creator/Anthropic-Cybersecurity-Skills
1
0
Fork 0
mirror of https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git synced 2026-08-03 09:20:18 +03:00
Code Issues Packages Projects Releases Wiki Activity

Fix framework-ID defects across 53 skills (grounded in authoritative data)

Browse Source 
Deterministic audit against vendored MITRE/NIST oracles (ATT&CK v19.1,
ATLAS 2026.07, NIST CSF 2.0, D3FEND v1.4.0) found and fixed:

- 27 wrong-framework leaks on 12 AI-security skills: ATLAS AML.* IDs were
  under `mitre_attack` (-> `atlas_techniques`) and AI-RMF GOVERN/MEASURE IDs
  under `nist_csf` (-> `nist_ai_rmf`).
- RS.AN-01 -> RS.AN-03 on 37 forensics/incident-analysis skills (CSF 1.1 ID
  retired in CSF 2.0; RS.AN-03 is the incident-analysis successor).
- PR.DS-06 -> PR.DS-01 on the SLSA/Sigstore provenance skill (CSF 1.1 ID
  absorbed into PR.DS-01 in CSF 2.0; body prose updated too).
- AML.T0104 -> AML.T0010 on 3 software-supply-chain skills (T0104 is
  "Publish Poisoned AI Agent Tool" -- wrong topic; T0010 "AI Supply Chain
  Compromise" is correct).

CSF/ATLAS replacements verified against NIST CSWP.29, the official CSF
1.1->2.0 transition workbook, and mitre-atlas/atlas-data.
Framework-ID gate: 0 defects. Schema: 817/817 pass.
This commit is contained in:
Mahipal
2026-08-02 06:00:54 -07:00
parent 673da1f3b0
commit 2545b2d3d5
53 changed files with 26 additions and 66 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skills/acquiring-disk-image-with-dd-and-dcfldd/SKILL.md
-1
View File
@@ -15,7 +15,6 @@ version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/analyzing-browser-forensics-with-hindsight/SKILL.md
-1
View File
@@ -20,7 +20,6 @@ version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/analyzing-disk-image-with-autopsy/SKILL.md
-1
View File
@@ -15,7 +15,6 @@ version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/analyzing-docker-container-forensics/SKILL.md
-1
View File
@@ -15,7 +15,6 @@ version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/analyzing-email-headers-for-phishing-investigation/SKILL.md
-1
View File
@@ -18,7 +18,6 @@ license: Apache-2.0
atlas_techniques:
- AML.T0052
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/analyzing-linux-kernel-rootkits/SKILL.md
-1
View File
@@ -19,7 +19,6 @@ version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/analyzing-linux-system-artifacts/SKILL.md
-1
View File
@@ -16,7 +16,6 @@ version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/analyzing-lnk-file-and-jump-list-artifacts/SKILL.md
-1
View File
@@ -20,7 +20,6 @@ version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/analyzing-mft-for-deleted-file-recovery/SKILL.md
-1
View File
@@ -20,7 +20,6 @@ version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/analyzing-outlook-pst-for-email-forensics/SKILL.md
-1
View File
@@ -25,7 +25,6 @@ nist_ai_rmf:
- MANAGE-3.1
- MEASURE-3.1
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/analyzing-prefetch-files-for-execution-history/SKILL.md
-1
View File
@@ -15,7 +15,6 @@ version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/analyzing-sbom-for-supply-chain-vulnerabilities/SKILL.md
-1
View File
@@ -26,7 +26,6 @@ author: mukul975
license: Apache-2.0
atlas_techniques:
- AML.T0010
- AML.T0104
nist_ai_rmf:
- GOVERN-5.2
- MAP-1.6
skills/analyzing-slack-space-and-file-system-artifacts/SKILL.md
-1
View File
@@ -16,7 +16,6 @@ version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/analyzing-supply-chain-malware-artifacts/SKILL.md
-1
View File
@@ -18,7 +18,6 @@ author: mahipal
license: Apache-2.0
atlas_techniques:
- AML.T0010
- AML.T0104
nist_ai_rmf:
- GOVERN-5.2
- MAP-1.6
skills/analyzing-usb-device-connection-history/SKILL.md
-1
View File
@@ -15,7 +15,6 @@ version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/analyzing-windows-amcache-artifacts/SKILL.md
-1
View File
@@ -23,7 +23,6 @@ version: 1.0.0
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/analyzing-windows-lnk-files-for-artifacts/SKILL.md
-1
View File
@@ -15,7 +15,6 @@ version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/analyzing-windows-prefetch-with-python/SKILL.md
-1
View File
@@ -22,7 +22,6 @@ version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/analyzing-windows-registry-for-artifacts/SKILL.md
-1
View File
@@ -15,7 +15,6 @@ version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/analyzing-windows-shellbag-artifacts/SKILL.md
-1
View File
@@ -20,7 +20,6 @@ version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/assessing-vector-and-embedding-weaknesses/SKILL.md
+2 -2
View File
@@ -15,9 +15,9 @@ tags:
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
nist_ai_rmf:
- MEASURE-2.7
mitre_attack:
atlas_techniques:
- AML.T0024
---
# Assessing Vector and Embedding Weaknesses
skills/auditing-mcp-servers-for-tool-poisoning/SKILL.md
+2 -2
View File
@@ -15,9 +15,9 @@ tags:
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
nist_ai_rmf:
- MANAGE-2.2
mitre_attack:
atlas_techniques:
- AML.T0010
---
# Auditing MCP Servers for Tool Poisoning
skills/continuous-llm-red-teaming-with-promptfoo/SKILL.md
+2 -2
View File
@@ -15,9 +15,9 @@ tags:
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
nist_ai_rmf:
- MANAGE-4.1
mitre_attack:
atlas_techniques:
- AML.T0051
---
# Continuous LLM Red Teaming with Promptfoo
skills/defending-llms-with-guardrails/SKILL.md
+2 -2
View File
@@ -15,9 +15,9 @@ tags:
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
nist_ai_rmf:
- MANAGE-2.1
mitre_attack:
atlas_techniques:
- AML.T0054
---
# Defending LLMs with Guardrails
skills/detecting-data-and-model-poisoning/SKILL.md
+2 -2
View File
@@ -15,9 +15,9 @@ tags:
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
nist_ai_rmf:
- MEASURE-2.7
mitre_attack:
atlas_techniques:
- AML.T0020
- AML.T0018
---
skills/detecting-indirect-prompt-injection/SKILL.md
+2 -2
View File
@@ -15,9 +15,9 @@ tags:
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
nist_ai_rmf:
- MEASURE-2.7
mitre_attack:
atlas_techniques:
- AML.T0051.001
---
# Detecting Indirect Prompt Injection
skills/detecting-model-extraction-attacks/SKILL.md
+2 -2
View File
@@ -15,9 +15,9 @@ tags:
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
nist_ai_rmf:
- MEASURE-2.6
mitre_attack:
atlas_techniques:
- AML.T0024
---
# Detecting Model Extraction Attacks
skills/detecting-supply-chain-attacks-in-ci-cd/SKILL.md
-1
View File
@@ -20,7 +20,6 @@ author: mahipal
license: Apache-2.0
atlas_techniques:
- AML.T0010
- AML.T0104
nist_ai_rmf:
- GOVERN-5.2
- MAP-1.6
skills/extracting-browser-history-artifacts/SKILL.md
-1
View File
@@ -16,7 +16,6 @@ version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/extracting-credentials-from-memory-dump/SKILL.md
-1
View File
@@ -53,7 +53,6 @@ version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/extracting-windows-event-logs-artifacts/SKILL.md
-1
View File
@@ -16,7 +16,6 @@ version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/investigating-ransomware-attack-artifacts/SKILL.md
-1
View File
@@ -15,7 +15,6 @@ version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/orchestrating-llm-attacks-with-pyrit/SKILL.md
+2 -2
View File
@@ -15,9 +15,9 @@ tags:
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
nist_ai_rmf:
- MEASURE-2.7
mitre_attack:
atlas_techniques:
- AML.T0051
- AML.T0054
---
skills/performing-cloud-forensics-investigation/SKILL.md
-1
View File
@@ -16,7 +16,6 @@ version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/performing-cloud-storage-forensic-acquisition/SKILL.md
-1
View File
@@ -28,7 +28,6 @@ atlas_techniques:
- AML.T0066
- AML.T0082
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/performing-file-carving-with-foremost/SKILL.md
-1
View File
@@ -15,7 +15,6 @@ version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/performing-linux-log-forensics-investigation/SKILL.md
-1
View File
@@ -20,7 +20,6 @@ version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/performing-log-analysis-for-forensic-investigation/SKILL.md
-1
View File
@@ -15,7 +15,6 @@ version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/performing-malware-persistence-investigation/SKILL.md
-1
View File
@@ -22,7 +22,6 @@ version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/performing-memory-forensics-with-volatility3/SKILL.md
-1
View File
@@ -15,7 +15,6 @@ version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/performing-mobile-device-forensics-with-cellebrite/SKILL.md
-1
View File
@@ -15,7 +15,6 @@ version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/performing-network-forensics-with-wireshark/SKILL.md
-1
View File
@@ -15,7 +15,6 @@ version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/performing-network-packet-capture-analysis/SKILL.md
-1
View File
@@ -21,7 +21,6 @@ version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/performing-sqlite-database-forensics/SKILL.md
-1
View File
@@ -20,7 +20,6 @@ version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/performing-steganography-detection/SKILL.md
-1
View File
@@ -15,7 +15,6 @@ version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/performing-timeline-reconstruction-with-plaso/SKILL.md
-1
View File
@@ -16,7 +16,6 @@ version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/SKILL.md
-1
View File
@@ -23,7 +23,6 @@ version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/recovering-deleted-files-with-photorec/SKILL.md
-1
View File
@@ -23,7 +23,6 @@ atlas_techniques:
- AML.T0066
- AML.T0082
nist_csf:
- RS.AN-01
- RS.AN-03
- DE.AE-02
- RS.MA-01
skills/red-teaming-llms-with-garak/SKILL.md
+2 -2
View File
@@ -15,9 +15,9 @@ tags:
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
nist_ai_rmf:
- MEASURE-2.7
mitre_attack:
atlas_techniques:
- AML.T0051
- AML.T0054
---
skills/securing-agentic-ai-tool-invocation/SKILL.md
+2 -2
View File
@@ -15,9 +15,9 @@ tags:
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
nist_ai_rmf:
- GOVERN-1.3
mitre_attack:
atlas_techniques:
- AML.T0053
---
# Securing Agentic AI Tool Invocation
skills/testing-for-system-prompt-leakage/SKILL.md
+2 -2
View File
@@ -15,9 +15,9 @@ tags:
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
nist_ai_rmf:
- MEASURE-2.7
mitre_attack:
atlas_techniques:
- AML.T0057
---
# Testing for System Prompt Leakage
skills/testing-prompt-injection-in-rag-pipelines/SKILL.md
+2 -2
View File
@@ -15,9 +15,9 @@ tags:
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
nist_ai_rmf:
- MEASURE-2.7
mitre_attack:
atlas_techniques:
- AML.T0051
---
# Testing Prompt Injection in RAG Pipelines
skills/verifying-build-provenance-with-slsa-sigstore/SKILL.md
+2 -2
View File
@@ -16,7 +16,7 @@ version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.DS-06
- PR.DS-01
mitre_attack:
- T1195
---
@@ -28,7 +28,7 @@ Build-provenance verification answers a question that defeats many supply-chain
This skill covers verifying signatures and SLSA provenance with **cosign** (`cosign verify`, `cosign verify-attestation`, `cosign verify-blob-attestation`) and **slsa-verifier** (`slsa-verifier verify-artifact`), enforcing the builder identity (the GitHub Actions workflow that produced the artifact) and the expected source repository. Keyless verification ties trust to an OIDC issuer (e.g., `https://token.actions.githubusercontent.com`) and a certificate identity rather than a long-lived private key.
This maps to MITRE ATT&CK **T1195 — Supply Chain Compromise** (provenance verification detects/blocks tampered artifacts) and NIST CSF **PR.DS-06** (integrity-checking mechanisms are used to verify software, firmware, and information integrity).
This maps to MITRE ATT&CK **T1195 — Supply Chain Compromise** (provenance verification detects/blocks tampered artifacts) and NIST CSF **PR.DS-01** (the confidentiality, integrity, and availability of data-at-rest are protected; CSF 2.0 absorbed the retired 1.1 PR.DS-06 integrity-checking outcome here).
## When to Use