Explore the full catalog
Explore skills, repositories and creators
Search the catalog or browse with filters. Checks are automated signals, not a safety guarantee.
Page 122 · 50 results shown
Skill
managing-intelligence-lifecycle
mukul975/Anthropic-Cybersecurity-Skills · skills/managing-intelligence-lifecycle
Manages the end-to-end cyber threat intelligence lifecycle from planning and direction through collection, processing, analysis, dissemination, and feedback to ensure intelligence products meet stakeholder requirements and continuously improve. Use when establishing or maturing a CTI program, defining intelligence requirements with business stakeholders, or building feedback loops between intelligence consumers and producers. Activates for requests involving CTI program maturity, intelligence requirements, PIRs, or intelligence lifecycle management.
Repository stars: 35,758 · Incomplete scan
Skill
performing-security-headers-audit
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-security-headers-audit
Auditing HTTP security headers including CSP, HSTS, X-Frame-Options, and cookie attributes to identify missing or misconfigured browser-level protections.
Repository stars: 35,758 · Incomplete scan
Skill
performing-web-cache-poisoning-attack
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-web-cache-poisoning-attack
Exploiting web cache mechanisms to serve malicious content to other users by poisoning cached responses through unkeyed headers and parameters during authorized security tests.
Repository stars: 35,758 · Incomplete scan
Skill
configuring-hsm-for-key-storage
mukul975/Anthropic-Cybersecurity-Skills · skills/configuring-hsm-for-key-storage
Configures Hardware Security Modules for cryptographic key storage using the PKCS#11 standard interface, covering key generation, signing, encryption, and key management on physical HSMs and SoftHSM2 for development. Use when protecting cryptographic keys so they never leave a hardened device boundary, or when building and testing PKCS#11-based key management workflows.
Repository stars: 35,758 · Incomplete scan
Skill
performing-ot-network-security-assessment
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-ot-network-security-assessment
This skill covers conducting comprehensive security assessments of Operational Technology (OT) networks including SCADA systems, DCS architectures, and industrial control system communication paths. It addresses the Purdue Reference Model layers, identifies IT/OT convergence risks, evaluates firewall rules between zones, and maps industrial protocol traffic (Modbus, DNP3, OPC UA, EtherNet/IP) to detect misconfigurations, unauthorized connections, and attack surfaces in critical infrastructure.
Repository stars: 35,758 · Incomplete scan
Skill
analyzing-malware-behavior-with-cuckoo-sandbox
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-malware-behavior-with-cuckoo-sandbox
Detonate malware samples in Cuckoo Sandbox to observe runtime behavior — process creation, file system and registry changes, network communications, and API calls — and generate behavioral reports for classification and IOC extraction. Use when a sample has passed static triage and needs dynamic/behavioral analysis, when mapping a full infection chain, or when building YARA/behavioral signatures from observed sandbox activity.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-secrets-scanning-in-ci-cd
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-secrets-scanning-in-ci-cd
Integrate gitleaks and trufflehog into CI/CD pipelines to detect leaked secrets before deployment
Repository stars: 35,758 · Incomplete scan
Skill
implementing-gdpr-data-subject-access-request
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-gdpr-data-subject-access-request
Automates GDPR Data Subject Access Request (DSAR) workflows including identity verification, PII discovery across databases and files using regex and NER, data mapping, response templating per Article 15 requirements, deadline tracking, and audit logging. Covers ICO/EDPB guidance compliance, exemption handling, and scalable batch processing. Use when building or auditing DSAR response capabilities under GDPR/UK GDPR.
Repository stars: 35,758 · Incomplete scan
Skill
hunting-bootkits-in-efi-system-partition
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-bootkits-in-efi-system-partition
Baseline the EFI System Partition and hunt malicious EFI binaries such as ESPecter, BlackLotus, Bootkitty, and Glupteba by mounting the ESP, hashing and verifying boot loaders, scanning with YARA, and flagging anomalous non-EFI files or out-of-band bootloader changes. Use during proactive threat hunts for firmware/bootkit persistence (MITRE ATT&CK T1542.003) or when investigating suspected UEFI-level compromise that survives OS reinstall.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-api-abuse-detection-with-rate-limiting
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-api-abuse-detection-with-rate-limiting
Implements API abuse detection using token bucket, sliding window, and fixed window rate-limiting algorithms backed by Redis, including adaptive limits that tighten during detected attacks and relax during normal traffic. Use when defending APIs against DDoS, brute force login attempts, credential stuffing, or scraping abuse and you need to design or tune rate-limiting logic.
Repository stars: 35,758 · Incomplete scan
Skill
hunting-for-supply-chain-compromise
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-for-supply-chain-compromise
Runs a hypothesis-driven threat hunt for supply-chain compromise (T1195) by querying SIEM/EDR logs for trojanized software updates, compromised dependencies, unauthorized code modifications, and tampered build artifacts. Use when hunting after threat intel flags a compromised vendor/dependency, scoping a build-pipeline compromise, or reviewing update/build integrity.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-digital-signatures-with-ed25519
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-digital-signatures-with-ed25519
Implements digital signatures using the Ed25519 algorithm (Curve25519), covering key-pair generation, signing, signature verification, and security tradeoffs versus RSA and ECDSA. Use when adding message or artifact signing and authentication-integrity checks to a system, or when advising on Ed25519 key properties and validation criteria.
Repository stars: 35,758 · Incomplete scan
Skill
performing-docker-bench-security-assessment
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-docker-bench-security-assessment
Runs Docker Bench for Security, the open-source CIS Docker Benchmark audit script, across host configuration, daemon settings, images, and runtime configuration, then interprets pass/fail/warn output and remediates the common failures. Use when auditing Docker hosts for CIS compliance, scheduling recurring container assessments, or validating runtime hardening controls after a change. Keywords: docker-bench-security, CIS Docker Benchmark, audit script, pass fail warn, host configuration, remediation. Do not use for applying the daemon hardening itself - use hardening-docker-daemon-configuration.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-gcp-organization-policy-constraints
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-gcp-organization-policy-constraints
Implements GCP Organization Policy constraints via gcloud and Terraform, such as restricting external IPs, resource locations, default service accounts, and service account keys, plus dry-run testing of policy impact before enforcement. Use when enforcing security guardrails across an org's resource hierarchy, or hardening GCP config at the org, folder, or project level.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-cisa-zero-trust-maturity-model
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-cisa-zero-trust-maturity-model
Assess, gap-analyze, and progressively implement the CISA Zero Trust Maturity Model v2.0 across five pillars (Identity, Devices, Networks, Applications & Workloads, Data) and three cross-cutting capabilities (Visibility/Analytics, Automation/Orchestration, Governance), from Traditional through Optimal maturity. Use for a federal/enterprise ZTMM assessment, phased roadmap, or mapping controls to NIST SP 800-207 and EO 14028.
Repository stars: 35,758 · Incomplete scan
Skill
detecting-network-anomalies-with-zeek
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-network-anomalies-with-zeek
Deploy and configure Zeek (formerly Bro) to passively analyze network traffic, generate structured connection/DNS/HTTP/SSL/file logs, detect anomalous behavior, and write custom scripts for organization-specific threats. Use for passive monitoring at network choke points, feeding SIEM/threat hunting with protocol metadata, or retrospective log analysis during incident response; not a substitute for inline IDS/IPS or host agents.
Repository stars: 35,758 · Incomplete scan
Skill
performing-yara-rule-development-for-detection
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-yara-rule-development-for-detection
Develops precise YARA and YARA-X rules for malware detection by identifying unique strings, byte sequences, PE header traits, and behavioral indicators in unpacked malware artifacts while minimizing false positives. Use when building detection signatures for threat hunting, classifying malware families, or authoring rules from IOCs such as C2 URLs, mutex names, and encryption constants.
Repository stars: 35,758 · Incomplete scan
Skill
analyzing-supply-chain-malware-artifacts
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-supply-chain-malware-artifacts
Investigate supply chain attack artifacts including trojanized software updates, compromised build pipelines, and sideloaded dependencies to identify intrusion vectors and scope of compromise.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-network-segmentation-with-firewall-zones
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-network-segmentation-with-firewall-zones
Designs and implements network segmentation using firewall security zones, VLANs, inter-zone ACLs, and workload-level microsegmentation to restrict east-west lateral movement and enforce least-privilege access. Use when architecting security zones, writing inter-zone firewall policies, or meeting PCI DSS/HIPAA/NIST 800-53/zero-trust segmentation requirements for dynamic or traditional network environments.
Repository stars: 35,758 · Incomplete scan
Skill
performing-file-carving-with-foremost
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-file-carving-with-foremost
Recovers files from disk images and unallocated space using Foremost's header-footer signature carving, extracting evidence independent of the file system's state. Use during digital forensics investigations to carve deleted or fragmented files, such as documents, images, and archives, from raw disk images or unallocated space.
Repository stars: 35,758 · Incomplete scan
Skill
securing-aws-lambda-execution-roles
mukul975/Anthropic-Cybersecurity-Skills · skills/securing-aws-lambda-execution-roles
Hardens AWS Lambda execution roles by writing least-privilege IAM policies, applying permission boundaries, restricting resource-based policies, validating permissions with IAM Access Analyzer, and enforcing role scoping through SCPs. Use when deploying new Lambda functions, remediating overly permissive Lambda roles found in an audit, or building reusable least-privilege IAM role templates for serverless teams.
Repository stars: 35,758 · Incomplete scan
Skill
hunting-saas-sso-token-abuse
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-saas-sso-token-abuse
Hunts for stolen-session and OAuth/PRT token replay (T1550.001) by correlating Microsoft Entra ID SigninLogs SessionId/UniqueTokenIdentifier fields and Okta System Log sso/session events to spot impossible travel, refresh-token reuse, and token use from anomalous ASNs. Use when hunting MFA-bypass via stolen cookies/tokens, investigating impossible-travel alerts, or scoping SaaS lateral movement after phishing.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-pod-security-admission-controller
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-pod-security-admission-controller
Configures and operates the Kubernetes Pod Security Admission (PSA) controller that enforces Pod Security Standards: namespace enforce/audit/warn labels, cluster-wide defaults via AdmissionConfiguration, exemptions for usernames, runtime classes and namespaces, version pinning, and troubleshooting pods the controller rejected. Use when wiring PSA up on a cluster, setting cluster-wide default enforcement, exempting system namespaces, debugging why a pod was rejected or why enforcement is not firing, or reading PSA audit and warning output. Keywords: Pod Security Admission, PSA, admission controller, AdmissionConfiguration, pod-security.kubernetes.io labels, enforce audit warn, exemptions, kube-apiserver. Do not use for choosing which security profile a workload needs - use implementing-kubernetes-pod-security-standards.
Repository stars: 35,758 · Incomplete scan
Skill
performing-dns-tunneling-detection
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-dns-tunneling-detection
Detects DNS tunneling by computing Shannon entropy of DNS query names, analyzing query length distributions, inspecting TXT record payloads, and identifying high subdomain cardinality. Uses scapy for packet capture analysis and statistical methods to distinguish legitimate DNS from covert channels. Use when hunting for data exfiltration.
Repository stars: 35,758 · Incomplete scan
Skill
configuring-windows-event-logging-for-detection
mukul975/Anthropic-Cybersecurity-Skills · skills/configuring-windows-event-logging-for-detection
Configures Windows Event Logging with advanced audit policies to generate high-fidelity security events for threat detection and forensic investigation. Use when enabling audit policies for logon events, process creation, privilege use, and object access to feed SIEM detection rules. Activates for requests involving Windows audit policy, event log configuration, security logging, or detection-oriented logging.
Repository stars: 35,758 · Incomplete scan
Skill
collecting-open-source-intelligence
mukul975/Anthropic-Cybersecurity-Skills · skills/collecting-open-source-intelligence
Collects and synthesizes open-source intelligence (OSINT) about threat actors, malicious infrastructure, and attack campaigns using publicly available data sources, passive reconnaissance tools, and dark web monitoring. Use when investigating external threat actor infrastructure, performing pre-engagement reconnaissance for authorized red team assessments, or enriching CTI reports with publicly available adversary context. Activates for requests involving Maltego, Shodan, OSINT framework, SpiderFoot, or infrastructure reconnaissance.
Repository stars: 35,758 · Incomplete scan
Skill
performing-cloud-native-forensics-with-falco
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-cloud-native-forensics-with-falco
Uses Falco YAML rules for runtime threat detection in containers and Kubernetes, monitoring syscalls for shell spawns, file tampering, network anomalies, and privilege escalation. Manages Falco rules via the Falco gRPC API and parses Falco alert output. Use when building container runtime security or investigating k8s cluster compromises.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-just-in-time-access-provisioning
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-just-in-time-access-provisioning
Implements Just-In-Time (JIT) access provisioning to eliminate standing privileges by granting temporary, time-bound access, covering approval workflows, automatic expiration/revocation, and PAM/IGA integration. Use when designing access approval workflows or replacing standing privileged accounts with time-bound, zero-trust-aligned grants.
Repository stars: 35,758 · Incomplete scan
Skill
detecting-process-hollowing-technique
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-process-hollowing-technique
Detect process hollowing (MITRE T1055.012) by analyzing memory-mapped sections, hollowed process indicators, and parent-child anomalies using EDR telemetry, Volatility's malfind plugin, pe-sieve, Hollows Hunter, and Sysmon Event ID 25. Use when investigating a legitimate-looking process (svchost.exe, explorer.exe, rundll32.exe) suspected of hosting injected code via NtUnmapViewOfSection.
Repository stars: 35,758 · Incomplete scan
Skill
building-identity-federation-with-saml-azure-ad
mukul975/Anthropic-Cybersecurity-Skills · skills/building-identity-federation-with-saml-azure-ad
Configure SAML 2.0 identity federation between on-premises Active Directory (via AD FS or a third-party IdP) and Microsoft Entra ID, covering federation models (AD FS, password hash sync, pass-through auth, third-party IdP) and the SAML authentication flow. Use when extending on-premises authentication authority to cloud resources or designing hybrid identity SSO architecture for Entra ID.
Repository stars: 35,758 · Incomplete scan
Skill
performing-brand-monitoring-for-impersonation
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-brand-monitoring-for-impersonation
Monitor for brand impersonation attacks across domains, social media, mobile apps, and dark web channels to detect phishing campaigns, fake sites, and unauthorized brand usage targeting your organization.
Repository stars: 35,758 · Incomplete scan
Skill
hunting-for-anomalous-powershell-execution
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-for-anomalous-powershell-execution
Hunt for malicious PowerShell activity by analyzing Script Block Logging (Event 4104), Module Logging (Event 4103), and process creation events. The analyst parses Windows Event Log EVTX files to detect obfuscated commands, AMSI bypass attempts, encoded payloads, credential dumping keywords, and suspicious download cradles. Activates for requests involving PowerShell threat hunting, script block analysis, encoded command detection, or AMSI bypass identification.
Repository stars: 35,758 · Incomplete scan
Skill
performing-clickjacking-attack-test
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-clickjacking-attack-test
Testing web applications for clickjacking vulnerabilities by assessing frame embedding controls and crafting proof-of-concept overlay attacks during authorized security assessments.
Repository stars: 35,758 · Incomplete scan
Skill
performing-ot-vulnerability-assessment-with-claroty
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-ot-vulnerability-assessment-with-claroty
Perform OT vulnerability assessments using the Claroty xDome platform for asset discovery, risk scoring, and vulnerability correlation, combining passive traffic-based identification and active safe device querying with CVE/ICS-CERT advisory correlation for remediation prioritization. Use for scheduled IEC 62443 or NERC CIP OT vulnerability assessments, initial xDome deployment, or generating CIP-010-4 compliance evidence; not for active PLC scanning or penetration testing.
Repository stars: 35,758 · Incomplete scan
Skill
conducting-api-security-testing
mukul975/Anthropic-Cybersecurity-Skills · skills/conducting-api-security-testing
Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic. The tester uses the OWASP API Security Top 10 as the testing framework, combining Burp Suite interception with Postman collections and custom scripts to test endpoint security at every privilege level. Activates for requests involving API security testing, REST API pentest, GraphQL security assessment, or API vulnerability testing.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-hipaa-security-rule-safeguards
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-hipaa-security-rule-safeguards
Implement the HIPAA Security Rule (45 CFR Part 164 Subpart C) to protect electronic protected health information (ePHI): conduct the required risk analysis, deploy the administrative, physical, and technical safeguards, handle required vs addressable implementation specifications, execute Business Associate Agreements, and stand up breach-notification readiness. Use when an organization is a HIPAA covered entity or business associate, when protecting ePHI, when preparing for an OCR audit or responding to a breach, when performing a HIPAA Security Risk Analysis, when drafting or reviewing a BAA, or when mapping security controls to the §164.308/310/312/314/316 safeguards. Notes the 2025 NPRM proposed changes (not yet final). Keywords: HIPAA, HIPAA Security Rule, ePHI, PHI, 45 CFR 164, risk analysis, administrative safeguards, physical safeguards, technical safeguards, addressable, required, Business Associate Agreement, BAA, OCR, breach notification, HITECH, covered entity, business associate.
Repository stars: 35,758 · Incomplete scan
Skill
detecting-modbus-command-injection-attacks
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-modbus-command-injection-attacks
Detect command injection against Modbus TCP/RTU in ICS/SCADA environments by monitoring unauthorized writes, anomalous function codes, malformed frames, and deviations from communication baselines using ICS-aware IDS and deep packet inspection. Use when deploying IDS for Modbus OT networks, investigating unauthorized PLC register/coil changes, or responding to FrostyGoop-style Modbus attacks.
Repository stars: 35,758 · Incomplete scan
Skill
detecting-container-escape-with-falco-rules
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-container-escape-with-falco-rules
Writes and tunes Falco rule syntax for container escape detection - conditions, macros, lists, priorities, and output fields - covering host filesystem mounts, sensitive host path access, kernel module loading, and privileged capability abuse, including how to drive down false positives. Use when authoring or tuning a specific Falco rule for breakout behaviour, or triaging a noisy escape-related Falco alert. Keywords: Falco rule, macro, list, condition, priority, falco_rules.local.yaml, tuning, false positive. Do not use for deploying and operating Falco itself - use detecting-container-runtime-threats-with-falco; for tool-agnostic escape signals use detecting-container-escape-attempts.
Repository stars: 35,758 · Incomplete scan
Skill
exploiting-race-condition-vulnerabilities
mukul975/Anthropic-Cybersecurity-Skills · skills/exploiting-race-condition-vulnerabilities
Detects and exploits race condition (TOCTOU) vulnerabilities in web applications using Burp Suite's Turbo Intruder extension and its single-packet attack technique to fire parallel requests that bypass rate limits, duplicate transactions, or overrun usage limits. Use when pentesting endpoints with balances, coupon redemption, or rate limiting that concurrent requests might manipulate.
Repository stars: 35,758 · Incomplete scan
Skill
auditing-kubernetes-cluster-rbac
mukul975/Anthropic-Cybersecurity-Skills · skills/auditing-kubernetes-cluster-rbac
Auditing Kubernetes cluster RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous ClusterRoleBindings, service account abuse, and privilege escalation paths using kubectl, rbac-tool, KubiScan, and Kubeaudit.
Repository stars: 35,758 · Incomplete scan
Skill
hunting-for-dns-based-persistence
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-for-dns-based-persistence
Hunts for DNS-based persistence mechanisms such as DNS hijacking, dangling CNAME records enabling subdomain takeover, wildcard DNS abuse, and unauthorized zone or NS delegation changes, using passive DNS history (SecurityTrails API), Route53/Azure DNS/Cloudflare audit logs, and zone transfer analysis. Use when investigating suspected DNS hijacking or subdomain takeover, or when threat hunting for DNS record tampering that persists across credential rotations and endpoint reimaging.
Repository stars: 35,758 · Incomplete scan
Skill
analyzing-windows-shellbag-artifacts
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-windows-shellbag-artifacts
Analyze Windows Shellbag (BagMRU) registry artifacts with SBECmd and Shellbags Explorer to reconstruct folder browsing activity and prove user interaction with directories, including removable media and network shares, even after the folders are deleted. Use when reconstructing a user's folder access history or proving access to a since-removed directory in DFIR work.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-threat-modeling-with-mitre-attack
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-threat-modeling-with-mitre-attack
Implements threat modeling using the MITRE ATT&CK framework to map adversary TTPs against organizational assets, assess detection coverage gaps, and prioritize defensive investments. Use when SOC teams need to align detection engineering with threat landscape, conduct threat assessments for new environments, or justify security tool procurement.
Repository stars: 35,758 · Incomplete scan
Skill
analyzing-windows-lnk-files-for-artifacts
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-windows-lnk-files-for-artifacts
Parse Windows LNK shortcut files to extract target paths, MAC timestamps, volume serial numbers, and machine identifiers for forensic timeline reconstruction. Use when investigating recently-accessed files, tracking removable media or network paths referenced by shortcuts, or building a DFIR timeline from LNK artifacts.
Repository stars: 35,758 · Incomplete scan
Skill
detecting-api-enumeration-attacks
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-api-enumeration-attacks
Detect API enumeration attacks (BOLA/IDOR, OWASP API1:2023) by writing SIEM detection rules that flag sequential or UUID identifier iteration, parameter tampering, and mixed 200/401/403 response patterns from API gateway and WAF logs. Use when investigating suspected object-level authorization abuse, building threat-hunting queries for API access-control bypass, or hardening API logging/rate-limiting against enumeration.
Repository stars: 35,758 · Incomplete scan
Skill
hardening-docker-daemon-configuration
mukul975/Anthropic-Cybersecurity-Skills · skills/hardening-docker-daemon-configuration
Hardens the Docker daemon (dockerd) through /etc/docker/daemon.json with user namespace remapping, TLS client authentication, seccomp profiles, and CIS Docker Benchmark controls such as icc, no-new-privileges, and live-restore. Use when securing a Docker host's daemon to prevent privilege escalation, breakout, or lateral movement, or when auditing daemon settings against CIS requirements. Keywords: dockerd, daemon.json, userns-remap, no-new-privileges, icc, live-restore, TLS socket. Do not use for hardening images and per-container runtime flags - use hardening-docker-containers-for-production.
Repository stars: 35,758 · Incomplete scan
Skill
performing-dark-web-monitoring-for-threats
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-dark-web-monitoring-for-threats
Dark web monitoring involves systematically scanning Tor hidden services, underground forums, paste sites, and dark web marketplaces to identify threats targeting an organization, including leaked cre
Repository stars: 35,758 · Incomplete scan
Skill
detecting-secure-boot-bypass
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-secure-boot-bypass
Detect UEFI Secure Boot bypasses and bootkits such as BlackLotus and Bootkitty by verifying Secure Boot state, checking dbx revocation currency, and hashing EFI boot binaries against known-bad sets using mokutil, efi-readvar/dbxtool, CHIPSEC, sbverify/pesign, and Windows Confirm-SecureBootUEFI. Use when auditing fleet dbx rollout after a bootkit advisory or hunting for pre-OS persistence on a suspected-compromised endpoint.
Repository stars: 35,758 · Incomplete scan
Skill
migrating-to-post-quantum-cryptography
mukul975/Anthropic-Cybersecurity-Skills · skills/migrating-to-post-quantum-cryptography
Build a cryptographic inventory/CBOM with OpenSSL 3.5+, deploy hybrid post-quantum key exchange (X25519MLKEM768) on TLS/VPN/SSH endpoints, generate ML-KEM/ML-DSA keys and PQC/hybrid certificates, and prioritize migration by harvest-now-decrypt-later (HNDL) exposure per NIST SP 1800-38. Use when inventorying enterprise cryptography for quantum-readiness, enabling hybrid PQC key exchange, or issuing and verifying PQC/hybrid certificates.
Repository stars: 35,758 · Incomplete scan
Skill
building-soc-escalation-matrix
mukul975/Anthropic-Cybersecurity-Skills · skills/building-soc-escalation-matrix
Build a structured SOC escalation matrix defining severity tiers, response SLAs, tiered escalation paths, and notification procedures for security incidents, using context-driven criteria that combine business risk, asset criticality, and data sensitivity. Use when designing or revising how a SOC triages and escalates incidents across analyst tiers.
Repository stars: 35,758 · Incomplete scan
Automated signals, not a guarantee. How the checks work.
