Explore the full catalog
Explore skills, repositories and creators
Search the catalog or browse with filters. Checks are automated signals, not a safety guarantee.
Page 116 · 50 results shown
Skill
configuring-zscaler-private-access-for-ztna
mukul975/Anthropic-Cybersecurity-Skills · skills/configuring-zscaler-private-access-for-ztna
Configures Zscaler Private Access (ZPA) to replace traditional VPN with zero trust network access by deploying App Connectors, defining application segments, configuring identity- and device-posture-based access policies, and integrating with IdPs. Use when replacing VPN concentrators with ZTNA or providing remote users secure access to internal applications without network-level connectivity.
Repository stars: 35,755 · Incomplete scan
Skill
exploiting-deeplink-vulnerabilities
mukul975/Anthropic-Cybersecurity-Skills · skills/exploiting-deeplink-vulnerabilities
Tests and exploits deep link (URL scheme and App Link) vulnerabilities in Android and iOS mobile applications to identify unauthorized access, data injection, intent hijacking, and redirect manipulation. Use when assessing mobile app attack surface through custom URI schemes, Android App Links, iOS Universal Links, or intent-based navigation. Activates for requests involving deep link security testing, URL scheme exploitation, mobile intent abuse, or link hijacking.
Repository stars: 35,755 · Incomplete scan
Skill
performing-threat-modeling-with-owasp-threat-dragon
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-threat-modeling-with-owasp-threat-dragon
Uses OWASP Threat Dragon (web or desktop) to build data flow diagrams, identify threats with STRIDE, LINDDUN, CIA, DIE, or PLOT4ai methodologies via its auto-generation rule engine, and produce PDF threat model reports. Use during secure design review of an application architecture to build a formal threat model and document mitigations for GRC compliance.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-velociraptor-for-ir-collection
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-velociraptor-for-ir-collection
Deploy and configure Velociraptor for scalable endpoint forensic artifact collection during incident response using VQL queries, hunts, and pre-built artifact packs across Windows, Linux, and macOS environments.
Repository stars: 35,755 · Incomplete scan
Skill
auditing-azure-active-directory-configuration
mukul975/Anthropic-Cybersecurity-Skills · skills/auditing-azure-active-directory-configuration
Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, stale accounts, conditional access gaps, and guest user risks using AzureAD PowerShell, Microsoft Graph API, and ScoutSuite.
Repository stars: 35,755 · Incomplete scan
Skill
performing-threat-hunting-with-yara-rules
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-threat-hunting-with-yara-rules
Use YARA pattern-matching rules to hunt for malware, suspicious files, and indicators of compromise across filesystems and memory dumps. Covers rule authoring, yara-python scanning, and integration with threat intel feeds.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-honeypot-for-ransomware-detection
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-honeypot-for-ransomware-detection
Deploys canary files, honeypot shares, and decoy systems to detect ransomware activity at the earliest possible stage. Configures canary tokens embedded in strategic file locations that trigger alerts when ransomware attempts encryption, uses honeypot network shares that mimic high-value targets, and deploys Thinkst Canary appliances for comprehensive deception-based detection. Activates for requests involving ransomware honeypots, canary files, deception technology for ransomware, or early ransomware alerting.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-rapid7-insightvm-for-scanning
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-rapid7-insightvm-for-scanning
Deploy and configure Rapid7 InsightVM Security Console and Scan Engines, including scan templates, credentialed scanning, and Insight Agent integration, for authenticated and unauthenticated vulnerability scanning across enterprise environments. Use when standing up InsightVM infrastructure, configuring credentialed vulnerability scans, or integrating continuous asset assessment via the Insight Agent.
Repository stars: 35,755 · Incomplete scan
Skill
building-threat-hunt-hypothesis-framework
mukul975/Anthropic-Cybersecurity-Skills · skills/building-threat-hunt-hypothesis-framework
Build a systematic threat-hunt workflow that turns threat intelligence and ATT&CK gap analysis into testable hypotheses, then executes and validates them via EDR/SIEM queries (CrowdStrike, Defender, Splunk, Elastic, Sysmon, Velociraptor, Sigma) and documents findings in a standardized hunt report. Use when planning or running a proactive threat hunt or scoping compromise from an intel- or anomaly-driven lead.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-suspicious-powershell-execution
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-suspicious-powershell-execution
Hunt for suspicious PowerShell execution (T1059.001) such as encoded commands, download cradles, AMSI bypass, and constrained language mode evasion using EDR telemetry (CrowdStrike, Microsoft Defender for Endpoint), Sysmon, and SIEM queries (Splunk, Elastic). Use when proactively threat hunting, triaging EDR/SIEM alerts, or scoping an incident involving malicious PowerShell activity.
Repository stars: 35,755 · Incomplete scan
Skill
performing-thick-client-application-penetration-test
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-thick-client-application-penetration-test
Conduct a thick client application penetration test to identify insecure local storage, hardcoded credentials, DLL hijacking, memory manipulation, and insecure API communication in desktop applications using dnSpy, Procmon, and Burp Suite.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-mtls-for-zero-trust-services
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-mtls-for-zero-trust-services
Configures mutual TLS (mTLS) authentication between microservices using Python cryptography library for certificate generation and ssl module for TLS verification. Validates certificate chains, checks expiration, and audits mTLS deployment status. Use when implementing zero-trust service-to-service authentication.
Repository stars: 35,755 · Incomplete scan
Skill
performing-malware-hash-enrichment-with-virustotal
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-malware-hash-enrichment-with-virustotal
Enrich malware file hashes (MD5, SHA-1, SHA-256) using the VirusTotal API v3 to retrieve multi-engine detection rates, sandbox behavioral analysis, YARA rule matches, related indicators, and community threat intelligence. Use during SOC triage, incident response, or threat intelligence workflows to validate whether a file hash is malicious and gather context for IOC enrichment.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-broken-object-property-level-authorization
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-broken-object-property-level-authorization
Detect and test for OWASP API3:2023 Broken Object Property Level Authorization (BOPLA), covering excessive data exposure in API responses and mass assignment via injected request-body properties. Use when reviewing API responses/requests for over-exposed or over-writable object fields, or building detection rules and test cases for property-level authorization gaps that object-level checks miss.
Repository stars: 35,755 · Incomplete scan
Skill
performing-ssl-stripping-attack
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-ssl-stripping-attack
Simulates SSL stripping / HTTPS downgrade attacks using sslstrip, Bettercap, and mitmproxy in authorized lab environments to test HSTS enforcement, certificate validation, and HTTPS upgrade mechanisms. Use when performing an authorized penetration test to validate HSTS preloading and TLS certificate handling, demonstrate downgrade-attack risk to stakeholders, or train SOC teams to detect SSL stripping indicators in network traffic.
Repository stars: 35,755 · Incomplete scan
Skill
building-cloud-siem-with-sentinel
mukul975/Anthropic-Cybersecurity-Skills · skills/building-cloud-siem-with-sentinel
Deploy Microsoft Sentinel as a cloud-native SIEM/SOAR by configuring multi-cloud data connectors (AWS, Azure, GCP), writing KQL detection and hunting queries, and building automated Logic Apps response playbooks. Use when establishing a centralized SOC for multi-cloud environments, migrating from a legacy SIEM, or performing petabyte-scale threat hunting; not for AWS-only setups where Security Hub/GuardDuty suffice or for endpoint EDR needs.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-anomalous-authentication-patterns
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-anomalous-authentication-patterns
Detects anomalous authentication patterns using UEBA analytics, statistical baselines, and machine learning models to identify impossible travel, credential stuffing, brute force, password spraying, and compromised account behaviors across authentication logs. Activates for requests involving authentication anomaly detection, login behavior analysis, UEBA implementation, or suspicious sign-in investigation.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-identity-governance-with-sailpoint
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-identity-governance-with-sailpoint
Deploys SailPoint IdentityNow or IdentityIQ for identity governance and administration, covering identity lifecycle management, access request workflows, certification campaigns, role mining, separation-of-duties (SOD) policy enforcement, and compliance reporting. Use when standing up or tuning an identity governance program, automating access certifications, or enforcing SOD policies across enterprise IAM.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-supply-chain-attacks-in-ci-cd
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-supply-chain-attacks-in-ci-cd
Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned actions, script injection via expressions, dependency confusion, and secrets exposure. Uses PyGithub and YAML parsing for automated audit. Use when hardening CI/CD pipelines or investigating compromised build systems.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-zero-standing-privilege-with-cyberark
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-zero-standing-privilege-with-cyberark
Deploy CyberArk Secure Cloud Access (SCA) to eliminate standing privileges in AWS, Azure, and GCP by provisioning ephemeral, scoped roles on a just-in-time basis governed by the TEA framework (Time, Entitlements, Approvals). Use when designing or implementing zero standing privilege / just-in-time privileged access models with CyberArk, or when replacing persistent cloud admin roles with time-bound, approval-gated sessions.
Repository stars: 35,755 · Incomplete scan
Skill
testing-android-intents-for-vulnerabilities
mukul975/Anthropic-Cybersecurity-Skills · skills/testing-android-intents-for-vulnerabilities
Tests Android inter-process communication (IPC) through intents for vulnerabilities including intent injection, unauthorized component access, broadcast sniffing, pending intent hijacking, and content provider data leakage. Use when assessing Android app attack surface through exported components, testing intent-based data flows, or evaluating IPC security. Activates for requests involving Android intent security, IPC testing, exported component analysis, or Drozer assessment.
Repository stars: 35,755 · Incomplete scan
Skill
conducting-network-penetration-test
mukul975/Anthropic-Cybersecurity-Skills · skills/conducting-network-penetration-test
Conducts comprehensive network penetration tests against authorized target environments by performing host discovery, port scanning, service enumeration, vulnerability identification, and controlled exploitation to assess the security posture of network infrastructure. The tester follows PTES methodology from reconnaissance through post-exploitation and reporting. Activates for requests involving network pentest, infrastructure security assessment, internal network testing, or external perimeter testing.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-dependency-confusion
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-dependency-confusion
Detect and prevent dependency confusion (public-over-private package name resolution) in npm, PyPI, and Maven by enumerating claimable internal package names with tools like `confused` and OWASP `dep-scan`, then enforcing source restrictions via `.npmrc`, `pip.conf`/`pyproject.toml`, and Maven `settings.xml`. Use when onboarding a repo to a supply-chain security program, auditing lockfiles/manifests for confusable dependencies, or after an incident that may have leaked internal package names.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-proofpoint-email-security-gateway
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-proofpoint-email-security-gateway
Deploy and configure Proofpoint Email Protection as a secure email gateway to detect and block phishing, malware, BEC, and spam before messages reach user inboxes.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-network-policies-for-kubernetes
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-network-policies-for-kubernetes
Writes portable upstream Kubernetes NetworkPolicy YAML - default-deny-all, DNS egress, namespace and pod selector rules - that works on any conformant CNI such as Calico or Cilium. Use when segmentation must stay CNI-portable, introducing a default-deny posture, or restricting east-west traffic between pods and namespaces without depending on a vendor CRD. Keywords: NetworkPolicy, default deny, podSelector, namespaceSelector, ingress, egress, CNI portable. Do not use for Calico-specific resources - use implementing-kubernetes-network-policy-with-calico.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-insider-threat-behaviors
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-insider-threat-behaviors
Detect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-correlated data theft. Use when proactively threat-hunting for malicious or negligent insider activity, or when investigating a departing or disgruntled employee for potential data theft.
Repository stars: 35,755 · Incomplete scan
Skill
testing-for-broken-access-control
mukul975/Anthropic-Cybersecurity-Skills · skills/testing-for-broken-access-control
Systematically tests web applications and APIs for broken access control (OWASP A01:2021), including privilege escalation, missing function-level checks, insecure direct object references, and multi-tenant data leakage, using Burp Suite with the Authorize extension. Use during authorized penetration tests or RBAC/multi-tenant authorization audits.
Repository stars: 35,755 · Incomplete scan
Skill
performing-cloud-penetration-testing-with-pacu
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-cloud-penetration-testing-with-pacu
Run authorized AWS penetration tests with Pacu, the open-source AWS exploitation framework, to enumerate IAM configuration, scan for privilege escalation paths, and test data access and lateral movement using compromised credentials. Use when conducting authorized red-team assessments of AWS environments, validating IAM policies and SCPs, or determining the blast radius of compromised AWS credentials.
Repository stars: 35,755 · Incomplete scan
Skill
performing-nist-csf-maturity-assessment
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-nist-csf-maturity-assessment
Conduct a NIST Cybersecurity Framework (CSF) 2.0 maturity assessment across the six core Functions (Govern, Identify, Protect, Detect, Respond, Recover), scoring organizational posture against the four Implementation Tiers (Partial, Risk-Informed, Repeatable, Adaptive) and producing an improvement roadmap. Use when benchmarking an organization's cybersecurity program maturity or preparing a CSF-based gap analysis and remediation plan.
Repository stars: 35,755 · Incomplete scan
Skill
performing-graphql-introspection-attack
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-graphql-introspection-attack
Performs GraphQL introspection attacks that extract the full API schema (types, queries, mutations, subscriptions, field definitions), map the attack surface, test query depth/complexity limits, and exploit GraphQL-specific weaknesses such as batching attacks, alias-based brute force, and nested query DoS. Use for GraphQL security testing, schema enumeration, or GraphQL API penetration testing.
Repository stars: 35,755 · Incomplete scan
Skill
performing-subdomain-enumeration-with-subfinder
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-subdomain-enumeration-with-subfinder
Enumerate subdomains of target domains using ProjectDiscovery's Subfinder passive reconnaissance tool to map the attack surface during security assessments.
Repository stars: 35,755 · Incomplete scan
Skill
analyzing-windows-event-logs-in-splunk
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-windows-event-logs-in-splunk
Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use when SOC analysts need to investigate Windows-based threats, build detection queries, or perform forensic timeline analysis of Windows endpoints and domain controllers.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-threat-intelligence-lifecycle-management
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-threat-intelligence-lifecycle-management
Build out a full CTI program around the six-phase threat intelligence lifecycle (direction, collection, processing, analysis, dissemination, feedback), including defining intelligence requirements, building a collection pipeline, normalizing data, and tracking dissemination feedback. Use when standing up or maturing a threat intelligence program, defining intelligence requirements, or designing collection-to-dissemination workflows for a CTI team.
Repository stars: 35,755 · Incomplete scan
Skill
performing-aws-account-enumeration-with-scout-suite
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-aws-account-enumeration-with-scout-suite
Run the agentless, open-source ScoutSuite tool (via pip install and the `scout` CLI) against an AWS account to enumerate resources across services, identify misconfigurations, and generate an interactive HTML security report. Use when assessing an AWS account's overall security posture with read-only IAM credentials, such as during a cloud security audit or compliance review.
Repository stars: 35,755 · Incomplete scan
Skill
conducting-man-in-the-middle-attack-simulation
mukul975/Anthropic-Cybersecurity-Skills · skills/conducting-man-in-the-middle-attack-simulation
Simulates man-in-the-middle attacks using Ettercap, mitmproxy, and Bettercap in authorized environments to intercept, analyze, and modify network traffic for testing encryption enforcement, certificate validation, and detection capabilities.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-epss-score-for-vulnerability-prioritization
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-epss-score-for-vulnerability-prioritization
Queries FIRST's Exploit Prediction Scoring System (EPSS) API to fetch exploitation-probability and percentile scores for CVEs, then uses those scores to prioritize vulnerability remediation. Use when triaging or ranking a vulnerability backlog by real-world 30-day exploitation likelihood rather than CVSS severity alone.
Repository stars: 35,755 · Incomplete scan
Skill
performing-user-behavior-analytics
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-user-behavior-analytics
Performs User and Entity Behavior Analytics (UEBA) to detect anomalous user activities including impossible travel, unusual access patterns, privilege abuse, and insider threats using SIEM-based behavioral baselines and statistical analysis. Use when SOC teams need to identify compromised accounts or insider threats through deviation from established behavioral norms.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-siem-correlation-rules-for-apt
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-siem-correlation-rules-for-apt
Write multi-event correlation rules in Splunk SPL and Sigma format that detect APT lateral movement by chaining Windows authentication events (4624, 4648), process execution (4688, Sysmon Event 1), and network connections (Sysmon Event 3) across hosts within sliding time windows. Use when building SIEM correlation searches to surface multi-stage attack sequences that single-event detections miss, such as pass-the-hash or lateral movement chains.
Repository stars: 35,755 · Incomplete scan
Skill
performing-mobile-app-certificate-pinning-bypass
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-mobile-app-certificate-pinning-bypass
Bypasses SSL/TLS certificate pinning implementations in Android and iOS applications to enable traffic interception during authorized security assessments. Covers OkHttp, TrustManager, NSURLSession, and third-party pinning library bypass techniques using Frida, Objection, and custom scripts. Activates for requests involving certificate pinning bypass, SSL pinning defeat, mobile TLS interception, or proxy-resistant app testing.
Repository stars: 35,755 · Incomplete scan
Skill
analyzing-android-malware-with-apktool
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-android-malware-with-apktool
Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.
Repository stars: 35,755 · Incomplete scan
Skill
hunting-for-registry-run-key-persistence
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-for-registry-run-key-persistence
Detect MITRE ATT&CK T1547.001 registry Run key persistence by analyzing Sysmon Event ID 13 logs and registry queries to identify malicious auto-start entries.
Repository stars: 35,755 · Incomplete scan
Skill
testing-for-host-header-injection
mukul975/Anthropic-Cybersecurity-Skills · skills/testing-for-host-header-injection
Test web applications for HTTP Host header injection vulnerabilities to identify password reset poisoning, web cache poisoning, SSRF, and virtual host routing manipulation risks.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-serverless-function-injection
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-serverless-function-injection
Detects and prevents code injection attacks targeting serverless functions (AWS Lambda, Azure Functions, Google Cloud Functions) through event source poisoning, malicious layer injection, runtime command execution, and IAM privilege escalation via function modification. The analyst combines static analysis of function code, CloudTrail event correlation, runtime behavior monitoring, and IAM policy auditing to identify injection vectors across the expanded serverless attack surface including API Gateway, S3, SQS, DynamoDB Streams, and CloudWatch event triggers. Activates for requests involving Lambda security assessment, serverless injection detection, function event poisoning analysis, or serverless privilege escalation investigation.
Repository stars: 35,755 · Incomplete scan
Skill
testing-mobile-api-authentication
mukul975/Anthropic-Cybersecurity-Skills · skills/testing-mobile-api-authentication
Tests authentication and authorization mechanisms in mobile application APIs to identify broken authentication, insecure token management, session fixation, privilege escalation, and IDOR vulnerabilities. Use when performing API security assessments against mobile app backends, testing JWT implementations, evaluating OAuth flows, or assessing session management. Activates for requests involving mobile API auth testing, token security assessment, OAuth mobile flow testing, or API authorization bypass.
Repository stars: 35,755 · Incomplete scan
Skill
securing-helm-chart-deployments
mukul975/Anthropic-Cybersecurity-Skills · skills/securing-helm-chart-deployments
Secures Helm chart deployments by verifying chart signatures and provenance, rendering and linting templates for misconfiguration, enforcing pod security contexts through values.yaml, moving secrets into an external store instead of Helm values, and scoping RBAC for Helm operations in CI/CD. Use when deploying charts to Kubernetes or reviewing chart provenance, templates, or release RBAC. Keywords: Helm, provenance file, helm verify, helm lint, values.yaml, Tiller-less, release RBAC, external secrets. Do not use for scanning the rendered manifests themselves - use scanning-kubernetes-manifests-with-kubesec.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-azure-ad-privileged-identity-management
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-azure-ad-privileged-identity-management
Configure Microsoft Entra Privileged Identity Management (PIM) to convert standing privileged assignments into eligible, time-bound roles requiring justification, MFA, and approval, covering Entra roles, Azure resource roles, and PIM for Groups, plus access reviews. Use for role-assignment audits, just-in-time admin activation, or Zero Trust identity governance in Entra/Azure AD.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-taxii-server-with-opentaxii
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-taxii-server-with-opentaxii
Deploy and configure a TAXII 2.1 server (Medallion) with Docker, publish and consume STIX 2.1 bundles across collections, and integrate the feed with SIEM/SOAR platforms for automated indicator exchange between organizations. Use when standing up a TAXII server to share threat intel, configuring collections for CTI feeds, or automating STIX indicator ingestion into a SIEM/SOAR.
Repository stars: 35,755 · Incomplete scan
Skill
triaging-vulnerabilities-with-ssvc-framework
mukul975/Anthropic-Cybersecurity-Skills · skills/triaging-vulnerabilities-with-ssvc-framework
Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track/Track*/Attend/Act decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.
Repository stars: 35,755 · Incomplete scan
Skill
analyzing-linux-kernel-rootkits
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-linux-kernel-rootkits
Detect kernel-level rootkits in Linux memory dumps using Volatility3 linux plugins (check_syscall, lsmod, hidden_modules), rkhunter system scanning, and /proc vs /sys discrepancy analysis to identify hooked syscalls, hidden kernel modules, and tampered system structures.
Repository stars: 35,755 · Incomplete scan
Skill
performing-dynamic-analysis-with-any-run
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-dynamic-analysis-with-any-run
Perform interactive dynamic malware analysis using the ANY.RUN cloud sandbox to detonate samples, observe real-time execution behavior, interact with malware prompts such as dialogs and CAPTCHAs, and capture process trees, network traffic, and system changes. Use when a suspicious file or URL needs live, interactive behavioral detonation in a cloud sandbox rather than static analysis alone.
Repository stars: 35,755 · Incomplete scan
Automated signals, not a guarantee. How the checks work.
