Explore the full catalog
Explore skills, repositories and creators
Search the catalog or browse with filters. Checks are automated signals, not a safety guarantee.
Page 118 · 50 results shown
Skill
triaging-security-incident-with-ir-playbook
mukul975/Anthropic-Cybersecurity-Skills · skills/triaging-security-incident-with-ir-playbook
Classifies and prioritizes security incidents using structured IR playbooks and SIEM/case-management queries (Splunk, TheHive) to determine severity, assign response teams, and initiate the appropriate response procedures. Use when a new SOC alert needs triage, multiple concurrent incidents require prioritization, or automated triage rules need validation or tuning.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-mobile-malware-behavior
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-mobile-malware-behavior
Detects and analyzes malicious behavior in mobile applications through behavioral analysis, permission abuse detection, network traffic monitoring, and dynamic instrumentation. Use when analyzing suspicious mobile applications for data exfiltration, command-and-control communication, credential stealing, SMS interception, or other malware indicators. Activates for requests involving mobile malware analysis, app behavior monitoring, trojan detection, or suspicious app investigation.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-patch-management-for-ot-systems
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-patch-management-for-ot-systems
Implements a structured patch management program for OT/ICS environments where IT-style patching can cause process disruption or safety hazards, covering vendor compatibility testing, risk-based prioritization, staged test deployment, maintenance window coordination, rollback procedures, and compensating controls. Use when planning or auditing patching for SCADA, PLCs, or other industrial control systems.
Repository stars: 35,755 · Incomplete scan
Skill
performing-false-positive-reduction-in-siem
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-false-positive-reduction-in-siem
Reduces SIEM false positives through systematic rule tuning, threshold adjustment, correlation logic refinement, allowlisting, and threat intelligence enrichment. Use when SOC analysts are overwhelmed by alert noise, when tuning noisy detection rules, or during a quarterly SIEM rule review to cut alert fatigue.
Repository stars: 35,755 · Incomplete scan
Skill
performing-ransomware-response
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-ransomware-response
Executes a structured ransomware incident response from detection through containment, forensic analysis, decryption assessment, recovery, and post-incident hardening, covering ransom negotiation, backup integrity verification, and regulatory notification. Use when actively responding to a ransomware outbreak or crypto-ransomware infection, or deciding on ransom payment and containment steps.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-beyondcorp-zero-trust-access-model
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-beyondcorp-zero-trust-access-model
Implement Google's BeyondCorp zero trust access model using Cloud IAP, Access Context Manager, Endpoint Verification, Chrome Enterprise Premium, and BeyondCorp Enterprise Connectors to enforce identity- and device-aware access for VPN-less application access. Use for replacing VPN, enforcing device posture checks, or securing remote/hybrid access to GCP-hosted or on-prem apps; not for raw network-level protocols.
Repository stars: 35,755 · Incomplete scan
Skill
red-teaming-llms-with-garak
mukul975/Anthropic-Cybersecurity-Skills · skills/red-teaming-llms-with-garak
Runs NVIDIA garak probe suites (jailbreak, prompt injection, data leakage, toxicity, and more) against an LLM endpoint - Hugging Face models, OpenAI-compatible APIs, or Bedrock - then interprets the resulting hit-rate report for triage. Use when baselining LLM security before/after deployment, validating that a guardrail or fine-tune reduces jailbreak/injection success rates, or producing evidence for an AI risk assessment.
Repository stars: 35,755 · Incomplete scan
Skill
building-vulnerability-dashboard-with-defectdojo
mukul975/Anthropic-Cybersecurity-Skills · skills/building-vulnerability-dashboard-with-defectdojo
Deploy DefectDojo as a centralized vulnerability management dashboard that ingests findings from 200+ security scanners, deduplicates results, tracks remediation metrics, and integrates with CI/CD, Jira ticketing, and Slack notifications via its REST API. Use when consolidating scanner output into one dashboard or automating vulnerability ticketing and executive reporting.
Repository stars: 35,755 · Incomplete scan
Skill
performing-phishing-simulation-with-gophish
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-phishing-simulation-with-gophish
Deploy and run authorized phishing awareness campaigns with GoPhish, covering admin panel setup, SMTP sending profiles, email template and landing page creation, target user groups, and campaign reporting to measure click and credential-submission rates. Use when planning or executing a phishing simulation for employee security-awareness testing or measuring susceptibility to social engineering.
Repository stars: 35,755 · Incomplete scan
Skill
configuring-active-directory-tiered-model
mukul975/Anthropic-Cybersecurity-Skills · skills/configuring-active-directory-tiered-model
Implement Microsoft's Enhanced Security Admin Environment (ESAE) tiered administration model for Active Directory, covering Tier 0/1/2 separation, privileged access workstations (PAWs), administrative forest design, and authentication policy silos. Use when designing or hardening AD privileged-access architecture, segmenting Domain/Enterprise Admin accounts into tiers, or containing lateral movement and credential theft (pass-the-hash, Kerberoasting, golden tickets).
Repository stars: 35,755 · Incomplete scan
Skill
detecting-aws-cloudtrail-anomalies
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-aws-cloudtrail-anomalies
Detect unusual API call patterns in AWS CloudTrail logs using boto3, statistical baselining, and behavioral analysis to identify credential compromise, privilege escalation, and unauthorized resource access.
Repository stars: 35,755 · Incomplete scan
Skill
analyzing-apt-group-with-mitre-navigator
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-apt-group-with-mitre-navigator
Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups' TTPs for detection-gap analysis. Use to compare threat-actor technique coverage, find gaps in detection engineering, or produce Navigator visualizations for threat-intel reporting.
Repository stars: 35,755 · Incomplete scan
Skill
testing-for-open-redirect-vulnerabilities
mukul975/Anthropic-Cybersecurity-Skills · skills/testing-for-open-redirect-vulnerabilities
Identifies and exploits open redirect vulnerabilities by analyzing URL redirection parameters (next, url, redirect, return, goto), applying bypass techniques, and chaining findings into phishing or token-theft exploits, using Burp Suite/OWASP ZAP and Burp Collaborator. Use when testing login/logout flows, OAuth redirect_uri handling, or SSO redirect validation.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-passwordless-authentication-with-fido2
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-passwordless-authentication-with-fido2
Deploy FIDO2/WebAuthn passwordless authentication using security keys and platform authenticators, covering WebAuthn API integration, FIDO2 server configuration, passkey enrollment, biometric authentication, and migration from password-based systems aligned with NIST SP 800-63B AAL3. Use when implementing passkey login, configuring a FIDO2/WebAuthn server, or replacing passwords with phishing-resistant authentication.
Repository stars: 35,755 · Incomplete scan
Skill
conducting-internal-network-penetration-test
mukul975/Anthropic-Cybersecurity-Skills · skills/conducting-internal-network-penetration-test
Execute an internal network penetration test simulating an insider threat or post-breach attacker to identify lateral movement paths, privilege escalation vectors, and sensitive data exposure within the corporate network.
Repository stars: 35,755 · Incomplete scan
Skill
performing-physical-intrusion-assessment
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-physical-intrusion-assessment
Conduct authorized physical penetration testing against facilities, server rooms, and restricted areas using tailgating, RFID badge cloning, lock bypassing, rogue network device deployment, and security-guard procedure testing. Use as part of a full-scope red team engagement to evaluate physical security controls and their path to network access, always under signed client authorization.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-bgp-security-with-rpki
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-bgp-security-with-rpki
Implement RPKI-based BGP route origin validation by creating Route Origin Authorizations (ROAs) at RIRs (ARIN, RIPE, APNIC, AFRINIC, LACNIC), deploying validator software (Routinator, FORT, OctoRPKI), and configuring RPKI-to-Router protocol and ROV accept/reject policies on Cisco IOS-XE and Juniper Junos routers. Use when hardening BGP against route hijacking or leaks, or when configuring ROV filtering policy on production routers.
Repository stars: 35,755 · Incomplete scan
Skill
hunting-for-domain-fronting-c2-traffic
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-for-domain-fronting-c2-traffic
Detects domain fronting C2 traffic by analyzing SNI-vs-HTTP-Host-header mismatches in proxy logs and inspecting TLS certificate discrepancies with pyOpenSSL. Use when hunting for command-and-control traffic hidden behind legitimate CDN domains, or when investigating proxy/TLS logs for signs of domain fronting evasion.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-runtime-security-with-tetragon
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-runtime-security-with-tetragon
Implements eBPF-based runtime observability and in-kernel enforcement in Kubernetes with Cilium Tetragon, monitoring process execution, file access, network connections, and syscalls, and blocking dangerous calls at the kernel level. Use when deploying Tetragon to detect or block syscalls such as ptrace, mount, and unshare, enforcing kernel-level policy, or adding low-overhead runtime detection to a cluster. Keywords: Tetragon, Cilium, eBPF, TracingPolicy, kprobe, enforcement, process lineage. Do not use for Falco-based detection - use detecting-container-runtime-threats-with-falco.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-gcp-binary-authorization
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-gcp-binary-authorization
Implements GCP Binary Authorization end to end, including creating KMS-backed attestors, Container Analysis notes, deploy-time policies, and signing image attestations, so that only trusted, verified images deploy to GKE and Cloud Run. Use when enforcing container supply-chain integrity or deploy-time attestation checks on GCP.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-google-workspace-admin-security
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-google-workspace-admin-security
Hardens a Google Workspace tenant via Admin Console configuration: phishing-resistant MFA enforcement, DLP policies, email authentication (SPF/DKIM/DMARC), OAuth third-party app control, and external sharing restrictions. Use when hardening a Google Workspace or G Suite tenant, enforcing MFA and OAuth app controls, or configuring cloud office security administration.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-anti-ransomware-group-policy
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-anti-ransomware-group-policy
Configures Windows Group Policy Objects to block ransomware execution and lateral spread, covering AppLocker rules, Software Restriction Policies, Controlled Folder Access, attack surface reduction rules, and network protection settings. Use when hardening Windows endpoints against ransomware via GPO, configuring AppLocker or Controlled Folder Access, or building endpoint protection policies through Group Policy.
Repository stars: 35,755 · Incomplete scan
Skill
continuous-llm-red-teaming-with-promptfoo
mukul975/Anthropic-Cybersecurity-Skills · skills/continuous-llm-red-teaming-with-promptfoo
Wires Promptfoo and DeepTeam into CI/CD for automated, repeatable red-teaming of LLM apps against OWASP LLM Top 10, OWASP Agentic, and MITRE ATLAS presets, failing the build when jailbreak or injection vulnerabilities regress. Use for continuous adversarial testing in CI/CD, a merge-blocking security gate, or comparing model/prompt versions for compliance reporting.
Repository stars: 35,755 · Incomplete scan
Skill
scanning-infrastructure-with-nessus
mukul975/Anthropic-Cybersecurity-Skills · skills/scanning-infrastructure-with-nessus
Tenable Nessus is the industry-leading vulnerability scanner used to identify security weaknesses across network infrastructure including servers, workstations, network devices, and operating systems.
Repository stars: 35,755 · Incomplete scan
Skill
investigating-insider-threat-indicators
mukul975/Anthropic-Cybersecurity-Skills · skills/investigating-insider-threat-indicators
Investigates insider threat indicators including data exfiltration attempts, unauthorized access patterns, policy violations, and pre-departure behaviors using SIEM analytics, DLP alerts, and HR data correlation. Use when SOC teams receive insider threat referrals from HR, detect anomalous data movement by employees, or need to build investigation timelines for potential insider threats.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-shadow-api-endpoints
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-shadow-api-endpoints
Discover and inventory shadow API endpoints that operate outside documented OpenAPI/Swagger specs, using traffic analysis against API gateways (Kong, AWS API Gateway, Envoy), cloud configuration scanning, and source code repository mining for undocumented routes. Use when assessing API attack surface, auditing for forgotten test environments or deprecated API versions still running, or building an API registration governance policy.
Repository stars: 35,755 · Incomplete scan
Skill
hunting-for-scheduled-task-persistence
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-for-scheduled-task-persistence
Runs a hypothesis-driven threat hunt for Windows Scheduled Task persistence (T1053), guiding SIEM/EDR queries against task creation events (e.g. Event ID 4698), suspicious task actions, and unusual scheduling patterns. Use when hunting for scheduled-task persistence, after threat intel flags related campaigns, during incident response, or when alerts fire on schtasks/at.exe activity.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-fileless-attacks-on-endpoints
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-fileless-attacks-on-endpoints
Detects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk, evading traditional antivirus. Use when building detections for PowerShell-based attacks, reflective DLL injection, WMI persistence, and registry-resident malware. Activates for requests involving fileless malware detection, in-memory attacks, PowerShell exploitation, or living-off-the-land techniques.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-ot-incident-response-playbook
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-ot-incident-response-playbook
Develops OT-specific incident response playbooks using a SANS PICERL-based Python engine that classifies incident severity (safety, process, access, recon) and coordinates IT SOC, OT engineering, and plant operations, aligned with IEC 62443 and NIST SP 800-82. Use when building ICS/SCADA incident response procedures for the first time, preparing for OT ransomware scenarios, or aligning IR with IEC 62443/NERC CIP reporting requirements.
Repository stars: 35,755 · Incomplete scan
Skill
performing-log-analysis-for-forensic-investigation
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-log-analysis-for-forensic-investigation
Collect, parse, and correlate system, application, and security logs to reconstruct events and establish timelines during forensic investigations.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-usb-device-control-policy
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-usb-device-control-policy
Implements USB device control policies to restrict unauthorized removable media access on endpoints, preventing data exfiltration and malware introduction via USB devices. Use when deploying device control via Group Policy, Intune, or EDR platforms to enforce USB restrictions. Activates for requests involving USB control, removable media policy, device control, or data loss prevention via USB.
Repository stars: 35,755 · Incomplete scan
Skill
scanning-iac-and-images-with-trivy
mukul975/Anthropic-Cybersecurity-Skills · skills/scanning-iac-and-images-with-trivy
Scans container images, Infrastructure-as-Code (Terraform, CloudFormation, Kubernetes manifests, Dockerfile, Helm), filesystems, git repos, and SBOMs with Trivy's vuln, misconfig, secret, and license scanners. Use when building a CI/CD security gate that scans images before push, IaC before apply, or SBOMs for supply-chain weaknesses, and fails the build on policy violations.
Repository stars: 35,755 · Incomplete scan
Skill
testing-for-system-prompt-leakage
mukul975/Anthropic-Cybersecurity-Skills · skills/testing-for-system-prompt-leakage
Extracts LLM system prompts using direct requests, jailbreak/instruction-override framing, translation/encoding tricks, and few-shot replay, combining manual payloads with automated garak and Promptfoo scanners to surface embedded secrets, routing logic, and policy leakage (OWASP LLM07:2025). Use during LLM application red-team engagements or when validating that no credentials or authorization logic live in the system prompt.
Repository stars: 35,755 · Incomplete scan
Skill
analyzing-packed-malware-with-upx-unpacker
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-packed-malware-with-upx-unpacker
Identifies and unpacks UPX-packed malware samples, including binaries with modified UPX magic bytes or headers that block automated decompression, to recover the original executable for static analysis. Use when a sample shows high entropy, minimal imports, or only LoadLibrary/GetProcAddress in its import table, or when preparing a packed binary for disassembly in Ghidra or IDA.
Repository stars: 35,755 · Incomplete scan
Skill
performing-graphql-depth-limit-attack
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-graphql-depth-limit-attack
Execute and test GraphQL depth limit attacks using deeply nested recursive queries to identify denial-of-service vulnerabilities in GraphQL APIs.
Repository stars: 35,755 · Incomplete scan
Skill
analyzing-cobaltstrike-malleable-c2-profiles
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-cobaltstrike-malleable-c2-profiles
Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to extract HTTP/DNS transforms, URIs, headers, sleep/jitter, and injection behavior, then generate network detection signatures. Use when reverse-engineering a captured malleable profile or building detections against Cobalt Strike Beacon traffic.
Repository stars: 35,755 · Incomplete scan
Skill
recovering-deleted-files-with-photorec
mukul975/Anthropic-Cybersecurity-Skills · skills/recovering-deleted-files-with-photorec
Recovers deleted files from disk images and storage media using PhotoRec's file signature-based carving engine, which works regardless of file system damage or corruption. Use when recovering deleted or lost files from a forensic disk image, damaged storage device, or corrupted file system during evidence recovery.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-network-traffic-analysis-with-arkime
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-network-traffic-analysis-with-arkime
Queries Arkime (formerly Moloch) full packet capture via its API to search sessions, download PCAPs, detect C2 beaconing through connection interval/jitter stats, spot DNS tunneling via query-length analysis, and flag known-bad TLS certificate issuers, using the bundled scripts/agent.py. Use when investigating suspicious network flows or doing full-packet-capture forensics against an Arkime deployment.
Repository stars: 35,755 · Incomplete scan
Skill
building-adversary-infrastructure-tracking-system
mukul975/Anthropic-Cybersecurity-Skills · skills/building-adversary-infrastructure-tracking-system
Build an automated adversary infrastructure tracking system in Python (dnspython, python-whois, shodan, networkx) that pivots across passive DNS, certificate transparency logs, WHOIS records, and IP enrichment to map threat-actor C2 networks and flag newly registered domains matching known patterns. Use when pivoting from known indicators to discover related C2 infrastructure or maintaining a continuously updated map of a threat actor's network.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-canary-tokens-for-network-intrusion
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-canary-tokens-for-network-intrusion
Deploys DNS, HTTP, and AWS API key canary tokens across network infrastructure to detect unauthorized access and lateral movement. Integrates with webhook alerting (Slack, Teams, email, generic HTTP) for real-time intrusion notifications. Provides automated token generation, placement strategies, and monitoring for enterprise network environments. Use when building deception-based network intrusion detection with Canarytokens.org and Thinkst Canary platforms.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-honeytokens-for-breach-detection
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-honeytokens-for-breach-detection
Deploys canary tokens and honeytokens (fake AWS credentials, DNS canaries, document beacons, database records) that trigger alerts when accessed by attackers. Uses the Canarytokens API and custom webhook integrations for breach detection. Use when building deception-based early warning systems for intrusion detection.
Repository stars: 35,755 · Incomplete scan
Skill
building-ioc-enrichment-pipeline-with-opencti
mukul975/Anthropic-Cybersecurity-Skills · skills/building-ioc-enrichment-pipeline-with-opencti
Build an automated IOC enrichment pipeline on OpenCTI (STIX 2.1 native threat intel platform) using its internal enrichment connectors to pull context from VirusTotal, Shodan, AbuseIPDB, and GreyNoise, correlate indicators with known actors/campaigns, and score them for analyst prioritization. Use when deploying OpenCTI or automating enrichment and confidence scoring of newly ingested indicators.
Repository stars: 35,755 · Incomplete scan
Skill
analyzing-powershell-script-block-logging
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-powershell-script-block-logging
Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques. Uses python-evtx to extract and reconstruct multi-block scripts, applies entropy analysis and pattern matching for Base64-encoded commands, Invoke-Expression abuse, download cradles, and AMSI bypass attempts.
Repository stars: 35,755 · Incomplete scan
Skill
reverse-engineering-rust-malware
mukul975/Anthropic-Cybersecurity-Skills · skills/reverse-engineering-rust-malware
Reverse engineers Rust-compiled malware using IDA Pro and Ghidra, covering techniques for non-null-terminated fat-pointer strings, monomorphized/duplicated generic code, Result/Option unwrap chains, crate dependency extraction, and Rust-specific control flow and calling conventions. Use when analyzing Rust-based malware samples (e.g. BlackCat/ALPHV, Hive, Buer Loader) or attack artifacts in an authorized, controlled environment.
Repository stars: 35,755 · Incomplete scan
Skill
verifying-build-provenance-with-slsa-sigstore
mukul975/Anthropic-Cybersecurity-Skills · skills/verifying-build-provenance-with-slsa-sigstore
Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI/CD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.
Repository stars: 35,755 · Incomplete scan
Skill
testing-for-xss-vulnerabilities
mukul975/Anthropic-Cybersecurity-Skills · skills/testing-for-xss-vulnerabilities
Tests web applications for reflected, stored, and DOM-based Cross-Site Scripting by injecting JavaScript payloads with Burp Suite (XSS extensions, Active Scan++) and browser tools, then bypassing sanitization and CSP to demonstrate session hijacking and user impersonation. Use for OWASP WSTG client-side injection testing or when evaluating input sanitization and output encoding coverage.
Repository stars: 35,755 · Incomplete scan
Skill
detecting-malicious-npm-packages
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-malicious-npm-packages
Triage npm packages and lockfiles for install-script malware, credential exfiltration, and worming behavior using GuardDog, manual tarball inspection, and dynamic detonation with network/filesystem monitoring. Use when vetting a new dependency, reviewing a package.json/package-lock.json during code review, checking lockfiles against a supply-chain advisory's known-bad versions, or investigating a host suspected of installing a trojanized package.
Repository stars: 35,755 · Incomplete scan
Skill
hardening-docker-containers-for-production
mukul975/Anthropic-Cybersecurity-Skills · skills/hardening-docker-containers-for-production
Hardens Dockerfiles, images, and per-container runtime settings against the CIS Docker Benchmark v1.8.0: non-root users, dropped capabilities, read-only root filesystem, seccomp and AppArmor profiles, and minimal multi-stage builds, validated with docker-bench-security, Hadolint, and Dockle. Use when preparing a container or Dockerfile for production, or auditing images and runtime flags against CIS Docker controls. Keywords: Dockerfile, USER, --cap-drop, read-only rootfs, seccomp, AppArmor, multi-stage, Hadolint, Dockle. Do not use for the Docker daemon's own configuration - use hardening-docker-daemon-configuration.
Repository stars: 35,755 · Incomplete scan
Skill
building-role-mining-for-rbac-optimization
mukul975/Anthropic-Cybersecurity-Skills · skills/building-role-mining-for-rbac-optimization
Apply bottom-up and top-down role mining techniques, including clustering algorithms and formal concept analysis, to discover optimal RBAC roles from existing user-permission assignments, consolidating overlapping roles and enforcing least privilege. Use when an identity program needs to reduce role explosion or redesign its RBAC role set from access data.
Repository stars: 35,755 · Incomplete scan
Skill
implementing-privileged-access-workstation
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-privileged-access-workstation
Design and implement Privileged Access Workstations (PAWs) using the tiered administration model, with device hardening, device compliance enforcement via Microsoft Intune or Group Policy, just-in-time (JIT) access provisioning, and integration with PAM platforms like CyberArk or BeyondTrust. Use when hardening admin endpoints, designing a tiered administration model, or securing privileged administrative operations.
Repository stars: 35,755 · Incomplete scan
Automated signals, not a guarantee. How the checks work.
