Explore the full catalog
Explore skills, repositories and creators
Search the catalog or browse with filters. Checks are automated signals, not a safety guarantee.
Page 123 · 50 results shown
Skill
implementing-vulnerability-remediation-sla
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-vulnerability-remediation-sla
Design a vulnerability remediation SLA program covering asset tiering, a severity-based SLA matrix, exception processes, escalation chains, ticketing-system integration, and remediation KPIs/trending metrics. Use when defining mandatory patching timeframes by severity and asset criticality, building an SLA policy document, or setting up escalation and KPI tracking for vulnerability remediation.
Repository stars: 35,758 · Incomplete scan
Skill
detecting-lateral-movement-with-zeek
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-lateral-movement-with-zeek
Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to identify SMB file transfers, NTLM account spray activity, remote service execution, and anomalous internal connections.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-pci-dss-compliance-controls
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-pci-dss-compliance-controls
Implements PCI DSS 4.0.1's 12 requirements across 6 control objectives for organizations that store, process, or transmit cardholder data, including the customized validation approach, enhanced authentication, and continuous monitoring controls introduced by the 51 requirements mandatory since March 2025. Use when scoping a cardholder data environment, building PCI DSS 4.0.1 compliance controls, or preparing for a PCI assessment.
Repository stars: 35,758 · Incomplete scan
Skill
performing-bluetooth-security-assessment
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-bluetooth-security-assessment
Assess Bluetooth Low Energy (BLE) device security using Python's bleak asyncio library to discover nearby devices, enumerate GATT services and characteristics, and flag unencrypted or unauthenticated read/write access to sensitive data. Use when auditing IoT, healthcare, fitness, or smart-home BLE devices for weak pairing configurations or known vulnerable device fingerprints.
Repository stars: 35,758 · Incomplete scan
Skill
detecting-privilege-escalation-attempts
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-privilege-escalation-attempts
Detect privilege escalation attempts across Windows and Linux, including access token manipulation, UAC bypass, unquoted service path abuse, kernel exploits, and sudo/doas abuse. Use when threat hunting for T1068-style privilege escalation, triaging EDR/SIEM alerts on suspicious privilege changes, scoping compromise during incident response, or validating detection coverage in a purple team exercise.
Repository stars: 35,758 · Incomplete scan
Skill
configuring-windows-defender-advanced-settings
mukul975/Anthropic-Cybersecurity-Skills · skills/configuring-windows-defender-advanced-settings
Configures Microsoft Defender for Endpoint (MDE) advanced protection settings including attack surface reduction rules, controlled folder access, network protection, and exploit protection. Use when hardening Windows endpoints beyond default Defender settings, deploying enterprise-grade endpoint protection, or meeting compliance requirements for advanced malware defense. Activates for requests involving Windows Defender configuration, ASR rules, MDE tuning, or Microsoft endpoint security.
Repository stars: 35,758 · Incomplete scan
Skill
detecting-s3-data-exfiltration-attempts
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-s3-data-exfiltration-attempts
Detecting data exfiltration attempts from AWS S3 buckets by analyzing CloudTrail S3 data events, VPC Flow Logs, GuardDuty findings, Amazon Macie alerts, and S3 access patterns to identify unauthorized bulk downloads and cross-account data transfers.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-zero-knowledge-proof-for-authentication
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-zero-knowledge-proof-for-authentication
Implements the Schnorr identification protocol and a simplified Zero-Knowledge Password Proof (ZKPP) over the discrete logarithm problem, letting a prover authenticate by demonstrating knowledge of a secret without ever revealing it to the server. Use when designing or building password-less or password-secret-free authentication, or when a server must verify a user's credential without learning or storing the underlying secret.
Repository stars: 35,758 · Incomplete scan
Skill
abusing-shadow-credentials-for-privesc
mukul975/Anthropic-Cybersecurity-Skills · skills/abusing-shadow-credentials-for-privesc
Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.
Repository stars: 35,758 · Incomplete scan
Skill
detecting-suspicious-oauth-application-consent
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-suspicious-oauth-application-consent
Detect risky OAuth application consent grants in Azure AD / Microsoft Entra ID using Microsoft Graph API, audit logs, and permission analysis to identify illicit consent grant attacks.
Repository stars: 35,758 · Incomplete scan
Skill
performing-web-application-firewall-bypass
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-web-application-firewall-bypass
Bypasses Web Application Firewall protections using encoding tricks, HTTP method manipulation, parameter pollution, and payload obfuscation to smuggle SQL injection, XSS, and other exploit payloads past WAF detection rules. Use when a confirmed vulnerability is blocked by a WAF, during penetration tests or red team engagements requiring bypass of perimeter security controls, or when evaluating WAF rule effectiveness and bypass resistance.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-network-segmentation-for-ot
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-network-segmentation-for-ot
Implements OT network segmentation using VLANs, OT-aware firewalls, data diodes, and IEC 62443 zone/conduit architecture, with a traffic-baseline-driven design tool for migrating flat Purdue-model networks without disrupting operations. Use when segmenting a flat OT network into Purdue levels, deploying an IT/OT DMZ, or isolating safety instrumented systems from basic process control systems.
Repository stars: 35,758 · Incomplete scan
Skill
hunting-for-suspicious-scheduled-tasks
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-for-suspicious-scheduled-tasks
Hunts for adversary persistence and execution via Windows scheduled tasks (T1053.005) by analyzing Security Event ID 4698 task-creation events, suspicious task properties, and unusual execution patterns from schtasks.exe/at.exe. Use after detecting schtasks or at.exe in process creation logs, during incident response to enumerate persistence on compromised hosts, or when Event ID 4698 fires for an unusual task.
Repository stars: 35,758 · Incomplete scan
Skill
auditing-aws-s3-bucket-permissions
mukul975/Anthropic-Cybersecurity-Skills · skills/auditing-aws-s3-bucket-permissions
Systematically audit AWS S3 bucket permissions to identify publicly accessible buckets, overly permissive ACLs, misconfigured bucket policies, and missing encryption settings using AWS CLI, S3audit, and Prowler to enforce least-privilege data access controls.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-next-generation-firewall-with-palo-alto
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-next-generation-firewall-with-palo-alto
Configures and deploys Palo Alto Networks next-generation firewalls end-to-end, covering App-ID application-aware policies, User-ID identity-based enforcement, zone-based security rules, SSL decryption for encrypted traffic visibility, and Content-ID threat prevention profiles. Use when moving an enterprise from port-based firewall rules to application- and identity-aware NGFW policy on Palo Alto hardware.
Repository stars: 35,758 · Incomplete scan
Skill
analyzing-dns-logs-for-exfiltration
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-dns-logs-for-exfiltration
Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 channels using entropy analysis, query volume anomalies, and subdomain length detection in SIEM platforms. Use when SOC teams need to identify DNS-based threats that bypass traditional network security controls.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-log-integrity-with-blockchain
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-log-integrity-with-blockchain
Builds an append-only log integrity chain using SHA-256 hash chaining, where each entry incorporates the previous entry's hash so tampering invalidates all subsequent hashes; covers log ingestion (syslog/JSON/plain text), chain verification, pinpoint tamper detection, and checkpoint anchoring to external timestamping services. Use for tamper-evident log storage for compliance or forensics, or to verify whether log entries were altered.
Repository stars: 35,758 · Incomplete scan
Skill
detecting-attacks-on-historian-servers
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-attacks-on-historian-servers
Detect cyber attacks on OT historian servers (OSIsoft PI, Ignition, GE Proficy, Wonderware InSQL) using a Python detector that flags unauthorized queries, data manipulation, and lateral-movement indicators as historians pivot between IT and OT networks. Use when monitoring historians bridging IT/OT zones for compromise, investigating historian-specific CVE exploitation, or validating historian data integrity after a suspected OT incident.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-nerc-cip-compliance-controls
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-nerc-cip-compliance-controls
Implements NERC CIP controls for Bulk Electric System (BES) cyber systems: asset categorization (CIP-002), electronic security perimeters (CIP-005), system security management (CIP-007), configuration management (CIP-010), and supply chain risk (CIP-013), including 2025 MFA updates. Use when a registered entity must achieve or maintain NERC CIP compliance, prepare for a Regional Entity audit, or categorize newly commissioned BES cyber systems.
Repository stars: 35,758 · Incomplete scan
Skill
exploiting-idor-vulnerabilities
mukul975/Anthropic-Cybersecurity-Skills · skills/exploiting-idor-vulnerabilities
Identifies and exploits Insecure Direct Object Reference (IDOR) vulnerabilities by manipulating object identifiers (numeric IDs, UUIDs, slugs) in API requests and URLs, using Burp Suite proxy history, Intruder, and the Authorize extension to test object-level authorization across sessions. Use during authorized penetration tests or bug bounty work to validate that CRUD endpoints and multi-tenant applications enforce per-object access control.
Repository stars: 35,758 · Incomplete scan
Skill
performing-kubernetes-etcd-security-assessment
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-kubernetes-etcd-security-assessment
Assesses the security posture of the etcd cluster backing Kubernetes: encryption at rest, TLS peer and client transport, access control, backup encryption, and network isolation. Use when auditing or hardening a control plane, reviewing whether Secrets are encrypted at rest, or protecting etcd backups, since etcd stores Secrets, RBAC policy, and ConfigMaps in plaintext by default. Keywords: etcd, EncryptionConfiguration, encryption at rest, peer TLS, snapshot, backup, control plane. Do not use for broad cluster-wide CIS checks - use performing-kubernetes-cis-benchmark-with-kube-bench.
Repository stars: 35,758 · Incomplete scan
Skill
analyzing-cloud-storage-access-patterns
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-cloud-storage-access-patterns
Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and time-series anomaly detection. Use when investigating suspected cloud data exfiltration or building related detection rules.
Repository stars: 35,758 · Incomplete scan
Skill
building-ioc-defanging-and-sharing-pipeline
mukul975/Anthropic-Cybersecurity-Skills · skills/building-ioc-defanging-and-sharing-pipeline
Build an automated pipeline that ingests raw IOCs (URLs, IPs, domains, emails), normalizes and deduplicates them, then produces defanged renderings for safe human reading alongside canonical STIX 2.1 bundles distributed via TAXII servers, MISP, or email reports. Use when preparing indicators of compromise for safe analyst sharing or automating threat intel distribution to TAXII/MISP feeds.
Repository stars: 35,758 · Incomplete scan
Skill
benchmarking-kubernetes-with-kube-bench
mukul975/Anthropic-Cybersecurity-Skills · skills/benchmarking-kubernetes-with-kube-bench
Installs and runs the kube-bench tool against a Kubernetes cluster as a Job, DaemonSet, or standalone binary, selecting the correct benchmark version and targets (control plane, etcd, kubelet, worker nodes) and emitting JSON or JUnit output for pipelines. Use when setting kube-bench up for the first time, choosing which benchmark version and node targets to run, wiring it into CI, or troubleshooting skipped or misdetected checks. Keywords: kube-bench, DaemonSet, --benchmark, --targets, JSON output, JUnit, CI integration. Do not use for interpreting the findings or producing an audit report - use performing-kubernetes-cis-benchmark-with-kube-bench.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-zero-trust-network-access
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-zero-trust-network-access
Configures Zero Trust Network Access (ZTNA) in AWS, Azure, and GCP using identity-aware proxies, micro-segmentation, and continuous verification with conditional access policies, replacing VPN-based access with BeyondCorp-style architectures. Use when replacing VPN remote access with identity-based controls, limiting lateral movement via micro-segmentation, or exposing cloud workloads to authenticated users without public internet exposure.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-google-workspace-sso-configuration
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-google-workspace-sso-configuration
Configures SAML 2.0 single sign-on for Google Workspace against a third-party identity provider (Okta, Azure AD/Entra ID, ADFS), with Workspace as the Service Provider, to centralize authentication and enable immediate access revocation. Use when setting up or troubleshooting Google Workspace SSO/SAML federation or migrating from native Google passwords to an external IdP.
Repository stars: 35,758 · Incomplete scan
Skill
detecting-t1548-abuse-elevation-control-mechanism
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-t1548-abuse-elevation-control-mechanism
Detect abuse of elevation control mechanisms (T1548), including Windows UAC bypass via auto-elevating binaries like fodhelper.exe and Linux sudo/setuid/setgid exploitation, by monitoring registry changes, integrity-level transitions, and parent-child process relationships via Sysmon and Windows Security events. Use when hunting privilege-escalation activity or validating elevation-abuse detection coverage.
Repository stars: 35,758 · Incomplete scan
Skill
profiling-threat-actor-groups
mukul975/Anthropic-Cybersecurity-Skills · skills/profiling-threat-actor-groups
Develops comprehensive threat actor profiles for APT groups, criminal organizations, and hacktivist collectives by aggregating TTP documentation, historical campaign data, tooling fingerprints, and attribution indicators from multiple intelligence sources. Use when briefing executives on sector-specific threats, updating threat model assumptions, or prioritizing defensive controls against specific adversaries. Activates for requests involving MITRE ATT&CK Groups, Mandiant APT profiles, CrowdStrike adversary naming, or sector-specific threat briefings.
Repository stars: 35,758 · Incomplete scan
Skill
auditing-terraform-infrastructure-for-security
mukul975/Anthropic-Cybersecurity-Skills · skills/auditing-terraform-infrastructure-for-security
Auditing Terraform infrastructure-as-code for security misconfigurations using Checkov, tfsec, Terrascan, and OPA/Rego policies to detect overly permissive IAM policies, public resource exposure, missing encryption, and insecure defaults before cloud deployment.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-code-signing-for-artifacts
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-code-signing-for-artifacts
Implements code signing for build artifacts (binaries, packages, containers) using GPG, Sigstore, and platform-specific signing tools, establishing trust chains and verifying signatures in deployment pipelines. Use when establishing artifact integrity checks against supply-chain tampering, proving authenticity to customers, building zero-trust pipelines that reject unsigned artifacts, or meeting SLSA Level 2+ provenance requirements.
Repository stars: 35,758 · Incomplete scan
Skill
scanning-containers-with-trivy-in-cicd
mukul975/Anthropic-Cybersecurity-Skills · skills/scanning-containers-with-trivy-in-cicd
Integrates Aqua Security's Trivy scanner into CI/CD pipelines to detect OS package and application dependency CVEs, Dockerfile misconfigurations, and issues in filesystems or git repositories, and to enforce severity-based quality gates that block vulnerable images from being deployed. Use when building Docker images in CI/CD and needing automated vulnerability scanning and pass/fail gates before registry push or production deployment.
Repository stars: 35,758 · Incomplete scan
Skill
securing-api-gateway-with-aws-waf
mukul975/Anthropic-Cybersecurity-Skills · skills/securing-api-gateway-with-aws-waf
Secures AWS API Gateway endpoints with AWS WAF by configuring managed rule groups for OWASP Top 10 protection, custom rate-limiting rules, bot control, IP reputation filtering, and WAF metric monitoring. Use when deploying API Gateway endpoints that need protection against common web attacks, or when implementing rate limiting and throttling to prevent API abuse and DDoS.
Repository stars: 35,758 · Incomplete scan
Skill
triaging-windows-with-kape
mukul975/Anthropic-Cybersecurity-Skills · skills/triaging-windows-with-kape
Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment/triage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.
Repository stars: 35,758 · Incomplete scan
Skill
exploiting-ms17-010-eternalblue-vulnerability
mukul975/Anthropic-Cybersecurity-Skills · skills/exploiting-ms17-010-eternalblue-vulnerability
Detects and exploits MS17-010 (EternalBlue), a critical remote code execution flaw in Microsoft's SMBv1 implementation, using Nmap's ms-17-010 NSE script for detection and Metasploit's ms17_010_eternalblue/ms17_010_psexec modules for exploitation. Use during authorized red-team engagements or penetration tests against legacy Windows environments with unpatched SMBv1 to gain remote code execution.
Repository stars: 35,758 · Incomplete scan
Skill
correlating-security-events-in-qradar
mukul975/Anthropic-Cybersecurity-Skills · skills/correlating-security-events-in-qradar
Correlates security events in IBM QRadar SIEM using AQL (Ariel Query Language), custom rules, building blocks, and offense management to detect multi-stage attacks across network, endpoint, and application log sources. Use when SOC analysts need to investigate QRadar offenses, build correlation rules, or tune detection logic for reducing false positives.
Repository stars: 35,758 · Incomplete scan
Skill
performing-scada-hmi-security-assessment
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-scada-hmi-security-assessment
Perform security assessments of SCADA Human-Machine Interface (HMI) systems to identify vulnerabilities in web-based HMIs, thin-client configurations, authentication mechanisms, and communication channels between HMI and PLCs, aligned with IEC 62443 and NIST SP 800-82 guidelines.
Repository stars: 35,758 · Incomplete scan
Skill
performing-csrf-attack-simulation
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-csrf-attack-simulation
Testing web applications for Cross-Site Request Forgery vulnerabilities by crafting forged requests that exploit authenticated user sessions during authorized security assessments.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-zero-trust-in-cloud
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-zero-trust-in-cloud
Guides zero trust implementation across AWS, Azure, and GCP per NIST SP 800-207 and BeyondCorp principles, covering identity-centric access, micro-segmentation, continuous verification, device trust assessment, and Identity-Aware Proxy deployment. Use when migrating from perimeter security to identity-centric access, removing VPN dependency, or designing micro-segmentation for multi-cloud workloads.
Repository stars: 35,758 · Incomplete scan
Skill
analyzing-network-flow-data-with-netflow
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-network-flow-data-with-netflow
Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port scanning, data exfiltration, and C2 beaconing patterns. Uses the Python netflow library to decode flow records, builds traffic baselines, and applies statistical analysis to identify flows with abnormal byte counts, connection durations, and periodic timing patterns.
Repository stars: 35,758 · Incomplete scan
Skill
building-red-team-c2-infrastructure-with-havoc
mukul975/Anthropic-Cybersecurity-Skills · skills/building-red-team-c2-infrastructure-with-havoc
Deploy and configure the Havoc C2 framework (teamserver, HTTPS/HTTP/SMB listeners, Nginx redirectors, and Demon agents) with malleable traffic profiles and OPSEC-hardened infrastructure for authorized red team operations. Use when standing up or hardening Havoc C2 infrastructure for a written, authorized adversary emulation engagement.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-security-monitoring-with-datadog
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-security-monitoring-with-datadog
Implements security monitoring using Datadog Cloud SIEM, Cloud Security Management (CSM), and Workload Protection to detect threats, enforce compliance, and respond to security events across cloud and hybrid infrastructure. Covers Agent deployment, log source ingestion, detection rule creation, security dashboards, and automated notification workflows. Activates for requests involving Datadog security setup, Cloud SIEM configuration, CSM threat detection, or security monitoring dashboards.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-zero-trust-for-saas-applications
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-zero-trust-for-saas-applications
Secures SaaS apps (Microsoft 365, Google Workspace, Salesforce, Slack) via CASB/SSPM deployment, conditional access policies, OAuth app governance, and session-level DLP controls enforcing identity verification and device compliance. Use when adding MFA/device-compliance conditional access, discovering shadow IT, governing OAuth consent grants, or applying session controls to sensitive SaaS data.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-llm-guardrails-for-security
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-llm-guardrails-for-security
Implements input/output validation guardrails for LLM applications using NVIDIA NeMo Guardrails (Colang), custom Python validators for PII detection, and the Guardrails AI framework, intercepting user inputs (prompt injection, PII, off-topic queries) and model outputs (hallucinations, toxic content, schema compliance). Use when adding safety controls to an LLM app/chatbot/RAG pipeline or validating outputs conform to expected schemas.
Repository stars: 35,758 · Incomplete scan
Skill
exploiting-vulnerabilities-with-metasploit-framework
mukul975/Anthropic-Cybersecurity-Skills · skills/exploiting-vulnerabilities-with-metasploit-framework
Uses the Metasploit Framework (msfconsole and its exploit, auxiliary, and post-exploitation modules) to validate that identified CVEs and vulnerabilities are actually exploitable, gather post-exploitation evidence, and confirm patch remediation. Use when performing vulnerability management validation, penetration testing, or post-patch verification and you need to prove real-world exploitability rather than rely on a scanner score alone.
Repository stars: 35,758 · Incomplete scan
Skill
performing-android-app-static-analysis-with-mobsf
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-android-app-static-analysis-with-mobsf
Performs automated static analysis of Android applications using Mobile Security Framework (MobSF) to identify hardcoded secrets, insecure permissions, vulnerable components, weak cryptography, and code-level security flaws without executing the application. Use when assessing Android APK/AAB files for security vulnerabilities before deployment, during penetration testing, or as part of CI/CD security gates. Activates for requests involving Android static analysis, MobSF scanning, APK security assessment, or mobile application code review.
Repository stars: 35,758 · Incomplete scan
Skill
hunting-for-process-injection-techniques
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-for-process-injection-techniques
Detects process injection techniques (MITRE T1055) — including CreateRemoteThread injection, process hollowing, and DLL injection — by analyzing Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess) alongside EDR process telemetry. Use when hunting for in-memory code injection or defense evasion via legitimate process abuse on Windows endpoints.
Repository stars: 35,758 · Incomplete scan
Skill
exploiting-constrained-delegation-abuse
mukul975/Anthropic-Cybersecurity-Skills · skills/exploiting-constrained-delegation-abuse
Exploits Kerberos Constrained Delegation misconfigurations in Active Directory using Impacket's findDelegation.py and getST.py (or Rubeus/Kekeo on Windows) to abuse S4U2Self and S4U2Proxy and impersonate privileged users. Use during authorized Active Directory penetration tests or red-team engagements for lateral movement and privilege escalation after finding an account trusted for constrained delegation.
Repository stars: 35,758 · Incomplete scan
Skill
collecting-threat-intelligence-with-misp
mukul975/Anthropic-Cybersecurity-Skills · skills/collecting-threat-intelligence-with-misp
Deploy MISP, configure threat feeds (MISP community, freetext, TAXII, CSV), and use the PyMISP API to programmatically fetch, add, and search events and IOCs, building automated collection pipelines that aggregate indicators from community and commercial sources. Use when gathering, storing, or correlating IOCs and threat intelligence, or when scripting MISP ingestion via PyMISP.
Repository stars: 35,758 · Incomplete scan
Skill
conducting-cyber-risk-assessment-with-nist-800-30
mukul975/Anthropic-Cybersecurity-Skills · skills/conducting-cyber-risk-assessment-with-nist-800-30
Conduct a defensible cybersecurity risk assessment using the NIST SP 800-30 Rev 1 methodology: prepare scope and a risk model, identify threat sources and threat events, identify vulnerabilities and predisposing conditions, determine likelihood and impact, compute risk, and communicate results as a prioritized risk register. Use when an organization needs an actual risk *assessment* (not a maturity score), when a control framework (CSF, ISO 27001, RMF, SOC 2, PCI) requires a documented risk analysis as input, when leadership asks "what are our top risks and how bad are they", when assessing risk for a new system or major change, or when building a risk register from scratch. This is the methodology that feeds framework selection, ATO packages, and treatment decisions. Keywords: risk assessment, NIST 800-30, threat modeling, likelihood and impact, risk register, risk analysis, threat sources, vulnerabilities, risk determination, qualitative risk, risk matrix, residual risk, risk treatment.
Repository stars: 35,758 · Incomplete scan
Skill
implementing-scim-provisioning-with-okta
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-scim-provisioning-with-okta
Implement automated user lifecycle provisioning and deprovisioning using the SCIM 2.0 protocol with Okta as the identity provider. Use when automating account creation, attribute sync, or deactivation across downstream applications through Okta SCIM integration, or when troubleshooting SCIM provisioning failures.
Repository stars: 35,758 · Incomplete scan
Automated signals, not a guarantee. How the checks work.
