Explore the full catalog
Explore skills, repositories and creators
Search the catalog or browse with filters. Checks are automated signals, not a safety guarantee.
Page 114 · 50 results shown
Skill
detecting-lateral-movement-in-network
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-lateral-movement-in-network
Identifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows, SMB traffic, and RDP sessions using Zeek, Velociraptor, and SIEM correlation rules to detect attackers moving between systems.
Repository stars: 35,755 · Incomplete scan
Skill
executing-phishing-simulation-campaign
mukul975/Anthropic-Cybersecurity-Skills · skills/executing-phishing-simulation-campaign
Executes authorized phishing simulation campaigns to assess an organization's susceptibility to email-based social engineering attacks. The tester designs realistic phishing scenarios, builds credential harvesting infrastructure, sends targeted phishing emails, and tracks open rates, click-through rates, and credential submission rates to measure human security awareness. Activates for requests involving phishing simulation, social engineering assessment, email security testing, or security awareness measurement.
Repository stars: 35,755 · Incomplete scan
Skill
hunting-for-beaconing-with-frequency-analysis
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-for-beaconing-with-frequency-analysis
Identify command-and-control beaconing patterns in network traffic by applying statistical frequency analysis, jitter calculation, and coefficient of variation scoring to detect periodic callbacks from compromised endpoints.
Repository stars: 35,755 · Incomplete scan
Skill
performing-directory-traversal-testing
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-directory-traversal-testing
Test web applications for path traversal and Local/Remote File Inclusion vulnerabilities by manipulating file path parameters, applying encoding and filter-bypass techniques, automating discovery with ffuf and dotdotpwn, and reading high-value files or achieving code execution. Use during authorized penetration tests of file download, view, or include functionality, or when assessing APIs that accept file names or file paths as parameters.
Repository stars: 35,755 · Incomplete scan
Skill
performing-cloud-forensics-investigation
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-cloud-forensics-investigation
Collect and analyze cloud forensic evidence using AWS CLI, Azure CLI, or gcloud to snapshot volumes, capture instance metadata and security group configurations, and preserve cloud-native logs (CloudTrail, Activity Log, Audit Log). Use when investigating a suspected breach in AWS, Azure, or GCP, tracing unauthorized access through API logs, or analyzing a compromised VM, container, or serverless function.
Repository stars: 35,755 · Incomplete scan
Skill
hunting-for-command-and-control-beaconing
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-for-command-and-control-beaconing
Detect C2 beaconing patterns in network traffic using frequency analysis, jitter detection, and domain reputation to identify compromised endpoints communicating with adversary infrastructure.
Repository stars: 35,755 · Incomplete scan
Skill
hardening-linux-endpoint-with-cis-benchmark
mukul975/Anthropic-Cybersecurity-Skills · skills/hardening-linux-endpoint-with-cis-benchmark
Hardens Linux endpoints using CIS Benchmark recommendations for Ubuntu, RHEL, and CentOS to reduce attack surface, enforce security baselines, and meet compliance requirements. Use when deploying new Linux servers, remediating audit findings, or establishing security baselines for Linux infrastructure. Activates for requests involving Linux hardening, CIS benchmarks for Linux, server security baselines, or Linux configuration compliance.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-passwordless-auth-with-microsoft-entra
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-passwordless-auth-with-microsoft-entra
Implements passwordless authentication using Microsoft Entra ID with FIDO2 security keys, Windows Hello for Business, Microsoft Authenticator passkeys, and certificate-based authentication to eliminate password-based attacks. Use when deploying passwordless sign-in, configuring FIDO2 passkeys, enforcing phishing-resistant MFA, or setting Microsoft Entra authentication method policies.
Repository stars: 35,755 · Incomplete scan
Skill
securing-agentic-ai-tool-invocation
mukul975/Anthropic-Cybersecurity-Skills · skills/securing-agentic-ai-tool-invocation
Implements defense-in-depth controls at an AI agent's tool-invocation boundary using tool allowlisting, least-privilege identity binding, NeMo Guardrails policy enforcement, human-in-the-loop approval, and audit logging. Use when hardening an agent that calls tools with real side effects (email, payments, file writes, code execution), mapping OWASP Agentic AI Top 10 controls, or bounding prompt-injection blast radius.
Repository stars: 35,755 · Incomplete scan
Skill
hunting-for-registry-persistence-mechanisms
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-for-registry-persistence-mechanisms
Hunts for registry-based persistence mechanisms (MITRE T1547) in Windows environments, including Run/RunOnce keys, Winlogon Shell/Userinit modifications, Image File Execution Options (IFEO) debugger injection, and COM hijacking via CLSID overrides. Use when auditing the registry for persistence artifacts or building detections for registry-based malware autostart techniques.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-email-forwarding-rules-attack
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-email-forwarding-rules-attack
Detect malicious inbox/mail-flow forwarding rules that adversaries create to maintain persistent access to email communications for intelligence collection and business email compromise. Use when hunting for suspicious auto-forwarding, hidden mailbox rules, or T1114-style email collection persistence after a compromised account or BEC incident.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-network-intrusion-prevention-with-suricata
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-network-intrusion-prevention-with-suricata
Deploys and configures Suricata as an inline network intrusion prevention system, covering IPS mode setup (NFQueue), custom rule writing, Emerging Threats ruleset management, performance tuning, and logging integration. Use when deploying real-time inline traffic inspection to actively block malicious traffic, or when tuning Suricata rules and performance for production IDS/IPS deployment.
Repository stars: 35,755 · Incomplete scan
Skill
conducting-spearphishing-simulation-campaign
mukul975/Anthropic-Cybersecurity-Skills · skills/conducting-spearphishing-simulation-campaign
Run a targeted spearphishing simulation for initial access by developing OSINT-derived pretexts, building payloads (HTML smuggling, macro docs, ISO/LNK, OneNote, QR codes), standing up look-alike-domain email infrastructure with SPF/DKIM/DMARC via GoPhish, and tracking results. Use in authorized engagements to gain initial access via personalized phishing against specific individuals, distinct from broad campaigns.
Repository stars: 35,755 · Incomplete scan
Skill
building-c2-infrastructure-with-sliver-framework
mukul975/Anthropic-Cybersecurity-Skills · skills/building-c2-infrastructure-with-sliver-framework
Deploy and harden a Sliver C2 team server (BishopFox's Go-based adversary emulation framework) with multi-protocol listeners (mTLS, HTTP/S, DNS, WireGuard), redirectors, domain fronting, and multi-operator support for authorized red-team operations. Use when standing up resilient C2 for a red-team engagement or generating beacon/session implants that must survive blue-team detection.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-service-account-abuse
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-service-account-abuse
Detect abuse of service accounts by hunting for anomalous interactive logons, privilege escalation, and lateral movement using EDR/SIEM telemetry (CrowdStrike Falcon, Microsoft Defender, Splunk, Elastic Security, Sysmon, Velociraptor) and Sigma detection rules. Use when hunting for service-account misuse or investigating a service account performing unexpected interactive logons.
Repository stars: 35,755 · Incomplete scan
Skill
building-soc-playbook-for-ransomware
mukul975/Anthropic-Cybersecurity-Skills · skills/building-soc-playbook-for-ransomware
Builds a structured SOC incident response playbook for ransomware attacks covering detection, containment, eradication, and recovery phases with specific SIEM queries, isolation procedures, and decision trees. Use when SOC teams need formalized response procedures for ransomware incidents aligned to NIST SP 800-61 and MITRE ATT&CK ransomware techniques.
Repository stars: 35,755 · Incomplete scan
Skill
investigating-phishing-email-incident
mukul975/Anthropic-Cybersecurity-Skills · skills/investigating-phishing-email-incident
Investigates phishing email incidents from initial user report through header analysis, URL/attachment detonation, impacted user identification, and containment actions using SOC tools like Splunk, Microsoft Defender, and sandbox analysis platforms. Use when a reported phishing email requires full incident investigation to determine scope and impact.
Repository stars: 35,755 · Incomplete scan
Skill
performing-linux-log-forensics-investigation
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-linux-log-forensics-investigation
Perform forensic investigation of Linux system logs including syslog, auth.log, systemd journal (via journalctl), kern.log, auditd, and application logs to reconstruct user sessions, identify unauthorized access and privilege escalation, trace lateral movement, and establish event timelines. Use when investigating a suspected compromise of a Linux system and needing to analyze SSH, sudo, cron, or kernel-level activity from plain-text or systemd journal logs.
Repository stars: 35,755 · Incomplete scan
Skill
abusing-dpapi-for-credential-access
mukul975/Anthropic-Cybersecurity-Skills · skills/abusing-dpapi-for-credential-access
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.
Repository stars: 35,755 · Incomplete scan
Skill
conducting-malware-incident-response
mukul975/Anthropic-Cybersecurity-Skills · skills/conducting-malware-incident-response
Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing containment, analysis, eradication, and recovery procedures aligned to MITRE ATT&CK. Use when responding to a confirmed or suspected malware infection, including trojan/worm/ransomware outbreaks, malware triage, or infected endpoint remediation.
Repository stars: 35,755 · Incomplete scan
Skill
conducting-cloud-incident-response
mukul975/Anthropic-Cybersecurity-Skills · skills/conducting-cloud-incident-response
Respond to security incidents in AWS, Azure, and GCP via identity-based containment, cloud-native log analysis (CloudTrail, Azure Activity Logs, GCP Audit Logs), resource isolation, and forensic evidence acquisition adapted for ephemeral cloud infrastructure. Use when CSPM alerts or audit logs show compromised cloud credentials, unauthorized IAM changes, or a breach spanning cloud services.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-security-chaos-engineering
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-security-chaos-engineering
Implements security chaos engineering experiments that deliberately disable or degrade security controls to verify detection and response capabilities. Tests WAF bypass, firewall rule removal, log pipeline disruption, and EDR disablement scenarios using boto3 and subprocess. Use when validating SOC detection coverage and resilience.
Repository stars: 35,755 · Incomplete scan
Skill
hunting-for-data-exfiltration-indicators
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-for-data-exfiltration-indicators
Hunt for data exfiltration by analyzing Zeek and Suricata network telemetry for unusual data flows, DNS tunneling via large/frequent TXT queries, uploads to personal cloud storage, and encrypted-channel abuse, correlated against threat intel on destination domains. Use when hunting for data theft in a compromised environment, investigating unusual outbound data volumes, or determining what data was stolen during incident response.
Repository stars: 35,755 · Incomplete scan
Skill
performing-red-team-phishing-with-gophish
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-red-team-phishing-with-gophish
Automates GoPhish phishing simulation campaigns using the Python gophish library, creating email templates with tracking pixels, configuring SMTP sending profiles, building target groups from CSV, launching campaigns, and analyzing results such as open rates, click rates, and credential submission statistics. Use when running an authorized phishing simulation or security awareness assessment via GoPhish.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-stix-taxii-feed-integration
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-stix-taxii-feed-integration
Implements a STIX 2.1/TAXII 2.1 threat-intelligence feed consumer and producer in Python, covering TAXII server discovery, collection polling, parsing STIX bundles with the stix2 library, and standing up a local TAXII server with Medallion. Use when integrating a STIX/TAXII CTI feed into a SIEM or TIP, writing a TAXII client to poll for new indicators, or setting up TAXII collections for indicator exchange.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-container-image-minimal-base-with-distroless
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-container-image-minimal-base-with-distroless
Reduces container attack surface by building application images on Google distroless base images that ship only the application runtime - no shell, package manager, or OS utilities - using multi-stage build patterns plus debugging and scanning techniques adapted to distroless. Use when hardening container images, cutting attack surface in a container architecture, or answering an assessment finding about bloated base images. Keywords: distroless, multi-stage build, no shell, nonroot tag, debug image, scratch, attack surface. Do not use for scanning an image for known CVEs - use scanning-docker-images-with-trivy.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-web-application-logging-with-modsecurity
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-web-application-logging-with-modsecurity
Configure ModSecurity WAF with the OWASP Core Rule Set (CRS) for web application audit logging, tuning SecRuleEngine, SecAuditEngine, and CRS paranoia levels to reduce false positives, and writing custom SecRules for application-specific threats. Use when deploying or tuning a ModSecurity WAF, analyzing audit logs for attack detection, or reducing CRS false positives.
Repository stars: 35,755 · Incomplete scan
Skill
executing-nist-rmf-authorization-to-operate
mukul975/Anthropic-Cybersecurity-Skills · skills/executing-nist-rmf-authorization-to-operate
Drive a federal system through the NIST Risk Management Framework (SP 800-37 Rev 2) to an Authorization to Operate (ATO): Prepare, Categorize (FIPS 199), Select a control baseline (FIPS 200 / SP 800-53 Rev 5), Implement, Assess (SP 800-53A), Authorize, and Monitor continuously. Use when a system needs an ATO or a renewal, when working a FISMA/FedRAMP authorization package, when building or reviewing an SSP, SAR, or POA&M, when categorizing a system as Low/Moderate/High impact, when selecting or tailoring a control baseline, or when standing up continuous monitoring (ConMon) after authorization. Covers ATO, conditional ATO (cATO), and the artifacts assessors expect. Keywords: NIST RMF, 800-37, ATO, authorization to operate, FISMA, FedRAMP, SSP, SAR, POA&M, FIPS 199, FIPS 200, 800-53, 800-53A, control baseline, security categorization, continuous monitoring, authorizing official, system boundary, ongoing authorization.
Repository stars: 35,755 · Incomplete scan
Skill
performing-network-packet-capture-analysis
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-network-packet-capture-analysis
Perform forensic analysis of network packet captures (PCAP/PCAPNG) using Wireshark, tshark, and tcpdump to reconstruct network communications, extract transferred files, identify malicious traffic, and establish evidence of data exfiltration or command-and-control activity. Use when a PCAP file from an incident needs to be examined to prove lateral movement, malware delivery, or unauthorized access.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-aws-config-rules-for-compliance
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-aws-config-rules-for-compliance
Implements AWS Config managed and custom rules for continuous compliance monitoring of AWS resources aligned to CIS and PCI DSS, configuring automatic remediation with SSM Automation and aggregating compliance data across accounts. Use when establishing continuous compliance monitoring, detecting configuration drift, or building a multi-account compliance dashboard via AWS Organizations.
Repository stars: 35,755 · Incomplete scan
Skill
securing-historian-server-in-ot-environment
mukul975/Anthropic-Cybersecurity-Skills · skills/securing-historian-server-in-ot-environment
Audits and hardens process historian servers (OSIsoft PI, Honeywell PHD, GE Proficy, AVEVA Historian) in OT environments: Purdue-level network placement, interface access control, secure DMZ replication via data diodes or PI-to-PI connectors, SQL injection prevention, and process data integrity. Use when auditing or hardening a historian server, or designing secure OT-to-IT data replication through a DMZ.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-arp-poisoning-in-network-traffic
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-arp-poisoning-in-network-traffic
Detect Layer 2 ARP poisoning/spoofing by deploying ARPWatch, Dynamic ARP Inspection (DAI), Wireshark packet analysis, and custom Python monitoring scripts that flag gratuitous ARP floods, IP-to-MAC mapping changes, and duplicate IP addresses. Use when investigating suspected man-in-the-middle interception or session hijacking on a local network segment, or when building layer-2 anomaly detection for a SOC.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-anomalies-in-industrial-control-systems
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-anomalies-in-industrial-control-systems
Deploys anomaly detection for OT/ICS environments using machine learning on OT network baselines, physics-based process models, and Modbus/DNP3/OPC UA traffic analysis to flag deviations, rogue devices, and mismatches against historian data. Use for continuous OT monitoring, baselining deterministic SCADA polling, or investigating alerts from Nozomi Guardian/Dragos needing deeper protocol analysis.
Repository stars: 35,755 · Incomplete scan
Skill
configuring-identity-aware-proxy-with-google-iap
mukul975/Anthropic-Cybersecurity-Skills · skills/configuring-identity-aware-proxy-with-google-iap
Configures Google Cloud Identity-Aware Proxy (IAP) via gcloud to enforce per-request identity verification on Compute Engine, App Engine, Cloud Run, and GKE, including IAM bindings, Access Context Manager access levels, session/reauth settings, and service-account programmatic access. Use when replacing VPN access with identity-based access to GCP backends or configuring context-aware, zero-trust policies for Google Cloud services.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-rdp-brute-force-attacks
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-rdp-brute-force-attacks
Detect RDP brute force attacks by parsing Windows Security Event Logs (EVTX files, via python-evtx) for failed logon patterns (Event ID 4625, Logon Type 10/3), correlating with successful logons (Event ID 4624), and analyzing NLA failures and source IP frequency. Use when investigating exposed RDP endpoints, building SIEM detection rules for credential guessing, or confirming whether a compromised account followed a brute-force pattern.
Repository stars: 35,755 · Incomplete scan
Skill
hunting-for-dcom-lateral-movement
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-for-dcom-lateral-movement
Hunt for DCOM-based lateral movement (MITRE ATT&CK T1021.003) by detecting abuse of MMC20.Application, ShellBrowserWindow, and ShellWindows COM objects via Sysmon Event ID 1/3 correlation, WMI event analysis, and RPC endpoint mapper traffic on port 135. Use when investigating suspicious mmc.exe/dllhost.exe child processes, building T1021.003 detections, or auditing DCOM exposure during purple-team exercises.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-dll-sideloading-attacks
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-dll-sideloading-attacks
Detect DLL side-loading and search-order hijacking (MITRE T1574) where adversaries plant malicious DLLs for legitimate signed applications to load, by analyzing Sysmon Event ID 7 DLL-load events, checking signatures/hashes against known-good versions, and flagging path anomalies with EDR tools like CrowdStrike, MDE, or SentinelOne. Use when investigating EDR alerts on unsigned DLLs, hunting for APT persistence via trojanized applications, or triaging incidents involving DLL hijacking.
Repository stars: 35,755 · Incomplete scan
Skill
performing-ot-vulnerability-scanning-safely
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-ot-vulnerability-scanning-safely
Perform vulnerability scanning in OT/ICS environments safely using passive monitoring, native protocol queries, and carefully controlled active scanning with Tenable OT Security to identify vulnerabilities without disrupting industrial processes or crashing legacy controllers.
Repository stars: 35,755 · Incomplete scan
Skill
performing-sca-dependency-scanning-with-snyk
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-sca-dependency-scanning-with-snyk
This skill covers implementing Software Composition Analysis (SCA) using Snyk to detect vulnerable open-source dependencies in CI/CD pipelines. It addresses scanning package manifests and lockfiles, automated fix pull request generation, license compliance checking, continuous monitoring of deployed applications, and integration with GitHub, GitLab, and Jenkins pipelines.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-qr-code-phishing-with-email-security
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-qr-code-phishing-with-email-security
Detect and prevent QR code phishing (quishing) attacks that embed malicious URLs inside QR code images to bypass link-based email security, using image-based threat detection, OCR/QR decoding, and mobile-side scanning (Microsoft Defender for O365, Proofpoint TAP, Barracuda Multimodal AI). Use when configuring gateway rules against QR phishing or investigating suspicious emails containing QR codes.
Repository stars: 35,755 · Incomplete scan
Skill
exploiting-mass-assignment-in-rest-apis
mukul975/Anthropic-Cybersecurity-Skills · skills/exploiting-mass-assignment-in-rest-apis
Discovers and exploits mass assignment (autobinding) in REST APIs by injecting unexpected or hidden parameters (e.g. role, isAdmin, plan) into create/update requests, using Burp Suite Intruder, Arjun, and param-miner to find bindable fields on ORM-backed endpoints (Rails, Django, Laravel, Spring). Use when testing REST APIs for privilege escalation or authorization bypass via unintended parameter binding.
Repository stars: 35,755 · Incomplete scan
Skill
hunting-for-shadow-copy-deletion
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-for-shadow-copy-deletion
Runs a hypothesis-driven threat hunt for Volume Shadow Copy deletion (T1490) by querying SIEM/EDR telemetry for vssadmin, wmic shadowcopy, and PowerShell shadow-copy-deletion commands. Use when hunting for ransomware preparation or anti-forensics activity, after threat intel flags active campaigns, or when alerts trigger on shadow-copy deletion commands.
Repository stars: 35,755 · Incomplete scan
Skill
hunting-for-cobalt-strike-beacons
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-for-cobalt-strike-beacons
Detect Cobalt Strike beacon command-and-control traffic using default TLS certificate signatures (serial 8BB00EE), JA3/JA3S/JARM fingerprints, HTTP malleable C2 profile pattern matching, and beacon jitter/interval analysis, built with Zeek network logs, Suricata IDS rules, and Python PCAP analysis. Use when hunting for Cobalt Strike beacon callbacks in network traffic or building detection rules for this C2 framework.
Repository stars: 35,755 · Incomplete scan
Skill
performing-osint-with-spiderfoot
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-osint-with-spiderfoot
Automate OSINT collection with the SpiderFoot REST API and CLI (sf.py/spiderfoot-cli) across 200+ modules, selecting scan modes (footprint, investigate, passive) and parsing results for domains, IPs, emails, leaked credentials, and DNS records into a target intelligence profile. Use when mapping an organization's attack surface or profiling a target for threat intelligence.
Repository stars: 35,755 · Incomplete scan
Skill
exploiting-insecure-deserialization
mukul975/Anthropic-Cybersecurity-Skills · skills/exploiting-insecure-deserialization
Identifying and exploiting insecure deserialization vulnerabilities in Java, PHP, Python, and .NET applications to achieve remote code execution during authorized penetration tests.
Repository stars: 35,755 · Incomplete scan
Skill
processing-stix-taxii-feeds
mukul975/Anthropic-Cybersecurity-Skills · skills/processing-stix-taxii-feeds
Processes STIX 2.1 threat intelligence bundles delivered via TAXII 2.1 servers, normalizing objects into platform-native schemas and routing them to appropriate consuming systems. Use when onboarding new TAXII collection endpoints, automating bi-directional intelligence sharing with ISACs, or building pipeline validation for malformed STIX bundles. Activates for requests involving OASIS STIX, TAXII server configuration, MISP TAXII, or Cortex XSOAR feed integrations.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-saml-sso-with-okta
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-saml-sso-with-okta
Implement SAML 2.0 Single Sign-On using Okta as the Identity Provider, covering SP-initiated and IdP-initiated flows, attribute mapping, certificate management, SHA-256 signature enforcement, and Single Logout. Use when configuring Okta SAML SSO for an application, hardening SAML certificate rotation and signing, or testing and troubleshooting SAML assertion flows with a tracer tool.
Repository stars: 35,755 · Incomplete scan
Skill
performing-fuzzing-with-aflplusplus
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-fuzzing-with-aflplusplus
Performs coverage-guided fuzzing of compiled binaries with AFL++, instrumenting targets via afl-cc/afl-clang-fast, minimizing corpora with afl-cmin and afl-tmin, running parallel campaigns with afl-fuzz, and triaging crashes with CASR or GDB scripts. Use for binary fuzzing, crash and memory-corruption discovery, coverage-guided testing, or running AFL++ fuzzing campaigns.
Repository stars: 35,755 · Incomplete scan
Skill
performing-binary-exploitation-analysis
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-binary-exploitation-analysis
Analyze ELF binaries for memory-corruption vulnerabilities and build proof-of-concept exploits using pwntools, checksec, and ROPgadget for buffer overflows and ROP chains. Use when a penetration test or CTF challenge requires evaluating compiler mitigations (NX, ASLR, stack canaries, PIE, RELRO) or developing a working exploit to demonstrate impact.
Repository stars: 35,755 · Incomplete scan
Skill
conducting-cloud-penetration-testing
mukul975/Anthropic-Cybersecurity-Skills · skills/conducting-cloud-penetration-testing
This skill outlines methodologies for performing authorized penetration testing against AWS, Azure, and GCP cloud environments. It covers understanding the shared responsibility model for testing scope, leveraging cloud-specific attack tools like Pacu and ScoutSuite, exploiting IAM misconfigurations, testing for SSRF to cloud metadata services, and reporting findings aligned to MITRE ATT&CK Cloud matrix.
Repository stars: 35,755 · Incomplete scan
Automated signals, not a guarantee. How the checks work.
