mukul975/Anthropic-Cybersecurity-Skills

What it is

This repository packages cybersecurity practitioner workflows as structured skills that an AI agent can discover and execute, rather than as loose scripts or tutorials. There are 818 skills across 34 security domains, each following the agentskills.io standard: YAML frontmatter for fast discovery plus a Markdown body with When to Use, Prerequisites, Workflow, and Verification sections. Skills are mapped to six frameworks — MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, MITRE D3FEND, NIST AI RMF, and the MITRE Fight Fraud Framework (F3) — each mapped only to the frameworks relevant to its subject.

The intended users are security analysts, DFIR and red-team practitioners, and developers integrating security knowledge into AI coding assistants, CLI agents, or agent frameworks. The design goal is progressive disclosure: an agent scans all skill frontmatter at roughly 30 tokens per skill, selects the relevant ones, and loads full workflows only for those matches.

Quick start

The README gives two installation paths. The recommended one uses npx:

npx skills add mukul975/Anthropic-Cybersecurity-Skills

Alternatively, clone the repository:

git clone https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
cd Anthropic-Cybersecurity-Skills

After installation, point a compatible agent at the skills directory and ask a security question; the agent should match skills by tags and description and then execute the selected workflow. See the quick start section for the original instructions.

The README also links a hosted playground for trying skills without local setup; that is a separate commercial service and not required for local use.

Skill structure and mappings

Each skill lives in skills/<skill-name>/ with a SKILL.md definition, reference files for framework mappings and deeper procedures, optional helper scripts, and templates. Frontmatter fields include name, description, domain, subdomain, tags, atlas_techniques, d3fend_techniques, nist_ai_rmf, and nist_csf; ATT&CK technique mappings are documented in each skill's references/standards.md and in an ATT&CK Navigator layer included with the v1.0.0 release. The library was tagged at 734 skills and has grown on main since, with F3, ATLAS, D3FEND, and AI RMF mappings added after that release.

Constraints and responsible use

The repository contains offensive and dual-use material — red-team C2, phishing simulation, exploitation, and similar techniques — and states it is intended only for authorized penetration testing, security research, defense, and education against systems you own or have explicit written permission to test. The project is an independent community effort and is not affiliated with Anthropic PBC; the name does not imply official backing.

The skills are knowledge files plus helper scripts, not a self-contained scanning product. Results depend on the agent platform, the tools each workflow references (for example Volatility3, Sigma, BloodHound CE, or cloud CLIs), and the access you have in the target environment. The README notes that PR review is currently slow, with some pull requests open for months, so contributed skills may not be vetted promptly. Apache-2.0 permits commercial use and modification.

HotRepo's take

HotRepo's daily snapshots show sustained attention: the project gained roughly 900–1,000 stars per day on several days in late May and late June 2026, and reached 36,122 stars and 4,421 forks by the 14 November 2026 Python daily snapshot, where it ranked 11th on that day's Python list. The noisiest early growth has since cooled to tens of stars per day in that last snapshot, which is a normal settling pattern for a reference-style repository.

The durable value here is the breadth of framework-linked skill files and the per-skill frontmatter design that keeps agent context usage low; the main thing to watch is whether the reported mappings and workflows hold up under practitioner review, given the stated PR backlog.