Anthropic Cybersecurity Skills

Anthropic Cybersecurity Skills is a Python-based knowledge library for AI coding and security agents. It packages 817 structured skill files across 29 security domains, covering everything from cloud security and memory forensics to malware analysis and OT/ICS defense. It's built for developers and security teams who want their AI agent (Claude Code, Copilot, Cursor, Codex CLI, or any agentskills.io-compatible tool) to follow real practitioner workflows instead of guessing at commands.

Each skill is a Markdown file with YAML frontmatter mapping it to relevant frameworks out of six supported: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, MITRE D3FEND, NIST AI RMF, and the MITRE Fight Fraud Framework (F3). Not every skill maps to every framework; a forensics skill might carry ATT&CK and CSF tags, while an AI-security skill adds ATLAS and AI RMF. The frontmatter alone (about 30 tokens per skill) lets an agent scan all 817 skills cheaply before loading the full workflow (500-2,000 tokens) for the ones that match.

Key features

• 817 skill files organized into 29 domains, from cloud security and threat hunting to hardware/firmware security and deception technology.
• Six framework mappings (ATT&CK, NIST CSF 2.0, ATLAS, D3FEND, NIST AI RMF, MITRE F3) applied per-skill, only where relevant.
• Consistent skill anatomy: each skill folder has a SKILL.md, a references/ directory with standards and workflow docs, scripts/ with helper code, and assets/ with templates.
• Progressive disclosure design: cheap frontmatter scanning lets an agent search the whole library before loading full instructions, keeping context usage low.
• MITRE ATT&CK v19.1 coverage across 805 of 817 skills, validated with the official mitreattack-python library, spanning Enterprise, ICS, and Mobile tactics.
• MITRE F3 fraud mapping for 94 skills covering cyber-enabled financial fraud, including the Positioning and Monetization tactics not covered by ATT&CK.
• Broad platform compatibility, working with Claude Code, GitHub Copilot, OpenAI Codex CLI, Cursor, Gemini CLI, and other agentskills.io-compatible tools.
• Apache-2.0 licensed, so skills can be reused and modified in commercial or research projects.

Ideal use cases

This repo fits teams building or configuring AI agents for security work: SOC analysts wiring up an agent for incident triage, red teamers who want an agent that knows ADCS abuse or C2 tooling, DFIR practitioners automating memory-forensics workflows, or researchers studying how to map LLM behavior to MITRE ATLAS and AI RMF. It's also useful for anyone benchmarking or training agents against a structured, framework-mapped security knowledge base rather than raw exploit code.

It's not a good fit if you're looking for a ready-made scanning tool, exploit framework, or SIEM product. It supplies structured knowledge and workflows, not executable attack tooling beyond the small helper scripts bundled per skill. It's also not a substitute for actual security training or certification, and the offensive/dual-use content is explicitly meant for authorized testing only, so it's the wrong choice if you need something to run unsupervised against systems you don't control.

Installation

The fastest path is installing the skills via the skills CLI:

# Option 1: npx (recommended)
npx skills add mukul975/Anthropic-Cybersecurity-Skills

Alternatively, clone the repository directly and point your agent at the skills/ directory:

# Option 2: Git clone
git clone https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
cd Anthropic-Cybersecurity-Skills

Once installed, the library works out of the box with Claude Code, GitHub Copilot, OpenAI Codex CLI, Cursor, Gemini CLI, and any other agentskills.io-compatible platform. No API keys or extra configuration are required beyond whatever your AI coding tool already needs to read local skill files or repos.