Explore the full catalog
Explore skills, repositories and creators
Search the catalog or browse with filters. Checks are automated signals, not a safety guarantee.
Page 115 · 50 results shown
Skill
attacking-oauth-with-device-code-phishing
mukul975/Anthropic-Cybersecurity-Skills · skills/attacking-oauth-with-device-code-phishing
Run OAuth 2.0 device-code and illicit-consent phishing attacks against Microsoft Entra ID, using TokenTactics-style tooling to steal access and refresh tokens, bypass MFA, and pivot across Microsoft 365 services. Use for authorized red-team engagements simulating device-code or consent-grant phishing against a tenant you have explicit written permission to test.
Repository stars: 35,755 · Incomplete scan
Skill
analyzing-threat-intelligence-feeds
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-threat-intelligence-feeds
Analyzes structured and unstructured threat intelligence feeds to extract actionable indicators, adversary tactics, and campaign context. Use when ingesting commercial or open-source CTI feeds, evaluating feed quality, normalizing data into STIX 2.1 format, or enriching existing IOCs with campaign attribution. Activates for requests involving ThreatConnect, Recorded Future, Mandiant Advantage, MISP, AlienVault OTX, or automated feed aggregation pipelines.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-github-advanced-security-for-code-scanning
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-github-advanced-security-for-code-scanning
Configures GitHub Advanced Security (code scanning with CodeQL, secret scanning, dependency review, and Dependabot alerts) to perform automated static analysis and vulnerability detection across repositories at enterprise scale, including custom CodeQL queries and CI workflow integration. Use when setting up or tuning code scanning, rolling out CodeQL across an organization, or shifting SAST left into pull request workflows.
Repository stars: 35,755 · Incomplete scan
Skill
performing-api-fuzzing-with-restler
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-api-fuzzing-with-restler
Uses Microsoft RESTler to perform stateful REST API fuzzing: compiles an OpenAPI/Swagger spec into a RESTler grammar, configures authentication, and runs test/fuzz-lean/fuzz modes that generate request sequences exercising producer-consumer dependencies, then flags 500 errors, auth bypasses, resource leaks, and injection bugs. Use when fuzzing REST APIs for stateful bugs or running RESTler-based automated API security testing.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-aws-security-hub
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-aws-security-hub
Deploy AWS Security Hub as a centralized CSPM platform, backed by AWS Config, aggregating findings from GuardDuty, Inspector, Macie, and third-party tools; enable CIS Foundations, PCI-DSS, and NIST standards; automate remediation via EventBridge/Systems Manager; and produce Audit Manager evidence. Use for a centralized findings dashboard or compliance audit evidence; not for threat detection or container scanning.
Repository stars: 35,755 · Incomplete scan
Skill
performing-credential-access-with-lazagne
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-credential-access-with-lazagne
Extract stored credentials from compromised endpoints using the LaZagne post-exploitation tool to recover passwords from browsers, databases, system vaults, and applications during authorized red team operations.
Repository stars: 35,755 · Incomplete scan
Skill
building-threat-intelligence-platform
mukul975/Anthropic-Cybersecurity-Skills · skills/building-threat-intelligence-platform
Design and deploy a Threat Intelligence Platform (TIP) by integrating open-source CTI tools (MISP, OpenCTI, TheHive, Cortex) into a unified system with feed ingestion pipelines, enrichment workflows, STIX/TAXII interoperability, and analyst dashboards. Use when architecting or standing up a centralized CTI platform to collect, analyze, and disseminate threat intelligence across a security team.
Repository stars: 35,755 · Incomplete scan
Skill
analyzing-malicious-pdf-with-peepdf
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-malicious-pdf-with-peepdf
Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects. Use when triaging a suspicious PDF attachment from a phishing email, analyzing a PDF-based exploit document, or building detection signatures for weaponized PDF threats.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-network-scanning-with-ids-signatures
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-network-scanning-with-ids-signatures
Detect network reconnaissance and port scanning using Suricata and Snort IDS signatures, threshold-based detection rules, and traffic anomaly analysis to identify Nmap, Masscan, and custom scanning activity.
Repository stars: 35,755 · Incomplete scan
Skill
conducting-post-incident-lessons-learned
mukul975/Anthropic-Cybersecurity-Skills · skills/conducting-post-incident-lessons-learned
Facilitate structured post-incident reviews to identify root causes, document what worked and failed, and produce actionable recommendations to improve future incident response.
Repository stars: 35,755 · Incomplete scan
Skill
exploiting-active-directory-with-bloodhound
mukul975/Anthropic-Cybersecurity-Skills · skills/exploiting-active-directory-with-bloodhound
BloodHound is a graph-based Active Directory reconnaissance tool that uses graph theory to reveal hidden and unintended relationships within AD environments. Red teams use BloodHound to identify attac
Repository stars: 35,755 · Incomplete scan
Skill
performing-wifi-password-cracking-with-aircrack
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-wifi-password-cracking-with-aircrack
Captures WPA/WPA2 handshakes and performs offline password cracking using aircrack-ng, hashcat, and dictionary attacks during authorized wireless security assessments to evaluate passphrase strength and wireless network security posture.
Repository stars: 35,755 · Incomplete scan
Skill
performing-oauth-scope-minimization-review
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-oauth-scope-minimization-review
Performs OAuth 2.0 scope minimization review to identify over-permissioned third-party application integrations, excessive API scopes, unused token grants, and risky OAuth consent patterns across identity providers and SaaS platforms. Activates for requests involving OAuth scope audit, API permission review, third-party app risk assessment, or consent grant minimization.
Repository stars: 35,755 · Incomplete scan
Skill
analyzing-kubernetes-audit-logs
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-kubernetes-audit-logs
Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access, and builds SIEM detection rules from the event patterns. Use when investigating a suspected cluster compromise, reconstructing what an attacker did through the API server, or writing Kubernetes-specific detection content. Keywords: audit policy, audit log, kube-apiserver, exec into pod, RBAC change, anonymous access, detection rules. Do not use for syscall-level detection inside a running container - use detecting-container-runtime-threats-with-falco. '
Repository stars: 35,755 · Incomplete scan
Skill
building-incident-response-playbook
mukul975/Anthropic-Cybersecurity-Skills · skills/building-incident-response-playbook
Designs and documents structured incident response playbooks with step-by-step procedures per incident type, decision trees, escalation criteria, RACI matrices, and SOAR platform integration, aligned to NIST SP 800-61r3 and SANS PICERL. Use when creating or maturing an IR program, documenting response runbooks for a new incident type, or designing SOAR playbooks.
Repository stars: 35,755 · Incomplete scan
Skill
performing-web-cache-deception-attack
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-web-cache-deception-attack
Executes web cache deception attacks by exploiting path normalization discrepancies between CDN/reverse-proxy caching layers (Cloudflare, Akamai, Varnish, Nginx) and origin servers to cache and retrieve sensitive authenticated content. Use when testing applications behind CDNs for cache-key misconfigurations, during bug bounty hunting on aggressively cached sites, or when assessing sensitive data exposure through cache layer misconfiguration.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-credential-dumping-techniques
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-credential-dumping-techniques
Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft (e.g. via Mimikatz) using Sysmon Event ID 10 process-access logging, Windows Security logs, and SIEM correlation rules. Use when hunting for credential-theft activity on Windows/Active Directory hosts or triaging EDR alerts on LSASS access.
Repository stars: 35,755 · Incomplete scan
Skill
auditing-foundry-smart-contract-security
mukul975/Anthropic-Cybersecurity-Skills · skills/auditing-foundry-smart-contract-security
Pre-deployment security audit of Solidity smart contracts in a Foundry project. Combines static analysis (Slither, Aderyn), symbolic execution (Mythril), and property-based testing (forge fuzz + invariant tests with handlers) to catch reentrancy, access-control, oracle/price manipulation, and arithmetic bugs BEFORE deploying to an EVM chain. Also enforces key hygiene (no plaintext private keys, encrypted cast keystore) and a secure deploy workflow. Use when writing, reviewing, testing, or deploying Solidity/Foundry contracts, building a dApp, or working with forge/cast/anvil, MetaMask, or Web3/DeFi code.
Repository stars: 35,755 · Incomplete scan
Skill
analyzing-bootkit-and-rootkit-samples
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-bootkit-and-rootkit-samples
Analyzes bootkit and advanced rootkit malware infecting the Master Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware for below-OS persistence, covering boot sector analysis, UEFI module inspection, and anti-rootkit detection. Use when compromise survives OS reinstallation or antivirus/EDR fails to detect malware despite clear infection signs.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-mitre-attack-coverage-mapping
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-mitre-attack-coverage-mapping
Implement MITRE ATT&CK coverage mapping to identify detection gaps, prioritize rule development, and measure SOC detection maturity against adversary techniques.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-ransomware-encryption-behavior
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-ransomware-encryption-behavior
Detects ransomware encryption activity in real time using entropy analysis, file system I/O monitoring (Sysmon, watchdog, psutil), and behavioral scoring to identify mass file modification, abnormal entropy spikes in written data, and suspicious process behavior characteristic of encryption routines. Use when building real-time ransomware detection, tuning entropy thresholds, or investigating suspected active encryption on an endpoint.
Repository stars: 35,755 · Incomplete scan
Skill
eradicating-malware-from-infected-systems
mukul975/Anthropic-Cybersecurity-Skills · skills/eradicating-malware-from-infected-systems
Systematically map and remove malware, backdoors, and attacker persistence mechanisms (registry Run keys, scheduled tasks, WMI subscriptions, services, cron/init.d) from infected Windows and Linux systems using Autoruns, EDR/AV, and YARA, restoring a clean state while preventing re-infection. Use after containment and forensic analysis have identified all compromised systems and persistence mechanisms and you are ready to eradicate and recover.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-application-whitelisting-with-applocker
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-application-whitelisting-with-applocker
Implements application whitelisting using Windows AppLocker to restrict unauthorized software execution on endpoints, reducing attack surface from malware, unauthorized tools, and shadow IT. Use when enforcing application control policies, meeting compliance requirements for software restriction, or preventing execution of unsigned or untrusted binaries. Activates for requests involving AppLocker, application whitelisting, software restriction, or executable control.
Repository stars: 35,755 · Incomplete scan
Skill
testing-api-authentication-weaknesses
mukul975/Anthropic-Cybersecurity-Skills · skills/testing-api-authentication-weaknesses
Tests API authentication mechanisms for weaknesses including broken token validation, missing authentication on endpoints, weak password policies, credential stuffing susceptibility, token leakage in URLs or logs, and session management flaws. The tester evaluates JWT implementation, API key handling, OAuth flows, and session token entropy to identify authentication bypasses. Maps to OWASP API2:2023 Broken Authentication. Activates for requests involving API authentication testing, token validation assessment, credential security testing, or API auth bypass.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-oauth-token-theft
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-oauth-token-theft
Detect and respond to OAuth token theft and replay in Microsoft Entra ID (Azure AD), covering access token theft, refresh token replay, Primary Refresh Token (PRT) abuse, pass-the-cookie attacks, and Token Protection conditional access policies. Use for impossible-travel or anomalous token-usage alerts, suspected session hijacking, sign-in log analysis, or configuring token-binding defenses in Azure/M365.
Repository stars: 35,755 · Incomplete scan
Skill
mapping-attack-paths-with-bloodhound-ce
mukul975/Anthropic-Cybersecurity-Skills · skills/mapping-attack-paths-with-bloodhound-ce
Collect Active Directory data with SharpHound and Entra ID data with AzureHound, ingest into BloodHound Community Edition, and analyze on-prem, cloud, and hybrid attack paths using built-in queries and custom Cypher. Use during authorized red-team or penetration-test engagements to map privilege-escalation chains toward domain/tenant compromise.
Repository stars: 35,755 · Incomplete scan
Skill
testing-ransomware-recovery-procedures
mukul975/Anthropic-Cybersecurity-Skills · skills/testing-ransomware-recovery-procedures
Tests and validates ransomware recovery procedures - backup restore operations (e.g. with Restic), RTO/RPO target verification, recovery sequencing, and clean-restore validation - to confirm organizational resilience against destructive ransomware attacks. Use when validating that recovery plans work under realistic conditions, measuring RTO/RPO against business requirements, or testing restore integrity after simulated encryption.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-business-email-compromise
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-business-email-compromise
Detect Business Email Compromise (BEC) fraud, where attackers impersonate executives or vendors to trick employees into wire transfers or data disclosure without malicious links, using email gateway rules, behavioral analytics, and financial process controls. Use when investigating a suspected executive/vendor impersonation email or building detection rules for social-engineering fund-transfer fraud.
Repository stars: 35,755 · Incomplete scan
Skill
configuring-multi-factor-authentication-with-duo
mukul975/Anthropic-Cybersecurity-Skills · skills/configuring-multi-factor-authentication-with-duo
Deploys Cisco Duo multi-factor authentication across enterprise applications, VPN, RDP, and SSH access points, covering Duo Authentication Proxy setup, adaptive authentication policies, device trust assessment, and phishing-resistant WebAuthn/FIDO2 deployment aligned with NIST 800-63B AAL2/AAL3. Use when adding or hardening MFA for remote access, VPN, or privileged logins with Duo.
Repository stars: 35,755 · Incomplete scan
Skill
hunting-for-webshell-activity
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-for-webshell-activity
Runs a hypothesis-driven threat hunt for web shell deployment (T1505.003) on internet-facing servers by analyzing file creation in web directories, suspicious child-process spawning from web server processes, and anomalous HTTP request patterns. Use when hunting for web shells after a public-facing app compromise, when EDR/SIEM alerts fire on webserver process anomalies, or during incident response on internet-facing infrastructure.
Repository stars: 35,755 · Incomplete scan
Skill
analyzing-uefi-bootkit-persistence
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-uefi-bootkit-persistence
Analyzes UEFI bootkit persistence (SPI flash implants, ESP modifications, Secure Boot bypass, UEFI variable manipulation) using chipsec for firmware integrity verification, detecting known families like BlackLotus, LoJax, and MoonBounce. Use for UEFI malware analysis, firmware persistence investigation, or Secure Boot bypass detection.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-malicious-scheduled-tasks-with-sysmon
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-malicious-scheduled-tasks-with-sysmon
Detect malicious scheduled task creation and modification using Sysmon Event IDs 1 (Process Create for schtasks.exe), 11 (File Create for task XML), and Windows Security Event 4698/4702. The analyst correlates task creation with suspicious parent processes, public directory paths, and encoded command arguments to identify persistence and lateral movement via scheduled tasks. Activates for requests involving scheduled task detection, Sysmon persistence hunting, or T1053.005 Scheduled Task/Job analysis.
Repository stars: 35,755 · Incomplete scan
Skill
deploying-decoy-files-for-ransomware-detection
mukul975/Anthropic-Cybersecurity-Skills · skills/deploying-decoy-files-for-ransomware-detection
Deploys canary files (honeytokens) across file systems to detect ransomware encryption activity in real time. Uses strategically placed decoy documents monitored via file integrity monitoring or OS-level watchdogs to trigger alerts when ransomware modifies or encrypts them. Activates for requests involving ransomware canary deployment, honeyfile setup, deception-based ransomware detection, or file integrity monitoring for encryption.
Repository stars: 35,755 · Incomplete scan
Skill
performing-oil-gas-cybersecurity-assessment
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-oil-gas-cybersecurity-assessment
Conduct cybersecurity assessments of upstream, midstream, and downstream oil and gas operations, covering pipeline SCADA, refinery DCS, safety instrumented systems, and remote wellhead RTUs, and evaluate compliance with API 1164, TSA Pipeline Security Directives, and IEC 62443. Use when assessing a refinery, pipeline, or production facility or preparing for TSA/API compliance audits; not for IT-only or purely physical-security assessments.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-email-account-compromise
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-email-account-compromise
Detect compromised O365 and Google Workspace email accounts by analyzing Unified Audit Logs and Azure AD sign-in logs for impossible travel, inbox rule creation/deletion (Set-InboxRule, New-InboxRule), external mail forwarding rules, and unusual Microsoft Graph API access or OAuth token use. Use when investigating suspected business email compromise (BEC), account takeover, or mailbox persistence via malicious inbox rules.
Repository stars: 35,755 · Incomplete scan
Skill
deploying-palo-alto-prisma-access-zero-trust
mukul975/Anthropic-Cybersecurity-Skills · skills/deploying-palo-alto-prisma-access-zero-trust
Deploys Palo Alto Networks Prisma Access for SASE-based zero trust network access, configuring GlobalProtect agents, ZTNA Connectors, security policy enforcement, and Strata Cloud Manager integration for unified management. Use when implementing enterprise-grade SASE with integrated ZTNA/SWG/CASB/FWaaS, replacing both VPN and branch firewalls with cloud-delivered security, or integrating ZTNA with an existing Palo Alto NGFW estate.
Repository stars: 35,755 · Incomplete scan
Skill
performing-entitlement-review-with-sailpoint-iiq
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-entitlement-review-with-sailpoint-iiq
Runs entitlement review and access certification campaigns in SailPoint IdentityIQ, covering manager certifications, targeted entitlement reviews, role-based access validation, segregation-of-duties violation remediation, and automated revocation workflows. Use when performing periodic user access recertification, auditing SailPoint IIQ access governance, or investigating SOD violations.
Repository stars: 35,755 · Incomplete scan
Skill
performing-alert-triage-with-elastic-siem
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-alert-triage-with-elastic-siem
Perform systematic alert triage in Elastic Security SIEM—classifying, prioritizing, and investigating alerts using Kibana, ES|QL queries, and ECS-normalized data—to drive SOC analyst workflows. Use when triaging incoming Elastic Security detections, prioritizing an analyst's alert queue, or investigating alerts during SOC operations.
Repository stars: 35,755 · Incomplete scan
Skill
testing-prompt-injection-in-rag-pipelines
mukul975/Anthropic-Cybersecurity-Skills · skills/testing-prompt-injection-in-rag-pipelines
Probes Retrieval-Augmented Generation pipelines for indirect prompt injection via poisoned retrieved documents and embedding-space manipulation, using NVIDIA garak, Promptfoo red-team plugins, and Microsoft PyRIT against vector stores like FAISS, Chroma, Pinecone, or pgvector. Use when security-testing a RAG chatbot or document-Q&A system, validating retrieval guardrails, or gating CI/CD on prompt-template/retriever changes.
Repository stars: 35,755 · Incomplete scan
Skill
performing-container-security-scanning-with-trivy
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-container-security-scanning-with-trivy
Runs Trivy across every target type it supports - container images, filesystems, Git repositories, and Kubernetes clusters - for OS and dependency vulnerabilities, IaC misconfiguration, exposed secrets, and licences, generating CycloneDX or SPDX SBOMs. Use when integrating Trivy into CI/CD, deploying the Trivy Kubernetes operator, scanning non-image targets, or triaging results at scale. Keywords: Trivy, trivy k8s, operator, SBOM, CycloneDX, SPDX, misconfig, secret scanning. Do not use for a single Docker image scan - use scanning-docker-images-with-trivy.
Repository stars: 35,755 · Incomplete scan
Skill
analyzing-email-headers-for-phishing-investigation
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-email-headers-for-phishing-investigation
Parse and analyze email headers (Received chain, Return-Path, Message-ID) to trace the true origin of a phishing email and validate SPF, DKIM, and DMARC results to confirm or rule out sender spoofing. Use when triaging a suspicious or reported email, investigating a phishing incident, or verifying whether a message's sender domain was spoofed.
Repository stars: 35,755 · Incomplete scan
Skill
auditing-mcp-servers-for-tool-poisoning
mukul975/Anthropic-Cybersecurity-Skills · skills/auditing-mcp-servers-for-tool-poisoning
Audit MCP servers for tool poisoning, tool shadowing, rug pulls, SSRF, and unauthenticated exposure using Invariant Labs' mcp-scan for static/runtime scanning plus manual SSRF/auth checks and description pinning. Use before adding a new MCP server to an agent stack, when reviewing an internal MCP server, detecting rug pulls, or investigating an agent's unexpected tool-driven behavior.
Repository stars: 35,755 · Incomplete scan
Skill
exploiting-adcs-with-certipy
mukul975/Anthropic-Cybersecurity-Skills · skills/exploiting-adcs-with-certipy
Use Certipy to enumerate AD CS certificate authorities and templates over LDAP/RPC, then exploit ESC1-ESC16 misconfigurations - SAN abuse, NTLM relay to web enrollment (ESC8), Shadow Credentials, golden certificate forgery, and PKINIT/Schannel auth. Use during authorized penetration tests to escalate a domain foothold to Domain Admin, or to validate that certificate template ACLs and CA hardening detect these attacks.
Repository stars: 35,755 · Incomplete scan
Skill
hunting-advanced-persistent-threats
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-advanced-persistent-threats
Proactively hunts for Advanced Persistent Threat (APT) activity within enterprise environments using hypothesis-driven searches across endpoint telemetry, network logs, and memory artifacts. Use when conducting scheduled threat hunting cycles, investigating anomalous behavior flagged by UEBA, or validating that known APT TTPs are not present in the environment. Activates for requests involving MITRE ATT&CK, Velociraptor, osquery, Zeek, or threat hunting playbooks.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-security-information-sharing-with-stix2
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-security-information-sharing-with-stix2
Create, validate, and share STIX 2.1 threat intelligence objects (indicators, malware, campaigns, relationships, bundles) using the stix2 Python library, and publish them over TAXII 2.1. Use when building or exchanging structured threat intelligence, modeling relationships between threat objects, or publishing/consuming a TAXII 2.1 feed.
Repository stars: 35,755 · Incomplete scan
Skill
reverse-engineering-ios-app-with-frida
mukul975/Anthropic-Cybersecurity-Skills · skills/reverse-engineering-ios-app-with-frida
Reverse engineers iOS applications using Frida dynamic instrumentation to understand internal logic, extract encryption keys, bypass security controls, and discover hidden functionality without source code access. Use when performing authorized iOS penetration testing, analyzing proprietary protocols, understanding obfuscated logic, or extracting runtime secrets from iOS binaries. Activates for requests involving iOS reverse engineering, Frida iOS hooking, Objective-C/Swift method tracing, or iOS binary analysis.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-infrastructure-as-code-security-scanning
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-infrastructure-as-code-security-scanning
Implements automated security scanning for Infrastructure as Code using Checkov, tfsec, and KICS to detect misconfigurations in Terraform, CloudFormation, Kubernetes manifests, and Helm charts, plus policy-based governance and CI/CD integration. Use when validating cloud infrastructure before deployment or blocking insecure changes (public S3 buckets, open security groups) in pull requests.
Repository stars: 35,755 · Incomplete scan
Skill
hunting-for-unusual-service-installations
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-for-unusual-service-installations
Detects suspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event log Event ID 7045, analyzing service binary paths, and flagging indicators of persistence mechanisms via Sysmon/EDR telemetry. Use when hunting for new-service persistence after a suspected compromise, when Event ID 7045 fires for an unfamiliar service, or during incident response to enumerate service-based persistence on Windows hosts.
Repository stars: 35,755 · Incomplete scan
Skill
performing-privileged-account-access-review
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-privileged-account-access-review
Conducts systematic reviews of privileged accounts to validate access rights, identify excessive or stale permissions, and enforce least privilege across PAM infrastructure. Use when auditing privileged access for compliance, periodic access recertification, or investigating whether privileged entitlements are still justified.
Repository stars: 35,755 · Incomplete scan
Skill
building-phishing-reporting-button-workflow
mukul975/Anthropic-Cybersecurity-Skills · skills/building-phishing-reporting-button-workflow
Implement a phishing report button (Microsoft 365 built-in Report button or third-party like KnowBe4/Cofense) in email clients with a SOAR-driven automated triage workflow that classifies reported emails, extracts IOCs, takes remediation actions, and gives feedback to reporters. Use when deploying user-reported phishing intake or automating triage of the resulting reporting mailbox.
Repository stars: 35,755 · Incomplete scan
Automated signals, not a guarantee. How the checks work.
