mukul975/Anthropic-Cybersecurity-Skills

The core bet here is that AI agents fail at security work not because they lack general intelligence but because they lack practitioner structure. A generic LLM knows that Volatility3 exists; it does not know which plugin to run first on a suspicious memory dump, what to check if that plugin returns nothing, or how to correlate the result against Windows event log evidence. This library tries to close that gap with 818 structured skills across 34 security domains, each encoded as YAML frontmatter plus a Markdown body with explicit sections for trigger conditions, prerequisites, step-by-step workflow, and verification.

The architecture is deliberately token-conscious. Frontmatter alone costs roughly 30 tokens to scan, while a full skill runs 500 to 2,000 tokens. That ratio lets an agent search the entire library in a single pass — matching on tags, description, and domain — then load only the two or three skills it actually needs. For a 200k-context window that is a reasonable trade; for a tighter one it matters considerably more.

The framework mapping is the most technically ambitious part. Six frameworks are in play: MITRE ATT&CK v19.1, NIST CSF 2.0, MITRE ATLAS, MITRE D3FEND, NIST AI RMF, and the MITRE Fight Fraud Framework (F3), which MITRE's Center for Threat-Informed Defense released in April 2026. F3 is the most interesting addition because it covers the post-compromise phase ATT&CK largely ignores — specifically the Positioning and Monetization tactics that describe how stolen access becomes stolen money. The 94 fraud-relevant skills mapped to F3 are a genuine gap-fill for anyone building agents that work financial crime investigations. Not every skill carries all six mappings; a forensics skill gets ATT&CK and CSF, an AI-security skill adds ATLAS and AI RMF. That selectivity is the right call.

The name is misleading and the README says so plainly: this is an independent community project, not an Anthropic product. The naming is a marketing choice that will confuse people, and the disclaimer buried in a blockquote at the top does not fully offset it.

Coverage is uneven in ways the README acknowledges honestly. Data Protection has one skill. Purple Team has one. Blockchain Security and Wireless Security have two each. The maintainer notes the PR review queue is longer than ideal and some pull requests have been open for months. For a library claiming production-grade quality across 818 entries, that backlog is worth knowing about before you depend on it.

What the library is not: a collection of exploit scripts, wordlists, or payloads. The skills encode decision workflows, not attack tooling. That distinction matters for both the utility and the risk profile. The dual-use concern is real — red-team C2 setup and phishing simulation are in here — but the structure is oriented toward detection, response, and authorized testing rather than raw offensive capability.