817 cybersecurity skills for agents

Your AI agent writes code just fine, but flounders in a real incident: it doesn't know which Volatility3 plugin to run on a memory dump or how to unravel a breach across three clouds. 817 ready-made skills hand it a senior analyst's playbook 🛡️

What it is and who it's for

Anthropic Cybersecurity Skills is the largest open library of Agent Skills for cybersecurity: 817 structured skills across 29 domains. Each skill is a folder with a SKILL.md (YAML front matter + a step-by-step workflow), plus references/, scripts/, assets/. The format is the open agentskills.io standard, so an agent picks the skills up with no configuration.

Important note on the name: "Anthropic" here refers to the format — Agent Skills, a standard Anthropic came up with — while the project itself is community-made, NOT from Anthropic PBC. The author is Mahipal Jangra (@mukul975). The repo header carries an honest non-affiliation disclaimer.

Who it's for: security engineers, pentesters, DevSecOps, SOC and DFIR analysts whose agent (Claude Code, Cursor, GitHub Copilot) should work by methodology rather than by guesswork. What sets it apart is that it isn't payloads or scripts but structured decision-making: when to apply a technique, what to check, how to execute step by step and how to verify the result.

Key capabilities

• 817 skills, 29 domains: Cloud Security (66), Threat Hunting (58), Threat Intelligence (52), Web App Security (42), Malware Analysis (39), Red Teaming (33), AI Security (14, including prompt injection and MCP attacks), and so on.
• Mapped to 6 frameworks at once: MITRE ATT&CK v19.1, NIST CSF 2.0, MITRE ATLAS v5.4, MITRE D3FEND v1.3, NIST AI RMF 1.0 and MITRE F3 (Fight Fraud). One skill — six compliance checkboxes.
• Progressive disclosure: ~30 tokens to scan the front matter, 500–2000 for a full load — the agent scans all 817 skills in one pass without blowing up context.
• Compatibility: Claude Code, GitHub Copilot, Cursor, Codex CLI, Gemini CLI, Windsurf, Cline and 20+ agentskills.io platforms.
• Apache 2.0 — fine for personal and commercial projects. 25k+ stars, 3k+ forks on GitHub.

Get started in 5 minutes

1. Install the skills into your project root with one command:

npx skills add mukul975/Anthropic-Cybersecurity-Skills

Or clone it: git clone https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git. 2. Open the project in Claude Code / Cursor / Copilot — the skills load automatically (agentskills.io format). 3. Give the agent a real task: "Analyze this memory dump for signs of credential theft." The agent finds the relevant skills itself (for example analyzing-memory-dumps-with-volatility), runs the workflow step by step and maps findings to ATT&CK.

When to use it, when not to

✅ Take it if the agent is already in your security stack and you need it to run an investigation/pentest by the book instead of ad hoc. ✅ Take it if mapping findings to MITRE ATT&CK / NIST matters for reports and compliance — it's baked into every skill. ❌ Skip it → use /security-review in Claude Code instead if the job is simply checking your diff for vulnerabilities before a commit, not running DFIR/red-team work. ❌ Skip it if your agent doesn't support Agent Skills — without a compatible platform the library is useless. ❌ Skip it if you're expecting ready exploits, wordlists or payloads: these are workflow playbooks, not offensive tooling. Want to build your own skills — see the skill-creator card.

The honest price

Completely free and open source under Apache 2.0 — no card required, commercial use allowed. The repo itself has no paid plans. The README links to a third-party playground, Casky.ai, and a survey for tokens — those are the author's external things, you don't need them to use the skills. Tag: free / oss.

Gotchas

• The name misleads: "Anthropic Cybersecurity Skills" is a community project by @mukul975, NOT an Anthropic product. Don't present it as official.
• Dual-use and offensive content (C2, phishing simulations, exploitation) — only against your own systems or with written permission and within the law. The README says so explicitly; the responsibility is yours.
• This is knowledge, not tooling: Volatility3, BloodHound, Nessus, garak and the rest you install separately — the skill only walks you through the steps.
• The numbers move: a competitor's post said "754 skills" — that's spring 2026 (v1.1 in March — 753, v1.2 in April — 754). The current release v1.3 (June 2026) and main are already at 817 and growing; older tagged releases have fewer than main.
• Procedure accuracy rests on contributors: this is community review, not a vendor audit. Double-check any questionable step against the primary source.
• A playbook ≠ a guarantee: the agent can still get a command wrong or skip a step — keep a human in the loop and check the output yourself.

🤖 Prompt accelerator

"You are my security agent with the Anthropic Cybersecurity Skills library (agentskills.io) connected. Task: <DESCRIBE THE INCIDENT/GOAL, e.g. investigate suspected credential theft on this Windows host>. First scan the skills' front matter and pick the 3 most relevant ones — name them and explain the choice. Then execute their Workflow step by step, showing the concrete commands. At the end add a Verification section: map the findings to MITRE ATT&CK and state what's confirmed and what's a hypothesis. We work only on an authorized system; ask for confirmation before any offensive command."