mukul975/Anthropic-Cybersecurity-Skills

The core idea here is architectural, not encyclopedic. An AI agent handed a memory dump can already write Python and call shell commands — what it lacks is the practitioner's decision tree: which Volatility3 plugin to run first, what LSASS access patterns to check, how to correlate event log evidence with the dump. This repo's 817 skills are structured precisely to fill that gap, each one a YAML-fronted Markdown document encoding when to activate, what prerequisites to verify, how to execute step-by-step, and how to confirm success.

The token economics matter. Frontmatter scans at roughly 30 tokens per skill; a full workflow loads at 500–2,000 tokens. That progressive disclosure design means an agent can scan all 817 skills in a single pass, identify the relevant handful, then load only those in full — without blowing a context window. It's a sensible answer to a real constraint, and it's baked into the structure rather than bolted on.

The framework mapping is genuinely thorough, though the coverage is uneven by design. MITRE ATT&CK touches 805 of the 817 skills; NIST CSF 2.0 touches 804. MITRE ATLAS, D3FEND, NIST AI RMF, and the MITRE Fight Fraud Framework each apply to far fewer — 93 to 139 skills — because they're only mapped where relevant. A forensics skill carries ATT&CK and CSF; an AI-security skill adds ATLAS and AI RMF. That selectivity is the right call. Blanket mapping everything to every framework would be noise.

The F3 inclusion is worth flagging specifically. The MITRE Fight Fraud Framework dropped in April 2026, co-developed with JPMorganChase, Citigroup, and others, and it adds two fraud-specific tactics ATT&CK doesn't enumerate: Positioning (pre-fraud access manipulation, SIM-swap pre-positioning, session hijack) and Monetization (money-mule layering, crypto off-ramping, chargeback abuse). The repo claims all 123 F3 v1.1 technique IDs were verified against the upstream STIX bundle. For anyone building agents that touch financial fraud detection, that mapping alone is hard to find elsewhere.

The domain spread is wide — 29 domains from OT/ICS to hardware firmware to deception technology — but coverage is thin at the edges. Deception Technology has 6 skills; Hardware and Firmware Security has 4. The README is candid about this and flags those domains as needing contributions. Cloud Security (66 skills) and Threat Hunting (58) are the densest areas.

The name is mildly misleading: the repo is explicitly not affiliated with Anthropic PBC, and the skills work with any agentskills.io-compatible platform — Claude Code, GitHub Copilot, Gemini CLI, LangChain, CrewAI, and more. The branding is a liability for discoverability, but the content is platform-agnostic.

What's absent from the README is any independent validation of skill accuracy. The claim that every skill encodes "real practitioner workflows, not generated summaries" is asserted, not demonstrated. For production security use, that's the question that matters most.