Explore the full catalog
Explore skills, repositories and creators
Search the catalog or browse with filters. Checks are automated signals, not a safety guarantee.
Page 125 · 50 results shown
Skill
performing-s7comm-protocol-security-analysis
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-s7comm-protocol-security-analysis
Perform security analysis of Siemens S7comm and S7CommPlus protocols used by SIMATIC S7 PLCs to identify vulnerabilities including replay attacks, integrity bypass, unauthorized CPU stop commands, and program download manipulation exploiting weaknesses in S7-300, S7-400, S7-1200, and S7-1500 controllers.
Repository stars: 35,763 · Incomplete scan
Skill
detecting-golden-ticket-forgery
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-golden-ticket-forgery
Detect Kerberos Golden Ticket forgery (e.g. Mimikatz-forged tickets) by analyzing Windows Event ID 4769 for RC4 encryption downgrades (0x17), abnormal ticket lifetimes, and krbtgt account anomalies using Splunk and Elastic SIEM queries. Use when investigating suspected forged Kerberos tickets or krbtgt credential theft in Active Directory.
Repository stars: 35,763 · Incomplete scan
Skill
triaging-security-alerts-in-splunk
mukul975/Anthropic-Cybersecurity-Skills · skills/triaging-security-alerts-in-splunk
Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisions using SPL queries and the Incident Review dashboard. Use when SOC analysts face queued alerts from correlation searches, need to prioritize investigation order, or must document triage decisions for handoff to Tier 2/3 analysts.
Repository stars: 35,763 · Incomplete scan
Skill
detecting-ransomware-precursors-in-network
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-ransomware-precursors-in-network
Detects early-stage ransomware indicators in network traffic before encryption begins, including initial access broker activity, command-and-control beaconing, credential harvesting, reconnaissance scanning, and staging behavior. Uses network detection tools (Zeek, Suricata, Arkime), SIEM correlation rules, and threat intelligence feeds to identify ransomware precursor patterns such as Cobalt Strike beacons, Mimikatz network signatures, and RDP brute-force attempts. Activates for requests involving pre-ransomware detection, network-based ransomware indicators, or early warning ransomware monitoring.
Repository stars: 35,763 · Incomplete scan
Skill
testing-for-xml-injection-vulnerabilities
mukul975/Anthropic-Cybersecurity-Skills · skills/testing-for-xml-injection-vulnerabilities
Test web applications for XML injection vulnerabilities including XXE, XPath injection, and XML entity attacks to identify data exposure and server-side request forgery risks.
Repository stars: 35,763 · Incomplete scan
Skill
analyzing-persistence-mechanisms-in-linux
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-persistence-mechanisms-in-linux
Scan Linux systems for persistence mechanisms including crontab/systemd entries, LD_PRELOAD injection, shell profile modifications (.bashrc, .profile), and SSH authorized_keys backdoors, then correlate findings with auditd logs into an installation timeline. Use during incident response or threat hunting to detect or confirm how an adversary maintained access to a compromised Linux host.
Repository stars: 35,763 · Incomplete scan
Skill
implementing-alert-fatigue-reduction
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-alert-fatigue-reduction
Implements strategies to reduce SOC alert fatigue by tuning detection rules, consolidating duplicate alerts, implementing risk-based alerting, and measuring alert quality metrics to maintain analyst effectiveness and prevent critical alert dismissal. Use when SOC teams face overwhelming alert volumes, high false positive rates, or declining analyst performance.
Repository stars: 35,763 · Incomplete scan
Skill
analyzing-threat-actor-ttps-with-mitre-navigator
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-threat-actor-ttps-with-mitre-navigator
Map advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework using the attackcti Python library to query STIX/TAXII data for group-technique associations, then generate ATT&CK Navigator layer files to visualize and compare defensive coverage against adversary profiles. Use when profiling an APT group's techniques, building Navigator coverage heatmaps, or assessing technique coverage gaps against a specific threat actor.
Repository stars: 35,763 · Incomplete scan
Skill
performing-kubernetes-cis-benchmark-with-kube-bench
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-kubernetes-cis-benchmark-with-kube-bench
Turns kube-bench output into a finished CIS Kubernetes Benchmark audit: interpreting PASS/FAIL/WARN per control, judging which failures are genuine on a managed cluster, writing remediation, and packaging evidence for SOC 2 or PCI DSS. Use when conducting a scheduled compliance audit, triaging kube-bench results, deciding which controls are not applicable on EKS, GKE, or AKS, or producing hardening evidence for an auditor. Keywords: CIS Kubernetes Benchmark, control plane, remediation, compliance evidence, SOC 2, PCI DSS, managed cluster exception. Do not use for installing and running the tool - use benchmarking-kubernetes-with-kube-bench.
Repository stars: 35,763 · Incomplete scan
Skill
performing-web-application-scanning-with-nikto
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-web-application-scanning-with-nikto
Runs Nikto, an open-source web server and web application scanner, to test over 7,000 potentially dangerous files/programs, check for outdated versions across 1,250+ servers, and identify XSS, SQL injection, misconfigurations, default credentials, and vulnerable CGI scripts. Use when performing web application vulnerability scanning, security assessments, scheduled security testing, or validating web server security controls.
Repository stars: 35,763 · Incomplete scan
Skill
triaging-security-incident
mukul975/Anthropic-Cybersecurity-Skills · skills/triaging-security-incident
Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM/EDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.
Repository stars: 35,763 · Incomplete scan
Skill
exploiting-nopac-cve-2021-42278-42287
mukul975/Anthropic-Cybersecurity-Skills · skills/exploiting-nopac-cve-2021-42278-42287
Exploits the noPac Active Directory privilege-escalation chain (CVE-2021-42278 sAMAccountName spoofing plus CVE-2021-42287 KDC PAC confusion) using Impacket and secretsdump.py to escalate from a standard domain user to Domain Admin. Use when red-teaming or pentesting Active Directory to validate machine-account impersonation and DCSync-based credential dumping.
Repository stars: 35,763 · Incomplete scan
Skill
analyzing-usb-device-connection-history
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-usb-device-connection-history
Correlate Windows registry keys (USBSTOR, MountedDevices), Event Logs, and setupapi.dev.log to reconstruct USB device connection history, first/last-plugged timestamps, and drive letter mappings. Use when investigating removable media usage, tracking device provenance, or building a timeline for suspected data exfiltration.
Repository stars: 35,763 · Incomplete scan
Skill
performing-privacy-impact-assessment
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-privacy-impact-assessment
Automates the Privacy Impact Assessment (PIA) workflow including data flow mapping, privacy risk scoring matrices, GDPR Article 35 DPIA and CCPA/CPRA alignment checks, data inventory cataloging, and remediation tracking. Implements the NIST Privacy Framework PRAM methodology and ICO DPIA guidance for systematic identification and mitigation of privacy risks across processing activities. Use when conducting privacy assessments for new systems, evaluating regulatory compliance posture, or building automated privacy governance programs.
Repository stars: 35,763 · Incomplete scan
Skill
implementing-gcp-vpc-firewall-rules
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-gcp-vpc-firewall-rules
Implements and audits GCP VPC firewall rules using gcloud, covering auditing overly permissive rules, creating restrictive ingress/egress rules, hierarchical firewall policies, and monitoring rule effectiveness with VPC Flow Logs. Use when deploying GCP workloads needing network access controls, auditing firewall configs, or responding to Security Command Center findings; not for Cloud Armor or DNS-based filtering.
Repository stars: 35,763 · Incomplete scan
Skill
detecting-cloud-threats-with-guardduty
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-cloud-threats-with-guardduty
Deploy and operationalize Amazon GuardDuty, covering protection plans for S3, EKS, EC2 runtime monitoring, and Lambda, interpreting finding severity, and building automated response with EventBridge and Lambda. Use when establishing threat detection for AWS accounts, investigating findings on compromised instances or credential abuse, or building automated incident-response playbooks.
Repository stars: 35,763 · Incomplete scan
Skill
detecting-fileless-malware-techniques
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-fileless-malware-techniques
Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and living-off-the-land binaries (LOLBins) without writing traditional executable files to disk. Use for requests involving fileless threat detection, in-memory malware investigation, LOLBin abuse analysis, or WMI persistence examination.
Repository stars: 35,763 · Incomplete scan
Skill
analyzing-prefetch-files-for-execution-history
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-prefetch-files-for-execution-history
Parse Windows Prefetch files (versions 17, 23, 26, 30) with tools like PECmd, WinPrefetchView, or python-prefetch to determine program execution history, including run counts, execution timestamps, and referenced files/DLLs. Use when building a timeline of program execution on a Windows system, confirming whether a suspicious binary ran, or correlating execution evidence with other forensic artifacts during an investigation.
Repository stars: 35,763 · Incomplete scan
Skill
performing-malware-triage-with-yara
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-malware-triage-with-yara
Performs rapid malware triage and classification using YARA rules that match file patterns, strings, byte sequences, and structural characteristics against known malware families and suspicious indicators, covering rule writing, scanning, and integration into analysis pipelines. Use when classifying a batch of malware samples against known family signatures, writing detection rules for a newly analyzed malware family, or performing signature-based malware triage.
Repository stars: 35,763 · Incomplete scan
Skill
testing-jwt-token-security
mukul975/Anthropic-Cybersecurity-Skills · skills/testing-jwt-token-security
Assessing JSON Web Token implementations for cryptographic weaknesses, algorithm confusion attacks, and authorization bypass vulnerabilities during security engagements.
Repository stars: 35,763 · Incomplete scan
Skill
implementing-envelope-encryption-with-aws-kms
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-envelope-encryption-with-aws-kms
Implements envelope encryption with AWS KMS, encrypting data locally with a data encryption key (DEK) and protecting that DEK with a KMS-managed key (KEK), covering the encrypt/decrypt flow, KMS key types, and security validation criteria. Use when designing key management for encrypting large or numerous data objects on AWS, or when reducing direct KMS API call volume.
Repository stars: 35,763 · Incomplete scan
Skill
implementing-ics-firewall-with-tofino
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-ics-firewall-with-tofino
Deploys and configures Tofino industrial firewalls (Belden/Hirschmann) to protect SCADA systems and PLCs, using deep packet inspection of OT protocols (Modbus, EtherNet/IP, OPC, S7comm) to enforce access control between ICS zones. Use when deploying zone-level firewall protection in front of PLCs/RTUs, enforcing IEC 62443 zone/conduit boundaries, or adding compensating controls for unpatchable legacy PLCs.
Repository stars: 35,763 · Incomplete scan
Skill
detecting-spearphishing-with-email-gateway
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-spearphishing-with-email-gateway
Detect and block spearphishing emails that use personalized, researched content to evade generic spam filters, by configuring email security gateway (SEG) impersonation protection, URL rewriting, attachment sandboxing, and custom detection rules in Microsoft Defender for Office 365, Proofpoint, Mimecast, or Barracuda. Use when hardening a mail gateway against targeted phishing or investigating a suspected spearphishing campaign.
Repository stars: 35,763 · Incomplete scan
Skill
integrating-sast-into-github-actions-pipeline
mukul975/Anthropic-Cybersecurity-Skills · skills/integrating-sast-into-github-actions-pipeline
Integrates CodeQL and Semgrep SAST scanning into GitHub Actions, covering scans on pull requests/pushes, rule tuning to cut false positives, SARIF upload to GitHub Advanced Security, and merge-blocking quality gates for high-severity findings. Use when adding automated code vulnerability detection to CI, enforcing consistent SAST org-wide, or producing SOC 2/PCI DSS/NIST SSDF compliance evidence.
Repository stars: 35,763 · Incomplete scan
Skill
reverse-engineering-dotnet-malware-with-dnspy
mukul975/Anthropic-Cybersecurity-Skills · skills/reverse-engineering-dotnet-malware-with-dnspy
Reverse engineers .NET malware samples using the dnSpy decompiler and debugger to read C#/VB.NET source, deobfuscate code protected by tools like ConfuserEx or SmartAssembly, and extract hardcoded C2 configurations, keys, and credentials. Use when a sample is identified as a .NET assembly (e.g. AgentTesla, AsyncRAT, RedLine Stealer, Quasar RAT) and needs decompilation, deobfuscation, or config extraction.
Repository stars: 35,763 · Incomplete scan
Skill
detecting-data-and-model-poisoning
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-data-and-model-poisoning
Identify poisoned training data and backdoored ML models across the pipeline using IBM's Adversarial Robustness Toolbox (activation clustering, spectral signatures, trigger reconstruction), Cleanlab for label-quality issues, and supply-chain checks like weight-hash verification and safetensors enforcement. Use before training or deploying on third-party/user-contributed data or downloaded checkpoints, during ML supply-chain reviews, or when investigating model misbehavior tied to specific inputs (suspected backdoor trigger).
Repository stars: 35,763 · Incomplete scan
Skill
implementing-cloud-workload-protection
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-cloud-workload-protection
Implements cloud workload protection using boto3 and google-cloud APIs for runtime security monitoring, process anomaly detection, and file integrity checking on EC2/GCE instances. Scans for cryptomining, reverse shells, and unauthorized binaries. Use when building runtime security controls for cloud compute workloads.
Repository stars: 35,763 · Incomplete scan
Skill
validating-backup-integrity-for-recovery
mukul975/Anthropic-Cybersecurity-Skills · skills/validating-backup-integrity-for-recovery
Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable/air-gapped backups for silent corruption or tampering.
Repository stars: 35,763 · Incomplete scan
Skill
hunting-for-dcsync-attacks
mukul975/Anthropic-Cybersecurity-Skills · skills/hunting-for-dcsync-attacks
Detect DCSync attacks (MITRE ATT&CK T1003.006) by analyzing Windows Event ID 4662 (AccessMask 0x100) for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All requests issued by non-domain-controller accounts. Use when hunting for DCSync credential theft, after detecting Mimikatz-class tooling, or during incident response and purple-team exercises involving Active Directory replication abuse.
Repository stars: 35,763 · Incomplete scan
Skill
detecting-port-scanning-with-fail2ban
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-port-scanning-with-fail2ban
Configures Fail2ban with custom filters and actions to detect port scanning activity, SSH brute force attempts, and network reconnaissance, automatically banning offending IP addresses and alerting security teams to suspicious network probing.
Repository stars: 35,763 · Incomplete scan
Skill
detecting-stuxnet-style-attacks
mukul975/Anthropic-Cybersecurity-Skills · skills/detecting-stuxnet-style-attacks
Detects sophisticated cyber-physical attacks that follow the Stuxnet pattern of modifying PLC logic while spoofing sensor readings to hide the manipulation, using PLC logic integrity monitoring (Claroty xDome, Nozomi Guardian) and physics-based process anomaly detection. Use when hunting for IT-to-OT lateral movement or discrepancies between PLC program state and physical process behavior in ICS/SCADA environments.
Repository stars: 35,763 · Incomplete scan
Skill
performing-service-account-credential-rotation
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-service-account-credential-rotation
Automates credential rotation for service accounts across Active Directory, cloud platforms, and application databases to eliminate stale secrets and reduce compromise risk. Use when rotating or automating rotation of service account passwords, API keys, or secrets stored in a vault.
Repository stars: 35,763 · Incomplete scan
Skill
implementing-cloud-dlp-for-data-protection
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-cloud-dlp-for-data-protection
Implement cloud DLP using Amazon Macie, Google Cloud DLP API, Microsoft Purview, Azure Information Protection, and Nightfall AI to discover, classify, label, de-identify, and protect sensitive data (PII, PHI, financial data) across cloud storage, databases, and pipelines. Use for GDPR/HIPAA/PCI DSS data-discovery, cloud data governance, or CI/CD DLP scanning; not for endpoint, email, or network-level DLP.
Repository stars: 35,763 · Incomplete scan
Skill
analyzing-macro-malware-in-office-documents
mukul975/Anthropic-Cybersecurity-Skills · skills/analyzing-macro-malware-in-office-documents
Analyzes malicious VBA macros embedded in Microsoft Office documents (Word, Excel, PowerPoint) to identify download cradles, payload execution, persistence mechanisms, and anti-analysis techniques. Uses olevba, oledump, and VBA deobfuscation to extract the attack chain. Activates for requests involving Office macro analysis, VBA malware investigation, maldoc analysis, or document-based threat examination.
Repository stars: 35,763 · Incomplete scan
Skill
configuring-ldap-security-hardening
mukul975/Anthropic-Cybersecurity-Skills · skills/configuring-ldap-security-hardening
Hardens LDAP directory services against credential harvesting, LDAP injection, anonymous binding, and channel-binding bypass by enforcing LDAPS, channel binding, and LDAP signing. Use when securing an LDAP or Active Directory environment against these attack classes or auditing directory service configurations for these vulnerabilities.
Repository stars: 35,763 · Incomplete scan
Skill
implementing-soar-automation-with-phantom
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-soar-automation-with-phantom
Implements Security Orchestration, Automation, and Response (SOAR) workflows using Splunk SOAR (formerly Phantom) to automate alert triage, IOC enrichment, containment actions, and incident response playbooks. Use when SOC teams need to reduce manual analyst work, standardize response procedures, or integrate multiple security tools into automated workflows.
Repository stars: 35,763 · Incomplete scan
Skill
configuring-host-based-intrusion-detection
mukul975/Anthropic-Cybersecurity-Skills · skills/configuring-host-based-intrusion-detection
Configures host-based intrusion detection systems (HIDS) to monitor endpoint file integrity, system calls, and configuration changes for security violations. Use when deploying OSSEC, Wazuh, or AIDE for endpoint monitoring, building file integrity monitoring (FIM) policies, or meeting compliance requirements for change detection. Activates for requests involving HIDS configuration, file integrity monitoring, OSSEC/Wazuh deployment, or host-based detection.
Repository stars: 35,763 · Incomplete scan
Skill
building-threat-actor-profile-from-osint
mukul975/Anthropic-Cybersecurity-Skills · skills/building-threat-actor-profile-from-osint
Build threat actor profiles by collecting OSINT from vendor reports, paste sites, dark web forums, social media, and code repos, correlating indicators, mapping adversary infrastructure with tools like Maltego and SpiderFoot, and producing structured dossiers of motivations, capabilities, infrastructure, and TTPs. Use when performing attribution or building an adversary dossier from open-source intelligence.
Repository stars: 35,763 · Incomplete scan
Skill
performing-steganography-detection
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-steganography-detection
Detects and extracts hidden data embedded in images, audio, and other media files using steganalysis tools such as StegDetect, zsteg, stegsolve, binwalk, steghide, and OpenStego to uncover covert communication channels. Use when investigating suspected data hiding or exfiltration via media files, espionage/insider-threat cases, or anomalies in media file properties found during standard file analysis.
Repository stars: 35,763 · Incomplete scan
Skill
deploying-active-directory-honeytokens
mukul975/Anthropic-Cybersecurity-Skills · skills/deploying-active-directory-honeytokens
Deploys deception-based honeytokens in Active Directory including fake privileged accounts with AdminCount=1, fake SPNs for Kerberoasting detection (honeyroasting), decoy GPOs with cpassword traps, and fake BloodHound paths. Monitors Windows Security Event IDs 4769, 4625, 4662, 5136 for honeytoken interaction. Use when implementing AD deception defenses for detecting lateral movement, credential theft, and reconnaissance.
Repository stars: 35,763 · Incomplete scan
Skill
building-incident-response-dashboard
mukul975/Anthropic-Cybersecurity-Skills · skills/building-incident-response-dashboard
Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership with situational awareness during active incidents, tracking affected systems, containment status, IOC spread, and response timeline. Use when IR teams need unified visibility during incident coordination and post-incident reporting.
Repository stars: 35,763 · Incomplete scan
Skill
performing-privileged-account-discovery
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-privileged-account-discovery
Discovers and inventories privileged accounts across enterprise infrastructure, including domain admins, local admins, service accounts, database admins, cloud IAM roles, and application admin accounts, using automated scanning and risk classification. Use when building a privileged account inventory, onboarding accounts to a PAM solution, or scoping which accounts need privileged-access controls.
Repository stars: 35,763 · Incomplete scan
Skill
implementing-secrets-management-with-vault
mukul975/Anthropic-Cybersecurity-Skills · skills/implementing-secrets-management-with-vault
Deploy HashiCorp Vault for centralized secrets management, covering dynamic secret generation for databases and cloud providers, transit encryption, PKI certificate management, and Kubernetes integration. Use when eliminating hardcoded credentials from application code or CI/CD pipelines, migrating to short-lived auto-rotated secrets, or giving Kubernetes workloads secure access to database or cloud provider credentials.
Repository stars: 35,763 · Incomplete scan
Skill
performing-ssl-tls-inspection-configuration
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-ssl-tls-inspection-configuration
Configure SSL/TLS break-and-inspect on next-generation firewalls and forward proxies to decrypt, inspect, and re-encrypt HTTPS traffic for malware and exfiltration detection, including deploying trusted CA certificates, managing exemptions for certificate-pinned apps, and privacy compliance. Use when setting up or auditing TLS inspection on network security devices to close the encrypted-traffic blind spot.
Repository stars: 35,763 · Incomplete scan
Skill
prioritizing-vulnerabilities-with-cvss-scoring
mukul975/Anthropic-Cybersecurity-Skills · skills/prioritizing-vulnerabilities-with-cvss-scoring
The Common Vulnerability Scoring System (CVSS) is the industry standard framework maintained by FIRST (Forum of Incident Response and Security Teams) for assessing vulnerability severity. CVSS v4.0 (r
Repository stars: 35,763 · Incomplete scan
Skill
auditing-cloud-with-cis-benchmarks
mukul975/Anthropic-Cybersecurity-Skills · skills/auditing-cloud-with-cis-benchmarks
Audit AWS, Azure, and GCP environments against the CIS Foundations Benchmarks by running automated scans with tools like Prowler and ScoutSuite, interpreting failed controls, and tracking remediation for continuous compliance. Use when conducting a cloud security audit, validating CIS benchmark compliance (CIS v5 AWS, v4 Azure, v4 GCP), or setting up continuous cloud compliance monitoring.
Repository stars: 35,763 · Incomplete scan
Skill
performing-blind-ssrf-exploitation
mukul975/Anthropic-Cybersecurity-Skills · skills/performing-blind-ssrf-exploitation
Detect and exploit blind Server-Side Request Forgery (SSRF) using out-of-band techniques such as Burp Collaborator DNS interactions and timing analysis, to reach internal services and cloud metadata endpoints even when server responses are not reflected. Use when testing URL/webhook parameters, PDF generators, image processors, or import/preview features where SSRF output cannot be observed directly.
Repository stars: 35,763 · Incomplete scan
Skill
mapping-mitre-attack-techniques
mukul975/Anthropic-Cybersecurity-Skills · skills/mapping-mitre-attack-techniques
Maps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and guide control prioritization. Use when building an ATT&CK-based coverage heatmap, tagging SIEM alerts with technique IDs, aligning security controls to adversary playbooks, or reporting threat exposure to executives. Activates for requests involving ATT&CK Navigator, Sigma rules, MITRE D3FEND, or coverage gap analysis.
Repository stars: 35,763 · Incomplete scan
Skill
collecting-indicators-of-compromise
mukul975/Anthropic-Cybersecurity-Skills · skills/collecting-indicators-of-compromise
Systematically collects, categorizes, and distributes indicators of compromise (IOCs) during and after security incidents to enable detection, blocking, and threat intelligence sharing. Covers network, host, email, and behavioral indicators using STIX/TAXII formats and threat intelligence platforms. Activates for requests involving IOC collection, indicator extraction, threat indicator sharing, compromise indicators, STIX export, or IOC enrichment.
Repository stars: 35,763 · Incomplete scan
Skill
exploiting-broken-link-hijacking
mukul975/Anthropic-Cybersecurity-Skills · skills/exploiting-broken-link-hijacking
Discovers and exploits broken link hijacking by spidering a site (Burp Suite Spider, Scrapy, curl scraping), extracting referenced external scripts/domains, and checking DNS/CNAME records and domain registration status for expired or unclaimed resources an attacker could register. Use for subdomain takeover testing, supply-chain review of third-party scripts, or bug bounty hunting for hijackable external resources.
Repository stars: 35,763 · Incomplete scan
Automated signals, not a guarantee. How the checks work.
