Explore the full catalog
Explore skills, repositories and creators
Search the catalog or browse with filters. Checks are automated signals, not a safety guarantee.
Page 120 · 50 results shown
Skill
detecting-rootkit-activity
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-rootkit-activity
Detects rootkit presence on compromised systems by identifying hidden processes, hooked system calls, modified kernel structures, and covert network connections using Volatility memory forensics, cross-view detection, and tools like GMER, rkhunter, chkrootkit, and RootkitRevealer. Use when standard tools (Task Manager, netstat, AV/EDR) show nothing abnormal but compromise is suspected.
Repository stars: 35,758 · Incomplete scan
Skill
detecting-process-injection-techniques
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-process-injection-techniques
Detects and analyzes process injection techniques used by malware including classic DLL injection, process hollowing, APC injection, thread hijacking, and reflective loading. Uses memory forensics, API monitoring, and behavioral analysis to identify injection artifacts. Activates for requests involving process injection detection, code injection analysis, hollowed process investigation, or in-memory threat detection.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-image-provenance-verification-with-cosign
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-image-provenance-verification-with-cosign
Signs and verifies container image provenance with Sigstore Cosign, covering key-based and keyless OIDC signing (Fulcio, Rekor transparency log), SLSA attestations, and enforcing signature verification through Kubernetes admission control. Use when signing images for supply chain security, setting up keyless OIDC signing, attaching attestations, or enforcing a verified-images-only policy at admission. Keywords: Cosign, Sigstore, Fulcio, Rekor, keyless, attestation, cosign verify, admission policy. Do not use for in-toto layout-based pipeline attestation - use implementing-supply-chain-security-with-in-toto.
Repository stars: 35,758 · Incomplete scan
Skill
analyzing-typosquatting-domains-with-dnstwist
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-typosquatting-domains-with-dnstwist
Generate domain permutations with dnstwist and check DNS resolution to detect typosquatting, homograph phishing, and brand impersonation domains registered against your organization. Use when asked to monitor for lookalike domains, investigate a phishing domain, or assess brand-impersonation risk.
Repository stars: 35,758 · Incomplete scan
Skill
analyzing-outlook-pst-for-email-forensics
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-outlook-pst-for-email-forensics
Parse Microsoft Outlook PST and OST files using libpff and pst-utils to extract message content, headers, attachments, deleted items, and MAPI metadata, including recovery of items from the Recoverable Items folder. Use when conducting email forensic investigations, legal e-discovery, or incident response that requires reconstructing communication patterns or tracing message routing from Outlook archives.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-kubernetes-network-policy-with-calico
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-kubernetes-network-policy-with-calico
Installs Calico as the cluster CNI and writes standard Kubernetes NetworkPolicy under it, covering default-deny baselines, policy ordering and precedence, service-account-based selectors, and verifying that policy is genuinely being enforced. Use when adopting Calico as the enforcement CNI, establishing a default-deny baseline, or debugging why a NetworkPolicy is not taking effect under Calico. Keywords: Calico CNI, NetworkPolicy, default deny, policy order, Felix, service account selector. Do not use for Calico-only CRDs such as GlobalNetworkPolicy or DNS egress - use implementing-container-network-policies-with-calico; for CNI-agnostic policy use implementing-network-policies-for-kubernetes.
Repository stars: 35,758 · Incomplete scan
Skill
performing-hash-cracking-with-hashcat
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-hash-cracking-with-hashcat
Cracks password hashes with Hashcat, covering hash-type identification, dictionary/brute-force/rule-based attack modes, custom rule creation, GPU benchmarking, and password-strength/compliance reporting. Use for authorized penetration testing or security audits that need to evaluate password strength or crack captured hashes.
Repository stars: 35,758 · Incomplete scan
Skill
performing-threat-hunting-with-elastic-siem
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-threat-hunting-with-elastic-siem
Performs proactive threat hunting in Elastic Security SIEM using KQL/EQL queries, detection rules, and Timeline investigation to identify threats that evade automated detection. Use when SOC teams need to hunt for specific ATT&CK techniques, investigate anomalous behaviors, or validate detection coverage gaps using Elasticsearch and Kibana Security.
Repository stars: 35,758 · Incomplete scan
Skill
analyzing-windows-amcache-artifacts
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-windows-amcache-artifacts
Parses the Windows Amcache.hve registry hive with Eric Zimmerman's AmcacheParser and Timeline Explorer to extract evidence of program execution, application installation, and driver loading, including SHA-1 hash correlation with threat intel and timeline reconstruction. Use for Amcache forensics, program execution evidence gathering, or application compatibility cache investigations in DFIR work.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-hashicorp-vault-dynamic-secrets
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-hashicorp-vault-dynamic-secrets
Configures HashiCorp Vault dynamic secrets engines for database credentials, AWS IAM keys, and PKI certificates, with automatic generation, lease management, and rotation to eliminate static secrets in application configuration. Use when eliminating long-lived static credentials, configuring a Vault secrets engine, generating ephemeral database or cloud credentials, or automating credential rotation for compliance (PCI-DSS, NIST 800-53 IA-5).
Repository stars: 35,758 · Incomplete scan
Skill
building-malware-incident-communication-template
mukul975/Anthropic-Cybersecurity-Skills · skills/building-malware-incident-communication-template
Build structured communication templates for malware incidents (ransomware, wiper, trojan, worm), covering internal stakeholder notifications, executive briefings, technical advisories for IT teams, customer notifications, and regulatory disclosures, with severity-based escalation procedures. Use when drafting or standardizing incident communications and notification workflows for a malware outbreak.
Repository stars: 35,758 · Incomplete scan
Skill
detecting-container-runtime-threats-with-falco
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-container-runtime-threats-with-falco
Deploys and operates Falco with the modern eBPF driver in Kubernetes and Docker, covering driver selection, Helm installation, output channels, and the built-in ruleset that detects container escape, namespace abuse, privileged mounts, and anomalous syscalls. Use when standing Falco up on a cluster, choosing between the eBPF and kernel-module drivers, routing Falco alerts into a SIEM or Falcosidekick, or upgrading an existing deployment. Keywords: Falco, modern_ebpf, kernel module, Helm, Falcosidekick, runtime security, syscall. Do not use for authoring individual escape rules - use detecting-container-escape-with-falco-rules.
Repository stars: 35,758 · Incomplete scan
Skill
extracting-browser-history-artifacts
mukul975/Anthropic-Cybersecurity-Skills · skills/extracting-browser-history-artifacts
Extracts and analyzes browser history, cookies, cache, downloads, and bookmarks from Chrome, Firefox, and Edge using sqlite3, DB Browser for SQLite, Hindsight, and NirSoft tools (BrowsingHistoryView, ChromeCacheView, MZCacheView). Use when performing digital forensics or incident response on a disk image or live system and you need timeline evidence of a user's web activity.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-kubernetes-pod-security-standards
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-kubernetes-pod-security-standards
Chooses and applies the correct Kubernetes Pod Security Standard (Privileged, Baseline, Restricted) for a workload: what each profile forbids, how to map existing workloads to a profile, which securityContext fields must change, and how to plan a PodSecurityPolicy-to-PSS migration without breaking running pods. Use when deciding which pod security profile a namespace or workload should run under, auditing which workloads would fail Restricted, planning a PSP migration, or mapping pod security posture to a compliance control. Keywords: Pod Security Standards, PSS, Privileged, Baseline, Restricted, securityContext, runAsNonRoot, drop ALL capabilities, seccomp RuntimeDefault, PSP migration. Do not use for configuring the admission controller that enforces these profiles - use implementing-pod-security-admission-controller.
Repository stars: 35,758 · Incomplete scan
Skill
building-devsecops-pipeline-with-gitlab-ci
mukul975/Anthropic-Cybersecurity-Skills · skills/building-devsecops-pipeline-with-gitlab-ci
Configure a GitLab CI/CD pipeline that embeds SAST (Semgrep, SpotBugs, Gosec, Bandit, NodeJsScan), DAST, container scanning, dependency scanning, and secret detection via GitLab's managed security templates. Use when building a shift-left DevSecOps pipeline in GitLab, adding automated vulnerability scanning stages to .gitlab-ci.yml, or triaging scanner findings with GitLab Duo AI before deployment.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-ddos-mitigation-with-cloudflare
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-ddos-mitigation-with-cloudflare
Configure Cloudflare DDoS protection with managed rulesets, rate limiting, WAF rules, Bot Management, and origin protection to mitigate volumetric, protocol, and application-layer attacks.
Repository stars: 35,758 · Incomplete scan
Skill
performing-vlan-hopping-attack
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-vlan-hopping-attack
Simulates VLAN hopping attacks using switch spoofing and 802.1Q double tagging techniques in authorized lab environments to test VLAN segmentation effectiveness and switch port security. Use during an authorized penetration test to validate trunk port hardening, confirm DTP is disabled on access ports, and demonstrate Layer 2 segmentation bypass risk to network teams.
Repository stars: 35,758 · Incomplete scan
Skill
building-automated-malware-submission-pipeline
mukul975/Anthropic-Cybersecurity-Skills · skills/building-automated-malware-submission-pipeline
Builds an automated malware submission and analysis pipeline that collects suspicious files from endpoints and email gateways, submits them to sandbox environments and multi-engine scanners, and generates verdicts with IOCs for SIEM integration. Use when SOC teams need to scale malware analysis beyond manual sandbox submissions for high-volume alert triage.
Repository stars: 35,758 · Incomplete scan
Skill
exploiting-sql-injection-with-sqlmap
mukul975/Anthropic-Cybersecurity-Skills · skills/exploiting-sql-injection-with-sqlmap
Detecting and exploiting SQL injection vulnerabilities using sqlmap to extract database contents during authorized penetration tests.
Repository stars: 35,758 · Incomplete scan
Skill
performing-soc-tabletop-exercise
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-soc-tabletop-exercise
Performs tabletop exercises for SOC teams simulating security incidents through discussion-based scenarios to test incident response procedures, communication workflows, and decision-making under pressure without impacting production systems. Use when organizations need to validate IR playbooks, train analysts, or meet compliance requirements for incident response testing.
Repository stars: 35,758 · Incomplete scan
Skill
deploying-software-defined-perimeter
mukul975/Anthropic-Cybersecurity-Skills · skills/deploying-software-defined-perimeter
Deploys a Software-Defined Perimeter per the CSA v2.0 specification, configuring Single Packet Authorization, mutual TLS, and SDP controller/gateway components to enforce zero trust network access. Use when building or hardening zero trust network architecture, implementing SPA-based "invisible" infrastructure that cloaks services from unauthenticated scanning, or meeting compliance requirements for zero trust network access.
Repository stars: 35,758 · Incomplete scan
Skill
performing-adversary-in-the-middle-phishing-detection
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-adversary-in-the-middle-phishing-detection
Detect and respond to Adversary-in-the-Middle (AiTM) phishing attacks that use reverse proxy kits like EvilProxy, Evilginx, and Tycoon 2FA to bypass MFA and steal session tokens, correlating Azure AD/Entra sign-in logs, SIEM alerts, and EDR telemetry. Use when investigating suspected MFA-bypass phishing or session token theft, or building detection and response playbooks against reverse-proxy phishing kits.
Repository stars: 35,758 · Incomplete scan
Skill
performing-cloud-native-threat-hunting-with-aws-detective
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-cloud-native-threat-hunting-with-aws-detective
Investigate AWS security incidents using Amazon Detective's behavior graphs, built from CloudTrail, VPC Flow Logs, GuardDuty, and EKS audit logs, to trace entity timelines and profile IAM users, roles, EC2 instances, and IP addresses for lateral movement. Use when triaging GuardDuty findings, investigating a suspected AWS compromise, or reconstructing an attacker's activity timeline across AWS accounts.
Repository stars: 35,758 · Incomplete scan
Skill
fleet-hunting-with-velociraptor
mukul975/Anthropic-Cybersecurity-Skills · skills/fleet-hunting-with-velociraptor
Deploy a Velociraptor server and agents, then author VQL (Velociraptor Query Language) artifacts and run them as fleet-wide hunts, on-demand forensic collections, or standalone offline collectors. Use when hunting a TTP across hundreds or thousands of endpoints, collecting forensic artifacts during incident response without re-imaging, or generating collectors for unmanaged/air-gapped hosts.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-pam-for-database-access
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-pam-for-database-access
Deploy privileged access management for database systems including Oracle, SQL Server, PostgreSQL, and MySQL, covering session proxy configuration, credential vaulting, query auditing, dynamic credential generation, and least-privilege database roles. Use when securing DBA access, implementing database PAM controls, or auditing privileged database sessions.
Repository stars: 35,758 · Incomplete scan
Skill
conducting-phishing-incident-response
mukul975/Anthropic-Cybersecurity-Skills · skills/conducting-phishing-incident-response
Respond to phishing incidents by analyzing reported emails, extracting indicators, sandboxing URLs/attachments, assessing credential compromise, quarantining malicious messages organization-wide, and remediating affected accounts. Use when investigating a reported phishing or credential-phishing email, a suspected spearphishing incident, or when a mailbox-wide purge and account remediation is needed.
Repository stars: 35,758 · Incomplete scan
Skill
performing-ransomware-tabletop-exercise
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-ransomware-tabletop-exercise
Plans and facilitates tabletop exercises simulating ransomware incidents, using realistic scenarios based on threat actors like LockBit and ALPHV/BlackCat with injects covering double extortion and backup destruction, then evaluates responses against NIST CSF and CISA guidelines. Use when planning or running a ransomware tabletop exercise or incident response readiness drill.
Repository stars: 35,758 · Incomplete scan
Skill
attacking-entra-id-with-roadtools
mukul975/Anthropic-Cybersecurity-Skills · skills/attacking-entra-id-with-roadtools
Enumerate Microsoft Entra ID (Azure AD) tenants with ROADrecon and acquire, exchange, and abuse tokens (including primary refresh tokens) with roadtx. Use for authorized red-team enumeration of a tenant's directory objects or for token-based identity attacks against Entra ID you are explicitly authorized to test.
Repository stars: 35,758 · Incomplete scan
Skill
detecting-indirect-prompt-injection
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-indirect-prompt-injection
Detect and defend against indirect prompt injection hidden in web pages, documents, and images consumed by an agent, via content extraction (HTML/PDF/OCR), normalization, and scanning with LLM Guard's PromptInjection scanner or Hugging Face Prompt Guard 2. Use when an agent ingests untrusted external content and you need to screen it for injected instructions before the LLM processes it.
Repository stars: 35,758 · Incomplete scan
Skill
detecting-t1003-credential-dumping-with-edr
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-t1003-credential-dumping-with-edr
Detect OS credential dumping (MITRE T1003) targeting LSASS memory, the SAM database, NTDS.dit, and cached credentials by correlating EDR telemetry, Sysmon process-access events, and Windows security event logs. Use when hunting for Mimikatz-style credential theft, triaging an EDR alert on LSASS access, or scoping an incident after suspected credential dumping.
Repository stars: 35,758 · Incomplete scan
Skill
deploying-cloud-deception-with-decoy-resources
mukul975/Anthropic-Cybersecurity-Skills · skills/deploying-cloud-deception-with-decoy-resources
Deploy cloud-native deception across AWS, Azure, and GCP using decoy (honey) resources whose only purpose is to generate a high-fidelity alert the instant an attacker touches them: canary IAM access keys, permission-less decoy users/roles/service principals, honey object-storage buckets, and decoy secrets in Secrets Manager / Key Vault / Secret Manager. Wires detection through CloudTrail + EventBridge, Azure Sentinel honeytoken watchlists + Defender, and GCP Cloud Audit Logs, so any use of a decoy is routed to the SOC with near-zero false positives. Use when protecting cloud accounts and data stores, when an org has only on-prem honeypots and needs cloud coverage, when seeding fake AWS keys to catch credential theft and code-leak exposure, or when detecting cloud reconnaissance and lateral movement. Keywords: cloud deception, canary token AWS, honey S3 bucket, decoy IAM credentials, CloudTrail alert, GuardDuty, Sentinel honeytoken, decoy secret, honey service account, cloud honeypot, breach detection.
Repository stars: 35,758 · Incomplete scan
Skill
detecting-ai-model-prompt-injection-attacks
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-ai-model-prompt-injection-attacks
Detects prompt injection using regex signature matching, heuristic scoring for structural anomalies, and DeBERTa-based transformer classification, flagging direct injections (system-prompt overrides, role-play escapes) and indirect injections (encoded payloads, obfuscation) per OWASP LLM Top 10 (LLM01:2025). Use for input validation layers in chatbots/agents/RAG pipelines, or for retrospectively classifying injection attempts in logs or incident investigations.
Repository stars: 35,758 · Incomplete scan
Skill
performing-soc2-type2-audit-preparation
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-soc2-type2-audit-preparation
Automates SOC 2 Type II audit preparation including gap assessment against AICPA Trust Services Criteria (CC1-CC9), evidence collection from cloud providers and identity systems, control testing validation, remediation tracking, and continuous compliance monitoring. Covers all five TSC categories (Security, Availability, Processing Integrity, Confidentiality, Privacy) with automated evidence gathering from AWS, Azure, GCP, Okta, GitHub, and Jira. Use when preparing for or maintaining SOC 2 Type II certification.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-identity-verification-for-zero-trust
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-identity-verification-for-zero-trust
Implements continuous, risk-adaptive identity verification for zero trust using phishing-resistant MFA (FIDO2/WebAuthn), risk-based conditional access, and identity governance aligned with NIST SP 800-207 and the CISA Zero Trust Maturity Model Identity Pillar. Use when designing zero trust identity controls, deploying phishing-resistant MFA, or building conditional access policies based on device posture, behavior, and location.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-network-access-control-with-cisco-ise
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-network-access-control-with-cisco-ise
Deploys Cisco Identity Services Engine (ISE) as a RADIUS policy server for 802.1X wired and wireless authentication, MAC Authentication Bypass, posture assessment, dynamic VLAN assignment, downloadable ACLs, and TrustSec Security Group Tags. Use when deploying enterprise NAC with ISE and Active Directory integration, enforcing endpoint posture compliance, or segmenting access with TrustSec instead of a generic 802.1X/PacketFence setup.
Repository stars: 35,758 · Incomplete scan
Skill
analyzing-disk-image-with-autopsy
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-disk-image-with-autopsy
Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining metadata and embedded artifacts, keyword searching, and building investigation timelines with visual reports. Use for structured analysis of a forensic disk image or when stakeholders need visual reports from evidence.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-conduit-security-for-ot-remote-access
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-conduit-security-for-ot-remote-access
Implements secure conduit architecture for OT remote access under the IEC 62443 zones-and-conduits model, deploying jump servers, MFA gateways, session recording, and approval-based workflows for vendor and engineer access to ICS. Use when replacing direct VPN access into OT networks, securing third-party vendor access to SCADA equipment, or remediating audit findings on uncontrolled OT remote access.
Repository stars: 35,758 · Incomplete scan
Skill
performing-purple-team-exercise
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-purple-team-exercise
Performs purple team exercises by coordinating red team adversary emulation with blue team detection validation using MITRE ATT&CK-mapped attack scenarios, real-time detection testing, and collaborative gap remediation. Use when SOC teams need to validate detection capabilities, improve analyst skills, and close detection gaps through structured offensive-defensive collaboration.
Repository stars: 35,758 · Incomplete scan
Skill
detecting-exfiltration-over-dns-with-zeek
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-exfiltration-over-dns-with-zeek
Detect DNS-based data exfiltration by analyzing Zeek dns.log for high-entropy subdomains, oversized TXT/NULL records, and anomalous query volume or patterns. Use when investigating suspected DNS tunneling, covert C2 over DNS, or data exfiltration hidden in DNS queries against network traffic captured by Zeek.
Repository stars: 35,758 · Incomplete scan
Skill
analyzing-docker-container-forensics
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-docker-container-forensics
Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.
Repository stars: 35,758 · Incomplete scan
Skill
performing-endpoint-forensics-investigation
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-endpoint-forensics-investigation
Performs digital forensics investigation on compromised endpoints including memory acquisition, disk imaging, artifact analysis, and timeline reconstruction. Use when investigating security incidents, collecting evidence for legal proceedings, or analyzing endpoint compromise scope. Activates for requests involving endpoint forensics, memory analysis, disk forensics, or incident investigation.
Repository stars: 35,758 · Incomplete scan
Skill
exploiting-api-injection-vulnerabilities
mukul975/Anthropic-Cybersecurity-Skills · skills/exploiting-api-injection-vulnerabilities
Tests API parameters, headers, and request bodies for injection flaws — SQL injection, NoSQL injection, OS command injection, LDAP injection, and SSRF — by crafting payloads tailored to the target backend to extract data, execute commands, or reach internal services, mapped to OWASP API8:2023 and API7:2023 SSRF. Use when performing SQLi, NoSQL injection, command injection, or SSRF testing against APIs, or assessing API input validation.
Repository stars: 35,758 · Incomplete scan
Skill
performing-serverless-function-security-review
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-serverless-function-security-review
Performing security reviews of serverless functions across AWS Lambda, Azure Functions, and GCP Cloud Functions to identify overly permissive execution roles, insecure environment variables, injection vulnerabilities, and missing runtime protections.
Repository stars: 35,758 · Incomplete scan
Skill
auditing-uefi-firmware-with-chipsec
mukul975/Anthropic-Cybersecurity-Skills · skills/auditing-uefi-firmware-with-chipsec
Use Intel CHIPSEC to assess platform firmware configuration, SPI flash write protection, BIOS lock, SMM/SMRR, and Secure Boot variable state, dump SPI flash, and triage UEFI variables for firmware-level threats.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-mimecast-targeted-attack-protection
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-mimecast-targeted-attack-protection
Deploys and configures Mimecast Targeted Threat Protection (TTP) modules -- URL Protect (click-time URL rewriting/analysis), Attachment Protect (sandbox detonation), Impersonation Protect (BEC/whaling detection), and Internal Email Protect -- for Microsoft 365 or Google Workspace. Use when defending against phishing, spearphishing, or business email compromise, or configuring TTP policies in the Mimecast Administration Console.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-anti-phishing-training-program
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-anti-phishing-training-program
Guides designing, deploying, and measuring an anti-phishing security awareness program - baseline phishing simulations, interactive training modules, just-in-time learning, and metric tracking - using platforms like KnowBe4, Proofpoint Security Awareness, or Cofense. Use when building or maturing a phishing awareness program, establishing training controls for compliance, or measuring phishing susceptibility and reporting rates over time.
Repository stars: 35,758 · Incomplete scan
Skill
testing-api-for-mass-assignment-vulnerability
mukul975/Anthropic-Cybersecurity-Skills · skills/testing-api-for-mass-assignment-vulnerability
Tests APIs for mass assignment (auto-binding), OWASP API3:2023, by identifying writable endpoints, adding undocumented fields to request bodies (role, isAdmin, price, balance), and checking whether the server binds them to the data model without filtering. Use when testing an API for mass assignment, parameter binding abuse, or over-posting on profile, registration, or object-creation endpoints.
Repository stars: 35,758 · Incomplete scan
Skill
scanning-docker-images-with-trivy
mukul975/Anthropic-Cybersecurity-Skills · skills/scanning-docker-images-with-trivy
Scans a Docker image with Trivy for vulnerabilities in OS packages and language dependencies, misconfiguration, exposed secrets, and licence violations, emitting SARIF, CycloneDX, or SPDX output. Use when scanning or gating a specific image, wiring an image scan into CI/CD, or checking an image during an incident investigation. Keywords: Trivy, image scan, --severity, --exit-code, SARIF, ignore file, .trivyignore. Do not use for cluster-wide scanning or non-image targets - use performing-container-security-scanning-with-trivy; when the toolchain is Grype use scanning-container-images-with-grype.
Repository stars: 35,758 · Incomplete scan
Skill
detecting-shadow-it-cloud-usage
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-shadow-it-cloud-usage
Detect unauthorized SaaS and cloud service usage (shadow IT) by parsing proxy access logs, DNS query logs, and firewall/netflow data with Python pandas to aggregate traffic by domain, classify domains against known SaaS categories, and score risk by data volume and user count. Use when auditing an organization for unsanctioned cloud/SaaS usage or generating a shadow IT discovery report with remediation recommendations.
Repository stars: 35,758 · Incomplete scan
Skill
auditing-tls-certificate-transparency-logs
mukul975/Anthropic-Cybersecurity-Skills · skills/auditing-tls-certificate-transparency-logs
Monitors Certificate Transparency (CT) logs to detect unauthorized certificate issuance, discover subdomains via CT data, and alert on suspicious certificate activity for owned domains. Uses the crt.sh API and direct CT log querying based on RFC 6962 to build continuous monitoring pipelines that catch rogue certificates, track CA behavior, and map the external attack surface. Activates for requests involving certificate transparency monitoring, CT log auditing, subdomain discovery via certificates, or certificate issuance alerting.
Repository stars: 35,758 · Incomplete scan
Automated signals, not a guarantee. How the checks work.
