Explore the full catalog
Explore skills, repositories and creators
Search the catalog or browse with filters. Checks are automated signals, not a safety guarantee.
Page 119 · 50 results shown
Skill
testing-for-xxe-injection-vulnerabilities
mukul975/Anthropic-Cybersecurity-Skills · skills/testing-for-xxe-injection-vulnerabilities
Discovering and exploiting XML External Entity injection vulnerabilities to read server files, perform SSRF, and exfiltrate data during authorized penetration tests.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-api-key-security-controls
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-api-key-security-controls
Implements secure API key generation with sufficient entropy, server-side hashing (SHA-256/bcrypt) instead of plaintext storage, per-key scoping to endpoints/IPs/rate limits, zero-downtime rotation, and automated leak monitoring across GitHub repos, logs, and client-side code. Use when designing API key formats, building key rotation or revocation workflows, or protecting server-to-server API credentials from leakage, brute force, and abuse.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-soar-playbook-with-palo-alto-xsoar
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-soar-playbook-with-palo-alto-xsoar
Build automated incident response playbooks in Cortex XSOAR (Demisto) using its YAML playbook structure, integration commands, and task types to orchestrate phishing, malware, account-compromise, and DDoS response workflows across SOC tools. Use when authoring or wiring up an XSOAR playbook, adding custom XSOAR integration commands or Python automation scripts, or reducing manual SOC response time via orchestration.
Repository stars: 35,758 · Incomplete scan
Skill
performing-access-review-and-certification
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-access-review-and-certification
Designs and runs access review and certification campaigns-scoping, reviewer selection, risk-based prioritization, micro-certification, and remediation tracking-to verify user access matches job roles for SOX, HIPAA, and PCI DSS compliance. Use when planning or executing periodic access recertification or preparing evidence for an IAM compliance audit.
Repository stars: 35,758 · Incomplete scan
Skill
exploiting-sql-injection-vulnerabilities
mukul975/Anthropic-Cybersecurity-Skills · skills/exploiting-sql-injection-vulnerabilities
Identifies and exploits SQL injection vulnerabilities in web applications during authorized penetration tests using manual techniques and automated tools like sqlmap. The tester detects injection points through error-based, union-based, blind boolean, and time-based blind techniques across all major database engines (MySQL, PostgreSQL, MSSQL, Oracle) to demonstrate data extraction, authentication bypass, and potential remote code execution. Activates for requests involving SQL injection testing, SQLi exploitation, database security assessment, or injection vulnerability verification.
Repository stars: 35,758 · Incomplete scan
Skill
analyzing-malware-sandbox-evasion-techniques
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-malware-sandbox-evasion-techniques
Detect sandbox and VM evasion techniques in malware samples by analyzing timing checks, VM/hypervisor artifact queries, user-interaction checks, and sleep-inflation patterns from Cuckoo or AnyRun behavioral reports. Use when a sample shows no or minimal activity in a sandbox, when a behavioral report needs review for evasion indicators, or when building detections for anti-analysis techniques.
Repository stars: 35,758 · Incomplete scan
Skill
performing-sqlite-database-forensics
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-sqlite-database-forensics
Performs forensic analysis of SQLite databases by examining B-tree page structures, recovering deleted records from freelist pages and Write-Ahead Log (WAL) files, decoding encoded timestamps, and extracting evidence from browser history, messaging apps, and mobile device databases. Use when recovering deleted or unallocated data from a SQLite database during digital forensics or mobile/browser evidence analysis.
Repository stars: 35,758 · Incomplete scan
Skill
integrating-dast-with-owasp-zap-in-pipeline
mukul975/Anthropic-Cybersecurity-Skills · skills/integrating-dast-with-owasp-zap-in-pipeline
Integrates OWASP ZAP (Zed Attack Proxy) into GitHub Actions and GitLab CI pipelines, covering baseline, full, and API scan configuration against running applications, ZAP finding interpretation, scan policy tuning, and DAST quality gates. Use when testing running web apps or REST/GraphQL APIs for XSS, SQLi, CSRF, and auth/authz flaws, or when SAST alone is insufficient and runtime DAST is required for compliance or release gating.
Repository stars: 35,758 · Incomplete scan
Skill
performing-wireless-network-penetration-test
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-wireless-network-penetration-test
Execute a wireless network penetration test to assess WiFi security by capturing handshakes, cracking WPA2/WPA3 keys, detecting rogue access points, and testing wireless segmentation using Aircrack-ng and related tools.
Repository stars: 35,758 · Incomplete scan
Skill
detecting-pass-the-hash-attacks
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-pass-the-hash-attacks
Detect Pass-the-Hash (T1550.002) attacks by analyzing NTLM authentication patterns, flagging Type 3 logons using NTLM where Kerberos would be expected, and correlating with credential-dumping indicators. Use when threat hunting for lateral movement via stolen NTLM hashes, triaging EDR/SIEM alerts on suspicious NTLM logons, scoping compromise during incident response, or validating detection coverage in a purple team exercise.
Repository stars: 35,758 · Incomplete scan
Skill
exploiting-websocket-vulnerabilities
mukul975/Anthropic-Cybersecurity-Skills · skills/exploiting-websocket-vulnerabilities
Testing WebSocket implementations for authentication bypass, cross-site hijacking, injection attacks, and insecure message handling during authorized security assessments.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-cloud-waf-rules
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-cloud-waf-rules
Deploys and tunes Web Application Firewall rules on AWS WAF, Azure WAF, and Cloudflare, covering managed rule sets, custom business-logic rules, rate limiting, bot management, and false-positive reduction. Use when deploying new apps behind a cloud WAF, when pentests reveal injection/XSS flaws, when facing bot or credential-stuffing traffic, or when compliance (e.g. PCI-DSS) mandates a WAF.
Repository stars: 35,758 · Incomplete scan
Skill
configuring-tls-1-3-for-secure-communications
mukul975/Anthropic-Cybersecurity-Skills · skills/configuring-tls-1-3-for-secure-communications
Configures TLS 1.3 (RFC 8446) on servers, covering cipher suite and key-exchange group selection, and validates the resulting configuration with openssl s_client and testssl.sh. Use when deploying or hardening TLS 1.3 for secure communications, or when testing a server for common TLS misconfigurations and vulnerabilities.
Repository stars: 35,758 · Incomplete scan
Skill
analyzing-network-covert-channels-in-malware
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-network-covert-channels-in-malware
Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol abuse used for C2 and data exfiltration. Use when investigating suspicious DNS/ICMP/HTTP traffic patterns, hunting for hidden C2 channels in network captures, or attributing exfiltration traffic to a known tunneling toolset.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-ot-network-traffic-analysis-with-nozomi
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-ot-network-traffic-analysis-with-nozomi
Deploy Nozomi Networks Guardian sensors for passive OT network traffic analysis, providing asset visibility, behavioral anomaly detection, protocol-aware monitoring, and vulnerability assessment across industrial control systems without disrupting operations. Use when deploying OT/ICS network monitoring, configuring Guardian sensors, or building real-time threat detection for SCADA and industrial environments.
Repository stars: 35,758 · Incomplete scan
Skill
auditing-gcp-iam-permissions
mukul975/Anthropic-Cybersecurity-Skills · skills/auditing-gcp-iam-permissions
Auditing Google Cloud Platform IAM permissions to identify overly permissive bindings, primitive role usage, service account key proliferation, and cross-project access risks using gcloud CLI, Policy Analyzer, and IAM Recommender.
Repository stars: 35,758 · Incomplete scan
Skill
performing-cve-prioritization-with-kev-catalog
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-cve-prioritization-with-kev-catalog
Fetch and parse the CISA Known Exploited Vulnerabilities (KEV) catalog, enrich it with EPSS scores and CVSS metrics, and build a multi-factor prioritization engine and report that ranks CVE remediation by real-world exploitation evidence and BOD 22-01 deadlines. Use when triaging a vulnerability backlog, deciding patch order across many CVEs, or building an automated KEV+EPSS prioritization workflow.
Repository stars: 35,758 · Incomplete scan
Skill
performing-insider-threat-investigation
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-insider-threat-investigation
Investigates insider threat incidents involving employees, contractors, or trusted partners who misuse authorized access to steal data, sabotage systems, or violate security policies, combining digital forensics, user behavior analytics, and HR/legal coordination to build an evidence-based case. Use when DLP alerts flag large data transfers to personal cloud storage or USB devices, when UBA detects anomalous access patterns for a user account, or when investigating employee data theft, privilege misuse, or internal threat detection requests.
Repository stars: 35,758 · Incomplete scan
Skill
enumerating-cloud-with-cloudfox
mukul975/Anthropic-Cybersecurity-Skills · skills/enumerating-cloud-with-cloudfox
Run CloudFox's read-only Describe/List/Get enumeration (all-checks, role-trusts, secrets, endpoints, and permissions commands) to map AWS and Azure attack paths and surface exploitable misconfigurations. Use immediately after obtaining a cloud credential to build situational awareness, find exposed resources and secrets, or map sts:AssumeRole trust relationships for lateral-movement/privilege-escalation planning.
Repository stars: 35,758 · Incomplete scan
Skill
performing-static-malware-analysis-with-pe-studio
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-static-malware-analysis-with-pe-studio
Performs static analysis of Windows PE malware samples using PEStudio to examine file headers, imports, strings, and resources without executing the binary, identifying packing, anti-analysis tricks, and malicious imports. Use for pre-execution triage of a suspicious Windows executable before sandbox detonation.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-google-workspace-phishing-protection
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-google-workspace-phishing-protection
Configures Google Workspace advanced phishing and malware protection settings in the Admin Console — pre-delivery message scanning, attachment protection, spoofing/impersonation detection, and Enhanced Safe Browsing enforcement. Use when hardening Gmail against phishing, spoofing, and malware, or when tuning Workspace email security policies.
Repository stars: 35,758 · Incomplete scan
Skill
detecting-azure-storage-account-misconfigurations
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-azure-storage-account-misconfigurations
Audit Azure Blob and ADLS storage accounts for public access exposure, weak or long-lived SAS tokens, missing encryption at rest, disabled HTTPS-only traffic, and outdated TLS versions, using the azure-mgmt-storage Python SDK to generate a risk-scored report. Use when assessing an Azure subscription's storage accounts for misconfiguration, building cloud security posture checks, or investigating a suspected data exposure via public blob access.
Repository stars: 35,758 · Incomplete scan
Skill
analyzing-browser-forensics-with-hindsight
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-browser-forensics-with-hindsight
Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX, JSON, or SQLite output). Use during incident response, insider-threat investigations, or criminal cases when you need to reconstruct a user's web activity from a browser profile.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-microsegmentation-with-guardicore
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-microsegmentation-with-guardicore
Implements microsegmentation with Akamai Guardicore Segmentation to map application dependencies, visualize east-west traffic flows, and create granular, least-privilege network policies across VMs, containers, bare metal, and cloud. Use when blocking lateral movement in a data center or when PCI DSS/HIPAA compliance requires validated network segmentation.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-browser-isolation-for-zero-trust
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-browser-isolation-for-zero-trust
Deploys remote browser isolation (RBI) as a core component of a Zero Trust architecture. Implements isolation policies with URL categorization and risk-based routing, content disarming and reconstruction (CDR) for file sanitization, data loss prevention controls within isolated sessions, and integration with Secure Web Gateway and ZTNA platforms. Based on Cloudflare Browser Isolation, Menlo Security, and Zscaler RBI approaches. Use when hardening web access against zero-day exploits, phishing, credential theft, and browser-based data exfiltration.
Repository stars: 35,758 · Incomplete scan
Skill
analyzing-active-directory-acl-abuse
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-active-directory-acl-abuse
Detect dangerous ACL misconfigurations in Active Directory using ldap3 to identify GenericAll, WriteDACL, and WriteOwner abuse paths
Repository stars: 35,758 · Incomplete scan
Skill
performing-memory-forensics-with-volatility3-plugins
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-memory-forensics-with-volatility3-plugins
Analyze memory dumps using Volatility3 plugins to detect injected code, rootkits, credential theft, and malware artifacts in Windows, Linux, and macOS memory images.
Repository stars: 35,758 · Incomplete scan
Skill
testing-api-for-broken-object-level-authorization
mukul975/Anthropic-Cybersecurity-Skills · skills/testing-api-for-broken-object-level-authorization
Tests REST and GraphQL APIs for Broken Object Level Authorization (BOLA/IDOR, OWASP API1:2023) by intercepting API calls, identifying object ID parameters (numeric IDs, UUIDs, slugs), and systematically substituting IDs belonging to other users to check whether the server enforces per-object authorization. Use when asked to test BOLA or IDOR in an API, verify object-level authorization, or assess an API for access control bypass.
Repository stars: 35,758 · Incomplete scan
Skill
validating-tpm-measured-boot-attestation
mukul975/Anthropic-Cybersecurity-Skills · skills/validating-tpm-measured-boot-attestation
Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote/tpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware/kernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.
Repository stars: 35,758 · Incomplete scan
Skill
conducting-pass-the-ticket-attack
mukul975/Anthropic-Cybersecurity-Skills · skills/conducting-pass-the-ticket-attack
Perform Pass-the-Ticket (PtT) lateral movement by extracting Kerberos TGT/TGS tickets from LSASS memory on a compromised host and injecting them into another session to impersonate the ticket owner without knowing their password. Use during authorized post-exploitation to move laterally or escalate access via stolen Kerberos tickets, or to validate detections for Kerberos ticket theft and reuse.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-syslog-centralization-with-rsyslog
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-syslog-centralization-with-rsyslog
Configure rsyslog for centralized log collection with TLS encryption, custom templates, and log rotation, generating server and client configuration files with GnuTLS stream drivers, x509 certificate authentication, per-host log segregation, and reliable queue settings. Use when building a centralized, encrypted syslog pipeline, hardening rsyslog client/server configs for high-availability log infrastructure, or troubleshooting TLS-based syslog forwarding.
Repository stars: 35,758 · Incomplete scan
Skill
performing-container-image-hardening
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-container-image-hardening
Harden container images by minimizing attack surface, stripping unnecessary packages, implementing multi-stage builds, configuring non-root users, and applying CIS Docker Benchmark recommendations to produce secure, production-ready images. Use when building production container images, when compliance requires CIS Docker Benchmark adherence, or when shrinking image size to reduce vulnerability exposure from unused packages.
Repository stars: 35,758 · Incomplete scan
Skill
performing-timeline-reconstruction-with-plaso
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-timeline-reconstruction-with-plaso
Builds comprehensive forensic super-timelines using Plaso (log2timeline and psort) to correlate events across file system metadata, event logs, browser history, and registry artifacts into a unified chronological view. Use during complex forensic investigations that need cross-source event correlation, or when standard log analysis is insufficient to establish the sequence of activities for reporting findings.
Repository stars: 35,758 · Incomplete scan
Skill
conducting-full-scope-red-team-engagement
mukul975/Anthropic-Cybersecurity-Skills · skills/conducting-full-scope-red-team-engagement
Plan and execute a comprehensive, MITRE ATT&CK-aligned red team engagement spanning threat modeling, reconnaissance, initial access, and post-exploitation to evaluate an organization's detection, prevention, and response against APT-style behavior. Use when scoping or running a full-scope, objective-based engagement, or purple-teaming against a specific threat actor's TTPs.
Repository stars: 35,758 · Incomplete scan
Skill
analyzing-memory-dumps-with-volatility
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-memory-dumps-with-volatility
Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes, injected code, network connections, loaded modules, and extracted credentials. Supports Windows, Linux, and macOS memory forensics. Activates for requests involving memory forensics, RAM analysis, volatile data examination, process injection detection, or memory-resident malware investigation.
Repository stars: 35,758 · Incomplete scan
Skill
configuring-network-segmentation-with-vlans
mukul975/Anthropic-Cybersecurity-Skills · skills/configuring-network-segmentation-with-vlans
Designs and implements VLAN-based (802.1Q) network segmentation on managed switches to isolate zones such as corporate, servers, DMZ, guest, and IoT, and to limit lateral movement paths. Use when segmenting an enterprise network into isolated security zones, meeting compliance mandates (PCI-DSS, HIPAA, SOC 2) for network isolation, or reducing blast radius from a security incident.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-aqua-security-for-container-scanning
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-aqua-security-for-container-scanning
Deploy Aqua Security's Trivy scanner to detect vulnerabilities, misconfigurations, secrets, and license issues in container images across CI/CD pipelines and registries.
Repository stars: 35,758 · Incomplete scan
Skill
testing-for-email-header-injection
mukul975/Anthropic-Cybersecurity-Skills · skills/testing-for-email-header-injection
Tests web application email functionality (contact forms, password reset, newsletter subscriptions) for CRLF/SMTP header injection using Burp Suite and OWASP ZAP, checking whether attackers can inject headers, modify recipients, or abuse forms for spam relay. Use when testing any user-input-driven email-sending feature during a penetration test.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-cloud-vulnerability-posture-management
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-cloud-vulnerability-posture-management
Implement multi-cloud CSPM to detect cloud-native misconfigurations and vulnerabilities (IAM over-permissions, exposed storage, unencrypted data, missing network controls) using AWS Security Hub, Azure Defender for Cloud, and open-source Prowler and ScoutSuite scans, then aggregate results across clouds. Use when auditing multi-cloud environments for misconfiguration-driven vulnerabilities or building a consolidated cross-cloud posture report.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-end-to-end-encryption-for-messaging
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-end-to-end-encryption-for-messaging
Implements a simplified Signal Protocol-style end-to-end encryption scheme for messaging, covering key exchange, forward secrecy, and the core cryptographic components so no server or intermediary can decrypt messages. Use when designing or building E2EE messaging, or evaluating forward-secrecy and key-management tradeoffs for a messaging system.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-data-loss-prevention-with-microsoft-purview
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-data-loss-prevention-with-microsoft-purview
Implements DLP policies using Microsoft Purview PowerShell cmdlets and the Graph API to protect data across Exchange Online, SharePoint, OneDrive, Teams, endpoints, and Power BI, including sensitivity labels, custom sensitive information types with regex, endpoint DLP rules, and Activity Explorer monitoring. Use when stopping PII/PHI/PCI exfiltration, configuring sensitivity labels, or investigating DLP incidents for policy tuning.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-fuzz-testing-in-cicd-with-aflplusplus
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-fuzz-testing-in-cicd-with-aflplusplus
Integrates AFL++ coverage-guided fuzzing into CI/CD pipelines, covering harness construction, AFL++/AddressSanitizer/CmpLog instrumentation builds, and persistent-mode fuzzing to discover memory-corruption and input-handling vulnerabilities in C/C++ code. Use when adding automated fuzz testing to a build pipeline or hunting for memory-safety bugs in native/compiled applications.
Repository stars: 35,758 · Incomplete scan
Skill
monitoring-scada-modbus-traffic-anomalies
mukul975/Anthropic-Cybersecurity-Skills · skills/monitoring-scada-modbus-traffic-anomalies
Monitors Modbus TCP traffic on SCADA and ICS networks to detect anomalous function code usage, unauthorized register writes, and suspicious communication patterns. The analyst uses deep packet inspection with pymodbus, Scapy, and Zeek to baseline normal PLC/RTU communication behavior, then applies statistical and rule-based anomaly detection to identify reconnaissance, parameter manipulation, and denial-of-service attacks targeting Modbus devices on port 502. Activates for requests involving Modbus traffic analysis, SCADA network monitoring, ICS anomaly detection, PLC security monitoring, or OT network threat detection.
Repository stars: 35,758 · Incomplete scan
Skill
hunting-for-ntlm-relay-attacks
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-for-ntlm-relay-attacks
Detects NTLM relay attacks (MITRE T1557.001) by analyzing Windows Event ID 4624 logon type 3 with NTLMSSP authentication, flagging IP-to-hostname mismatches, Responder/LLMNR poisoning signatures, SMB signing status, and anomalous cross-domain authentication patterns. Use when investigating credential-relay activity in Active Directory or building detections for NTLM relay and coercion-based attacks.
Repository stars: 35,758 · Incomplete scan
Skill
detecting-living-off-the-land-with-lolbas
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-living-off-the-land-with-lolbas
Detect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including certutil, regsvr32, mshta, and rundll32 via process telemetry, Sigma rules, and parent-child process analysis with Sysmon endpoint data. Use when hunting for adversaries abusing built-in Windows binaries to download, execute, or proxy malicious code while evading traditional executable-based detection.
Repository stars: 35,758 · Incomplete scan
Skill
analyzing-memory-forensics-with-lime-and-volatility
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-memory-forensics-with-lime-and-volatility
Performs Linux memory acquisition using LiME (Linux Memory Extractor) kernel module and analysis with Volatility 3 framework. Extracts process lists, network connections, bash history, loaded kernel modules, and injected code from Linux memory images. Use when performing incident response on compromised Linux systems.
Repository stars: 35,758 · Incomplete scan
Skill
testing-for-xss-vulnerabilities-with-burpsuite
mukul975/Anthropic-Cybersecurity-Skills · skills/testing-for-xss-vulnerabilities-with-burpsuite
Identifying and validating cross-site scripting vulnerabilities using Burp Suite's scanner, intruder, and repeater tools during authorized security assessments.
Repository stars: 35,758 · Incomplete scan
Skill
performing-cloud-storage-forensic-acquisition
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-cloud-storage-forensic-acquisition
Perform forensic acquisition of cloud storage services including Google Drive, OneDrive, Dropbox, and Box by pulling API-based remote data such as revision history and audit logs, and collecting local sync-client artifacts including KAPE targets and OneDrive databases from endpoints. Use during incident response or e-discovery when evidence resides in cloud-synced storage and both cloud-side and endpoint-side artifacts must be preserved.
Repository stars: 35,758 · Incomplete scan
Skill
performing-firmware-malware-analysis
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-firmware-malware-analysis
Analyzes firmware images for embedded malware, backdoors, and unauthorized modifications in routers, IoT devices, UEFI/BIOS, and embedded systems, covering firmware extraction, filesystem analysis, binary reverse engineering, and bootkit detection. Use for firmware security analysis, IoT malware investigation, UEFI rootkit detection, or embedded device compromise assessment.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-policy-as-code-with-open-policy-agent
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-policy-as-code-with-open-policy-agent
Implements policy-as-code enforcement with Open Policy Agent (OPA) and Gatekeeper for Kubernetes and CI/CD pipelines, covering writing Rego policies, deploying OPA Gatekeeper as a Kubernetes admission controller, testing policies in development, and integrating policy evaluation into deployment pipelines. Use when writing Rego policies, deploying Gatekeeper admission control, or gating CI/CD pipelines with policy-as-code checks.
Repository stars: 35,758 · Incomplete scan
Automated signals, not a guarantee. How the checks work.
