mirror of https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git synced 2026-08-03 17:30:19 +03:00

Files

T

Mahipal 2fb6a9faff Rewrite 548 skill descriptions to the activation rubric

Each rewritten description now states both what the skill does (concrete
capability, named tools/artifacts) and an explicit when-to-use trigger,
improving agent discovery/activation. Grounded in each skill's own body;
changes confined to the `description` field only (bodies and all other
frontmatter untouched). Produced by a gated audit->rewrite->recheck loop
(548 -> 0 flagged) with a sampled anti-invention check (0 ungrounded).

Schema: 817/817 pass. Framework-ID gate: 0 defects.

2026-08-02 09:32:13 -07:00

2.3 KiB

Raw Blame History

name, description, domain, subdomain, tags, version, author, license, nist_csf, mitre_attack

name

description

domain

subdomain

Implementing Deception-Based Detection with Canarytoken

Overview

Canary Tokens are lightweight tripwire mechanisms that alert when an attacker accesses a resource. This skill uses the Thinkst Canary REST API to programmatically create tokens (web bugs, DNS tokens, MS Word documents, AWS API keys), deploy them to strategic locations, monitor for triggered alerts, and generate deception coverage reports.

When to Use

When deploying or configuring implementing deception based detection with canarytoken capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

Thinkst Canary Console or canarytokens.org account
API auth token from Canary Console
Python 3.9+ with requests
File system access for deploying document and file tokens

Steps

Authenticate to the Canary Console API using auth_token
Create web bug (HTTP) tokens for embedding in documents and web pages
Create DNS tokens for monitoring DNS resolution attempts
Create MS Word document tokens for file share deployment
List all active tokens and their trigger history
Query recent alerts for triggered token events
Generate deception coverage report with deployment recommendations

Expected Output

JSON report listing all deployed Canary Tokens, trigger history, alert details, and coverage analysis
Deployment map showing token types across network segments

2.3 KiB Raw Blame History