mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-08-28 20:29:40 +03:00
docs: correct the domain table and add AGENTS.md and SUPPORT.md
The README advertised "29 security domains" and its table listed 29 rows summing to 785 of 817 skills. Six domains were missing entirely and nine carried stale counts, because alias subdomains fold into their canonical form (security-operations into soc-operations, and so on). The table is now generated from the subdomain field in each skill's frontmatter: 34 domains, summing to 817. The six that were invisible are Threat Detection (7), Blockchain Security (2), Wireless Security (2), Privacy Compliance (2), Data Protection (1) and Purple Team (1). AGENTS.md - short, imperative instructions for agents working in this repository: the flat layout, which files load when, the validator commands, and the rule against reintroducing regex frontmatter parsing. Kept deliberately brief; long context files measurably degrade agent performance. SUPPORT.md - where to ask what, what actually moves fastest, and an honest statement that there is no SLA and some PRs have waited months.
This commit is contained in:
Mahipal
@@ -0,0 +1,54 @@
|
||||
# AGENTS.md
|
||||
|
||||
Instructions for AI agents working in this repository.
|
||||
|
||||
## What this repository is
|
||||
|
||||
A library of 817 cybersecurity skills. Each skill is a directory under `skills/` containing a `SKILL.md` — YAML frontmatter plus a Markdown procedure — following the [agentskills.io](https://agentskills.io) standard.
|
||||
|
||||
The layout is flat: `skills/<skill-name>/SKILL.md`. Do not nest skills by domain; agents discover them by scanning `skills/*/SKILL.md`.
|
||||
|
||||
## Reading a skill
|
||||
|
||||
Only `name` and `description` load at discovery time. The body loads once the description matches the request; `references/`, `scripts/` and `assets/` load only when referenced.
|
||||
|
||||
Read the description first. If it carries a negative trigger — "Do not use for X — use `other-skill`" — honour it. Those exist because two skills would otherwise compete for the same request.
|
||||
|
||||
## Changing a skill
|
||||
|
||||
Frontmatter is parsed by `tools/skill_frontmatter.py`, which uses PyYAML. Do not write a regex frontmatter parser; CI fails the build if it detects one. Three hand-rolled parsers previously truncated 604 of 817 descriptions to their first line.
|
||||
|
||||
After changing any `SKILL.md`:
|
||||
|
||||
```bash
|
||||
pip install pyyaml
|
||||
python tools/validate-skill.py --all
|
||||
python tools/validate-agentskills.py --strict
|
||||
python tools/generate-index.py # regenerate index.json
|
||||
python tools/lint-descriptions.py --all
|
||||
python tools/detect-collisions.py
|
||||
```
|
||||
|
||||
All five run in CI. `index.json` is generated — never edit it by hand.
|
||||
|
||||
## Writing a description
|
||||
|
||||
The description is the only signal another agent sees when deciding whether to load the skill. It needs four things:
|
||||
|
||||
1. What it does, concretely.
|
||||
2. `Use when …` — the phrasings a user would actually type.
|
||||
3. `Keywords:` — tool names, event IDs, CVEs, API calls.
|
||||
4. `Do not use for X — use other-skill.` — the negative trigger.
|
||||
|
||||
Keep it under 1024 characters. Keep the body under 500 lines; depth belongs in `references/`.
|
||||
|
||||
## Constraints
|
||||
|
||||
- `name` must equal the directory name, lowercase-kebab, ≤64 characters.
|
||||
- `domain` is always `cybersecurity`. `subdomain` must be one the validator accepts — see CONTRIBUTING.md.
|
||||
- Scripts must run. No placeholders, no invented API endpoints, no fabricated CVE numbers.
|
||||
- Framework IDs must be real and current. A wrong mapping sends an investigation the wrong way; omit rather than guess.
|
||||
|
||||
## Scope
|
||||
|
||||
See [SCOPE.md](SCOPE.md). This repository holds skills. Runtimes, engines and applications belong elsewhere.
|
||||
@@ -10,10 +10,10 @@
|
||||
|
||||
[](https://mahipal.engineer/survey?utm_source=github_badge&utm_medium=readme&utm_campaign=gars2026)
|
||||
[](LICENSE)
|
||||
[](#whats-inside--29-security-domains)
|
||||
[](#whats-inside--34-security-domains)
|
||||
[](#six-frameworks-one-skill-library)
|
||||
[](https://ctid.mitre.org/fraud/)
|
||||
[](#whats-inside--29-security-domains)
|
||||
[](#whats-inside--34-security-domains)
|
||||
[](#compatible-platforms)
|
||||
[](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/stargazers)
|
||||
[](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/network/members)
|
||||
@@ -24,9 +24,9 @@
|
||||
[](https://github.com/NousResearch/hermes-agent)
|
||||
|
||||
|
||||
**817 production-grade cybersecurity skills · 29 security domains · 6 framework mappings · 26+ AI platforms**
|
||||
**817 production-grade cybersecurity skills · 34 security domains · 6 framework mappings · 26+ AI platforms**
|
||||
|
||||
[Get Started](#quick-start) · [What's Inside](#whats-inside--29-security-domains) · [Frameworks](#six-frameworks-one-skill-library) · [Platforms](#compatible-platforms) · [Contributing](#contributing)
|
||||
[Get Started](#quick-start) · [What's Inside](#whats-inside--34-security-domains) · [Frameworks](#six-frameworks-one-skill-library) · [Platforms](#compatible-platforms) · [Contributing](#contributing)
|
||||
|
||||
</div>
|
||||
|
||||
@@ -40,7 +40,7 @@
|
||||
|
||||
A junior analyst knows which Volatility3 plugin to run on a suspicious memory dump, which Sigma rules catch Kerberoasting, and how to scope a cloud breach across three providers. **Your AI agent doesn't — unless you give it these skills.**
|
||||
|
||||
This repo contains **817 structured cybersecurity skills** spanning **29 security domains**, each following the [agentskills.io](https://agentskills.io) open standard. The library maps across **six industry frameworks** — MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, MITRE D3FEND, NIST AI RMF, and the MITRE Fight Fraud Framework (F3) — with each skill mapped to the frameworks **relevant to its type** (a forensics skill carries ATT&CK + CSF; an AI-security skill adds ATLAS and AI RMF). Clone it, point your agent at it, and your next security investigation gets expert-level guidance in seconds.
|
||||
This repo contains **817 structured cybersecurity skills** spanning **34 security domains**, each following the [agentskills.io](https://agentskills.io) open standard. The library maps across **six industry frameworks** — MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, MITRE D3FEND, NIST AI RMF, and the MITRE Fight Fraud Framework (F3) — with each skill mapped to the frameworks **relevant to its type** (a forensics skill carries ATT&CK + CSF; an AI-security skill adds ATLAS and AI RMF). Clone it, point your agent at it, and your next security investigation gets expert-level guidance in seconds.
|
||||
|
||||
## Six frameworks, one skill library
|
||||
|
||||
@@ -145,39 +145,46 @@ Existing security tool repos give you wordlists, payloads, or exploit code. None
|
||||
|
||||
**Anthropic Cybersecurity Skills** is not a collection of scripts or checklists. It is an **AI-native knowledge base** built from the ground up for the agentskills.io standard — YAML frontmatter for sub-second discovery, structured Markdown for step-by-step execution, and reference files for deep technical context. Every skill encodes real practitioner workflows, not generated summaries.
|
||||
|
||||
## What's inside — 29 security domains
|
||||
## What's inside — 34 security domains
|
||||
|
||||
| Domain | Skills | Key capabilities |
|
||||
|---|---|---|
|
||||
| Cloud Security | 66 | AWS, Azure, GCP hardening · CSPM · cloud attack emulation · cloud forensics |
|
||||
| SOC Operations | 63 | Playbooks · escalation workflows · Graph-log detection · tabletop exercises |
|
||||
| Threat Hunting | 58 | Hypothesis-driven hunts · LOTL detection · EVTX hunting · fleet hunting |
|
||||
| Threat Intelligence | 52 | STIX/TAXII · MISP · OpenCTI · feed integration · actor profiling |
|
||||
| Web Application Security | 46 | OWASP Top 10 · SQLi · XSS · SSRF · deserialization |
|
||||
| Network Security | 43 | IDS/IPS · firewall rules · VLAN segmentation · traffic analysis |
|
||||
| Web Application Security | 42 | OWASP Top 10 · SQLi · XSS · SSRF · deserialization |
|
||||
| Digital Forensics | 41 | Disk imaging · memory forensics · Hayabusa/KAPE/Plaso timelines |
|
||||
| Identity & Access Management | 40 | Entra ID/ROADtools · device-code phishing · PAM · zero trust identity |
|
||||
| Malware Analysis | 39 | Static/dynamic analysis · reverse engineering · sandboxing |
|
||||
| Identity & Access Management | 37 | Entra ID/ROADtools · device-code phishing · PAM · zero trust identity |
|
||||
| SOC Operations | 35 | Playbooks · escalation workflows · Graph-log detection · tabletop exercises |
|
||||
| Red Teaming | 33 | ADCS/Certipy · BloodHound CE · Sliver/Havoc C2 · NTLM relay |
|
||||
| Red Teaming | 35 | ADCS/Certipy · BloodHound CE · Sliver/Havoc C2 · NTLM relay |
|
||||
| Container Security | 33 | K8s RBAC · image scanning · Falco · container escape |
|
||||
| Security Operations | 28 | SIEM correlation · log analysis · alert triage |
|
||||
| OT/ICS Security | 28 | Modbus · DNP3 · IEC 62443 · historian defense · SCADA |
|
||||
| OT/ICS Security | 29 | Modbus · DNP3 · IEC 62443 · historian defense · SCADA |
|
||||
| API Security | 28 | GraphQL · REST · OWASP API Top 10 · WAF bypass |
|
||||
| Incident Response | 26 | Breach containment · ransomware response · IR playbooks |
|
||||
| Vulnerability Management | 25 | Nessus · scanning workflows · patch prioritization · CVSS |
|
||||
| Penetration Testing | 21 | Network · web · cloud · mobile · NetExec lateral movement |
|
||||
| Penetration Testing | 23 | Network · web · cloud · mobile · NetExec lateral movement |
|
||||
| DevSecOps | 18 | CI/CD security · Trivy IaC/image scanning · code signing |
|
||||
| Zero Trust Architecture | 17 | BeyondCorp · CISA maturity model · microsegmentation |
|
||||
| Zero Trust Architecture | 18 | BeyondCorp · CISA maturity model · microsegmentation |
|
||||
| Endpoint Security | 17 | EDR · LOTL detection · fileless malware · persistence hunting |
|
||||
| Phishing Defense | 16 | Email authentication · BEC detection · phishing IR |
|
||||
| Cryptography | 16 | TLS · Ed25519 · post-quantum migration · key management |
|
||||
| Phishing Defense | 15 | Email authentication · BEC detection · phishing IR |
|
||||
| AI Security | 14 | LLM red-teaming (garak/PyRIT) · prompt injection · MCP/agentic security · guardrails |
|
||||
| Mobile Security | 13 | Android/iOS analysis · mobile pentesting · MDM forensics |
|
||||
| Ransomware Defense | 13 | Precursor detection · response · recovery · encryption analysis |
|
||||
| Compliance & Governance | 9 | NIST 800-30/RMF · CMMC · HIPAA · TPRM · CIS benchmarks |
|
||||
| Compliance & Governance | 10 | NIST 800-30/RMF · CMMC · HIPAA · TPRM · CIS benchmarks |
|
||||
| Supply Chain Security | 8 | SBOMs · dependency confusion · malicious-package triage · SLSA/Sigstore |
|
||||
| Threat Detection | 7 | Credential dumping · golden-ticket forgery · pass-the-ticket · LOLBAS · UEBA insider signals |
|
||||
| Hardware & Firmware Security | 6 | CHIPSEC/UEFI audit · Secure Boot bypass · TPM attestation · bootkit hunting |
|
||||
| Deception Technology | 6 | Honeytokens · canarytokens · breach detection |
|
||||
| Hardware & Firmware Security | 4 | CHIPSEC/UEFI audit · Secure Boot bypass · TPM attestation · bootkit hunting |
|
||||
| Blockchain Security | 2 | Ethereum smart-contract vulnerabilities · Foundry audit workflows |
|
||||
| Wireless Security | 2 | Bluetooth Low Energy attack detection · BLE security assessment |
|
||||
| Privacy Compliance | 2 | GDPR data-subject access requests · privacy impact assessments |
|
||||
| Data Protection | 1 | Data loss prevention with Microsoft Purview |
|
||||
| Purple Team | 1 | Atomic Red Team purple-team testing |
|
||||
|
||||
*817 skills across 34 domains. Counts come from the `subdomain` field in each skill's frontmatter.*
|
||||
|
||||
## How AI agents use these skills
|
||||
|
||||
|
||||
+46
@@ -0,0 +1,46 @@
|
||||
# Support
|
||||
|
||||
This project is maintained by one person alongside other work. That shapes what support looks like here, so it is worth being direct about it rather than leaving you to guess.
|
||||
|
||||
## Where to go
|
||||
|
||||
| I want to… | Use |
|
||||
|---|---|
|
||||
| Ask how something works | [Discussions](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/discussions) |
|
||||
| Report a skill that is wrong, broken, or out of date | [Issues](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/issues) |
|
||||
| Propose a new skill | Issue first, then a PR — see [CONTRIBUTING.md](CONTRIBUTING.md) |
|
||||
| Fix something yourself | Open a PR. This is the fastest path to change. |
|
||||
| Report a security problem | See [SECURITY.md](SECURITY.md) |
|
||||
|
||||
Issues are for concrete defects: a command that does not work, a flag that does not exist, a framework ID that is wrong, a script that fails. Questions belong in Discussions, where other people can answer too and the answer stays findable.
|
||||
|
||||
## What to expect
|
||||
|
||||
There is no SLA. Response time varies with what else is happening; some pull requests have waited months, and that is a real cost I am working to reduce rather than a policy.
|
||||
|
||||
What moves fastest, in order:
|
||||
|
||||
1. A PR that fixes one thing and passes the validators.
|
||||
2. An issue that names the skill, quotes the failing command, and shows the actual output.
|
||||
3. Everything else.
|
||||
|
||||
What tends to stall: large multi-skill PRs, feature requests outside the skill-library format, and requests for bespoke integration help.
|
||||
|
||||
## Before you open an issue
|
||||
|
||||
```bash
|
||||
pip install pyyaml
|
||||
python tools/validate-skill.py skills/<skill-name>
|
||||
```
|
||||
|
||||
If a skill fails validation, that output is the most useful thing you can paste. If you are reporting a procedure that does not work, say which version of the tool you ran and what it printed — "this does not work" is not actionable, and a wrong procedure in a security library is worth fixing properly.
|
||||
|
||||
## What this project is not
|
||||
|
||||
It is a reference library, not a product. It ships no service, holds no data, and makes no availability guarantee. Skills describe procedures for systems you own or are authorised to assess — see [SCOPE.md](SCOPE.md).
|
||||
|
||||
If you need something with a support contract behind it, this is not that, and I would rather say so plainly than have you discover it during an incident.
|
||||
|
||||
## Helping
|
||||
|
||||
The most useful contributions are unglamorous: correcting a procedure you actually ran, adding a framework mapping you verified, or telling me two skills are competing for the same request. All three make the library measurably better for everyone using it.
|
||||
Reference in New Issue
Block a user