CI/CD pipeline integration. Use when setting up keyless container/artifact signing, verifying signatures against the Rekor transparency log, or deploying Sigstore in a supply-chain security workflow.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-misconfigured-azure-storage
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-misconfigured-azure-storage
Audit Azure Storage accounts for public blob containers, missing encryption, overly permissive SAS tokens, disabled logging, and network access violations using Azure CLI, PowerShell, and Microsoft Defender for Storage. Use for storage security audits across subscriptions, responding to Defender for Storage anonymous-access alerts, verifying compliance controls, or setting security baselines when onboarding a subscription.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-conditional-access-policies-azure-ad
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-conditional-access-policies-azure-ad
Configures Microsoft Entra ID (Azure AD) Conditional Access policies for zero trust access control, covering signal-based policy design, device compliance requirements, risk-based authentication, named locations, and session controls aligned to NIST SP 1800-35. Use when deploying or hardening conditional access policies, building zero trust security architecture in Entra ID, or preparing for a security assessment of Azure AD access controls.
Repository stars: 35,755 · Incomplete scan
Skill
analyzing-malware-family-relationships-with-malpedia
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-malware-family-relationships-with-malpedia
Query the Malpedia API to look up malware family aliases and naming (platform.family_name), pull community/vendor YARA rules, link families to threat actors, and map family relationships such as loader-payload chains and shared authorship. Use when researching a malware family's aliases, lineage, or actor attribution, or when sourcing YARA rules for detection.
Repository stars: 35,755 · Incomplete scan
Skill
performing-post-quantum-cryptography-migration
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-post-quantum-cryptography-migration
Assesses organizational readiness for post-quantum cryptography migration per NIST FIPS 203/204/205 standards. Performs cryptographic inventory scanning to identify quantum-vulnerable algorithms (RSA, ECDH, ECDSA), evaluates hybrid TLS configurations with X25519MLKEM768, and validates CRYSTALS-Kyber (ML-KEM) and CRYSTALS-Dilithium (ML-DSA) readiness. Implements crypto-agility assessment using oqs-provider for OpenSSL. Use when planning or executing the transition from classical to post-quantum cryptographic algorithms across enterprise infrastructure.
Repository stars: 35,755 · Incomplete scan
Skill
performing-agentless-vulnerability-scanning
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-agentless-vulnerability-scanning
Configure and execute agentless vulnerability scanning using network protocols, cloud snapshot analysis, and API-based discovery to assess systems without installing endpoint agents.
Repository stars: 35,755 · Incomplete scan
Skill
operating-sliver-c2
mukul975/Anthropic-Cybersecurity-Skills · skills/operating-sliver-c2
Stand up a Sliver C2 server and mTLS listeners, generate cross-platform implants and beacons, and run post-exploitation, pivoting, and BOF/.NET tooling via the Armory for adversary emulation. Use during authorized, rules-of-engagement-bound red-team engagements that need a full open-source C2 lifecycle spanning server setup, implant generation, and post-exploitation tradecraft.
Repository stars: 35,755 · Incomplete scan
Skill
analyzing-windows-prefetch-with-python
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-windows-prefetch-with-python
Parse Windows Prefetch (.pf) files with the windowsprefetch Python library to reconstruct application execution history, run counts, and accessed file/volume lists. Use when investigating renamed or masquerading binaries, verifying program execution timelines, or hunting for suspicious execution patterns in incident response.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-secret-scanning-with-gitleaks
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-secret-scanning-with-gitleaks
This skill covers implementing Gitleaks for detecting and preventing hardcoded secrets in git repositories. It addresses configuring pre-commit hooks, CI/CD pipeline integration, custom rule authoring for organization-specific secrets, baseline management for existing repositories, and remediation workflows for exposed credentials.
Repository stars: 35,755 · Incomplete scan
Skill
extracting-memory-artifacts-with-rekall
mukul975/Anthropic-Cybersecurity-Skills · skills/extracting-memory-artifacts-with-rekall
Uses Rekall memory forensics framework to analyze memory dumps for process hollowing, injected code via VAD anomalies, hidden processes, and rootkit detection. Applies plugins like pslist, psscan, vadinfo, malfind, and dlllist to extract forensic artifacts from Windows memory images. Use during incident response memory analysis.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-dnp3-protocol-anomalies
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-dnp3-protocol-anomalies
Detect anomalies in DNP3 communications used in SCADA/ICS systems by monitoring unauthorized control commands, firmware update attempts, protocol violations, and deviations from baseline traffic using deep packet inspection and machine learning approaches. Use when securing energy-sector or other OT/ICS networks, investigating suspicious DNP3 master/outstation activity, or building an anomaly-based IDS for industrial control traffic.
Repository stars: 35,755 · Incomplete scan
Skill
monitoring-darkweb-sources
mukul975/Anthropic-Cybersecurity-Skills · skills/monitoring-darkweb-sources
Monitors dark web forums, marketplaces, paste sites, and ransomware leak sites for mentions of organizational assets, leaked credentials, threatened attacks, and threat actor communications to provide early warning intelligence. Use when establishing dark web monitoring coverage, investigating specific data breach claims, or enriching incident investigations with dark web context. Activates for requests involving dark web OSINT, leak site monitoring, credential exposure, Recorded Future dark web, or Tor hidden service intelligence.
Repository stars: 35,755 · Incomplete scan
Skill
performing-kubernetes-penetration-testing
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-kubernetes-penetration-testing
Evaluates Kubernetes cluster security by actively simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policy, and secrets, using kube-hunter, Kubescape, peirates, and manual kubectl exploitation to find paths to cluster compromise. Use for an authorized penetration test or hands-on validation that controls actually stop an attacker. Keywords: kube-hunter, Kubescape, peirates, kubelet 10250, anonymous auth, token theft, lateral movement, cluster takeover. Do not use for a configuration-only compliance audit - use performing-kubernetes-cis-benchmark-with-kube-bench.
Repository stars: 35,755 · Incomplete scan
Skill
performing-active-directory-bloodhound-analysis
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-active-directory-bloodhound-analysis
Use BloodHound and SharpHound (or AzureHound) to enumerate Active Directory relationships and graph attack paths from a compromised user to Domain Admin. Use when performing AD red-team reconnaissance, mapping privilege-escalation chains from group memberships, ACLs, and trusts, or auditing AD for exploitable misconfigurations.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-delinea-secret-server-for-pam
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-delinea-secret-server-for-pam
Implements Delinea Secret Server for privileged access management, covering secret vault configuration, role-based access policies, automated password rotation, session recording, and Active Directory/cloud integration. Use when centralizing privileged credential management, replacing spreadsheet-based secrets, automating password rotation, or meeting PAM compliance (SOX, PCI-DSS, HIPAA, NIST 800-53).
Repository stars: 35,755 · Incomplete scan
Skill
correlating-threat-campaigns
mukul975/Anthropic-Cybersecurity-Skills · skills/correlating-threat-campaigns
Correlates disparate security incidents, IOCs, and adversary behaviors across time and organizations to identify unified threat campaigns, attribute them to common threat actors, and extract shared indicators for improved detection. Use when multiple incidents exhibit overlapping indicators, when sector-wide attack campaigns require cross-organizational analysis, or when building campaign-level intelligence products. Activates for requests involving campaign analysis, incident clustering, cross-organizational IOC correlation, or MISP correlation engine.
Repository stars: 35,755 · Incomplete scan
Skill
hunting-for-lolbins-execution-in-endpoint-logs
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-for-lolbins-execution-in-endpoint-logs
Hunts for LOLBins (Living Off the Land Binaries) abuse, mapped to MITRE T1218, by analyzing endpoint process-creation logs for suspicious execution patterns of legitimate Windows system binaries used for malicious purposes. Use when reviewing endpoint process telemetry for LOLBins-based defense evasion or building detections for signed-binary proxy execution.
Repository stars: 35,755 · Incomplete scan
Skill
exploiting-bgp-hijacking-vulnerabilities
mukul975/Anthropic-Cybersecurity-Skills · skills/exploiting-bgp-hijacking-vulnerabilities
Analyzes and simulates BGP hijacking scenarios in authorized lab environments to assess route origin validation, RPKI deployment, and BGP monitoring defenses against prefix hijacking and route leak attacks on internet routing infrastructure.
Repository stars: 35,755 · Incomplete scan
Skill
performing-malware-persistence-investigation
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-malware-persistence-investigation
Systematically investigate all persistence mechanisms on Windows and Linux systems to identify how malware survives reboots and maintains access.
Repository stars: 35,755 · Incomplete scan
Skill
scanning-container-images-with-grype
mukul975/Anthropic-Cybersecurity-Skills · skills/scanning-container-images-with-grype
Scans container images, filesystems, and SBOMs for known CVEs with Anchore Grype, matching Syft-generated SBOM packages against NVD, GitHub Advisories, and OS-specific feeds with configurable severity thresholds and failure gates. Use when Grype or Syft is the chosen toolchain, when scanning an existing SBOM rather than an image, or when gating a build on severity. Keywords: Grype, Syft, SBOM, NVD, GitHub Advisory, --fail-on, severity threshold. Do not use when the toolchain is Trivy - use scanning-docker-images-with-trivy.
Repository stars: 35,755 · Incomplete scan
Skill
tracking-threat-actor-infrastructure
mukul975/Anthropic-Cybersecurity-Skills · skills/tracking-threat-actor-infrastructure
Discovers and maps adversary-controlled infrastructure (C2 servers, phishing domains, exploit-kit hosts, bulletproof hosting) by pivoting across passive DNS, certificate transparency logs, Shodan/Censys scans, WHOIS records, and network fingerprints (JARM/JA3S). Use when tracking threat actor infrastructure, expanding a known IOC into related assets, or producing STIX-based threat intelligence during a CTI investigation.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-vulnerability-management-with-greenbone
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-vulnerability-management-with-greenbone
Deploy and operate Greenbone/OpenVAS vulnerability management using the python-gvm library over the Greenbone Management Protocol (GMP) to connect via Unix socket or TLS, create scan targets and configs, execute scans, and parse the XML scan reports into actionable findings. Use when automating OpenVAS/GVM scan creation and execution, or programmatically retrieving and parsing vulnerability scan reports.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-sql-injection-via-waf-logs
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-sql-injection-via-waf-logs
Analyze WAF (ModSecurity/AWS WAF/Cloudflare) logs to detect SQL injection attack campaigns. Parses ModSecurity audit logs and JSON WAF event logs to identify SQLi patterns (UNION SELECT, OR 1=1, SLEEP(), BENCHMARK()), tracks attack sources, correlates multi-stage injection attempts, and generates incident reports with OWASP classification.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-privileged-access-management-with-cyberark
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-privileged-access-management-with-cyberark
Deploy CyberArk Privileged Access Management to discover, vault, rotate, and monitor privileged credentials across enterprise infrastructure, covering vault architecture, session isolation, credential rotation policies, and integration with NIST 800-53 access control requirements. Use when standing up CyberArk PAM, vaulting privileged credentials, or designing credential rotation policies.
Repository stars: 35,755 · Incomplete scan
Skill
performing-plc-firmware-security-analysis
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-plc-firmware-security-analysis
This skill covers analyzing Programmable Logic Controller (PLC) firmware for security vulnerabilities including hardcoded credentials, insecure update mechanisms, backdoor functions, memory corruption flaws, and undocumented debug interfaces. It addresses firmware extraction from common PLC platforms (Siemens S7, Allen-Bradley, Schneider Modicon), static analysis of firmware images, dynamic analysis in emulated environments, and comparison against known-good baselines to detect tampering.
Repository stars: 35,755 · Incomplete scan
Skill
analyzing-certificate-transparency-for-phishing
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-certificate-transparency-for-phishing
Monitor Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates, and unauthorized certificate issuance targeting your organization.
Repository stars: 35,755 · Incomplete scan
Skill
exploiting-nosql-injection-vulnerabilities
mukul975/Anthropic-Cybersecurity-Skills · skills/exploiting-nosql-injection-vulnerabilities
Detects and exploits NoSQL injection vulnerabilities in MongoDB, CouchDB, and similar databases to demonstrate authentication bypass, data extraction, and unauthorized access via crafted query operators. Use when pentesting APIs or web applications backed by NoSQL databases to test input validation and injection defenses.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-azure-lateral-movement
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-azure-lateral-movement
Detect lateral movement in Azure AD/Entra ID environments using Microsoft Graph API audit logs, Azure Sentinel KQL hunting queries, and sign-in anomaly correlation to identify privilege escalation, token theft, and cross-tenant pivoting.
Repository stars: 35,755 · Incomplete scan
Automated signals, not a guarantee. How the checks work.
