SkillCheatSheet
Agent skills for Information Security Analysts
105 agent skills are labelled for Information Security Analysts work. They are listed by code score, out of 100.
All 105
-
secops-detection-engineering google/skills
Author, validate, test, and deploy YARA-L 2.0 detection rules and evaluate end-to-end detection coverage gaps in Google SecOps. Use when writing new detection rules, tuning existi…
Verified87A -
cvss-scoring trailofbits/skills
Produces CVSS v4.0 vector strings from plain-text vulnerability descriptions by systematically evaluating base metrics. Use when scoring a vulnerability, generating a CVSS vector,…
Verified85A -
google-cloud-filestore-auditing google/skills
Audits Filestore instances on Google Cloud across projects for disaster recovery readiness (missing or stale backups), security access governance (overly permissive NFS export rul…
Verified84B -
auditing-tls-certificate-transparency-logs mukul975/Anthropic-Cybersecurity-Skills
Monitors Certificate Transparency (CT) logs to detect unauthorized certificate issuance, discover subdomains via CT data, and alert on suspicious certificate activity for owned do…
Verified82B -
performing-access-review-and-certification mukul975/Anthropic-Cybersecurity-Skills
Designs and runs access review and certification campaigns-scoping, reviewer selection, risk-based prioritization, micro-certification, and remediation tracking-to verify user acc…
Verified82B -
performing-vulnerability-scanning-with-nessus mukul975/Anthropic-Cybersecurity-Skills
Performs authenticated and unauthenticated vulnerability scanning using Tenable Nessus to identify known vulnerabilities, misconfigurations, default credentials, and missing patch…
Verified81B -
yara-rule-authoring trailofbits/skills
Guides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules. Covers naming conventions, string select…
Verified81B -
analyzing-linux-audit-logs-for-intrusion mukul975/Anthropic-Cybersecurity-Skills
Uses the Linux Audit framework (auditd) with ausearch and aureport utilities to detect intrusion attempts, unauthorized access, privilege escalation, and suspicious system activit…
Verified80B -
building-ransomware-playbook-with-cisa-framework mukul975/Anthropic-Cybersecurity-Skills
Builds a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST Cybersecurity Framework, covering preparation, detection, containment…
Verified80B -
deploying-decoy-files-for-ransomware-detection mukul975/Anthropic-Cybersecurity-Skills
Deploys canary files (honeytokens) across file systems to detect ransomware encryption activity in real time. Uses strategically placed decoy documents monitored via file integrit…
Verified80B -
detecting-lateral-movement-with-zeek mukul975/Anthropic-Cybersecurity-Skills
Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to iden…
Verified80B -
implementing-security-information-sharing-with-stix2 mukul975/Anthropic-Cybersecurity-Skills
Create, validate, and share STIX 2.1 threat intelligence objects (indicators, malware, campaigns, relationships, bundles) using the stix2 Python library, and publish them over TAX…
Verified80B -
performing-privileged-account-access-review mukul975/Anthropic-Cybersecurity-Skills
Conducts systematic reviews of privileged accounts to validate access rights, identify excessive or stale permissions, and enforce least privilege across PAM infrastructure. Use w…
Verified80B -
validating-backup-integrity-for-recovery mukul975/Anthropic-Cybersecurity-Skills
Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for…
Verified80B -
isms-audit-expert alirezarezvani/claude-skills
Use for ISO 27001 audit work: internal or surveillance audits, Annex A control evidence, Statement of Applicability, nonconformities, Stage 1 and 2 prep. Plans risk-based audits w…
Verified80B -
soc2-compliance alirezarezvani/claude-skills
Use when the user asks to prepare for SOC 2 audits, map Trust Service Criteria, build control matrices, collect audit evidence, perform gap analysis, or assess SOC 2 Type I vs Typ…
Verified80B -
hunting-bootkits-in-efi-system-partition mukul975/Anthropic-Cybersecurity-Skills
Baseline the EFI System Partition and hunt malicious EFI binaries such as ESPecter, BlackLotus, Bootkitty, and Glupteba by mounting the ESP, hashing and verifying boot loaders, sc…
79B -
performing-access-recertification-with-saviynt mukul975/Anthropic-Cybersecurity-Skills
Configure and execute access recertification campaigns in Saviynt Enterprise Identity Cloud to validate user entitlements, revoke excessive access, and maintain compliance with SO…
79B -
performing-cloud-native-threat-hunting-with-aws-detective mukul975/Anthropic-Cybersecurity-Skills
Investigate AWS security incidents using Amazon Detective's behavior graphs, built from CloudTrail, VPC Flow Logs, GuardDuty, and EKS audit logs, to trace entity timelines and pro…
79B -
78B
-
78B
-
analyzing-typosquatting-domains-with-dnstwist mukul975/Anthropic-Cybersecurity-Skills
Generate domain permutations with dnstwist and check DNS resolution to detect typosquatting, homograph phishing, and brand impersonation domains registered against your organizati…
78B -
detecting-oauth-token-theft mukul975/Anthropic-Cybersecurity-Skills
Detect and respond to OAuth token theft and replay in Microsoft Entra ID (Azure AD), covering access token theft, refresh token replay, Primary Refresh Token (PRT) abuse, pass-the…
78B -
agent-platform-access-audit google/skills
Audits AI agent data access, blast radius, and blocked policy operations in Google Cloud by querying Cloud Audit Logs via BigQuery. Use when investigating what resources or servic…
78B -
google-cloud-scc-query google/skills
Queries and retrieves active security findings, external exposures, toxic combinations, vulnerabilities, threats, and sensitive data risks from Security Command Center on Google C…
78B -
designing-adversary-engagement-with-mitre-engage mukul975/Anthropic-Cybersecurity-Skills
Plan, run, and measure an adversary engagement operation using the MITRE Engage framework so that deployed deception is driven by strategy instead of deployed ad hoc. Covers the E…
77B -
detecting-qr-code-phishing-with-email-security mukul975/Anthropic-Cybersecurity-Skills
Detect and prevent QR code phishing (quishing) attacks that embed malicious URLs inside QR code images to bypass link-based email security, using image-based threat detection, OCR…
77B -
implementing-security-monitoring-with-datadog mukul975/Anthropic-Cybersecurity-Skills
Implements security monitoring using Datadog Cloud SIEM, Cloud Security Management (CSM), and Workload Protection to detect threats, enforce compliance, and respond to security ev…
77B -
mapping-attack-paths-with-bloodhound-ce mukul975/Anthropic-Cybersecurity-Skills
Collect Active Directory data with SharpHound and Entra ID data with AzureHound, ingest into BloodHound Community Edition, and analyze on-prem, cloud, and hybrid attack paths usin…
77B -
detection-engineering-coverage-evaluation google/skills
Automates the end-to-end detection engineering workflow in Google SecOps using MCP tools. Use when fetching threat intelligence from blogs, generating Threat Detection Opportuniti…
77B -
iam-helper-for-privileged-access-management google/skills
Manages the end-to-end lifecycle of on-demand, temporary access using Privileged Access Manager (PAM). Use when a user asks to create, read, update, or delete PAM entitlements, re…
77B -
analyzing-apt-group-with-mitre-navigator mukul975/Anthropic-Cybersecurity-Skills
Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups' TTPs for…
76B -
detecting-ransomware-encryption-behavior mukul975/Anthropic-Cybersecurity-Skills
Detects ransomware encryption activity in real time using entropy analysis, file system I/O monitoring (Sysmon, watchdog, psutil), and behavioral scoring to identify mass file mod…
76B -
supply-chain-guard davila7/claude-code-templates
Detect and remediate software supply chain attacks in npm, PyPI, crates.io, GitHub Actions, and CI/CD pipelines by scanning for known compromised packages, malicious versions, fil…
76B -
deploying-cloud-deception-with-decoy-resources mukul975/Anthropic-Cybersecurity-Skills
Deploy cloud-native deception across AWS, Azure, and GCP using decoy (honey) resources whose only purpose is to generate a high-fidelity alert the instant an attacker touches them…
75B -
detecting-bluetooth-low-energy-attacks mukul975/Anthropic-Cybersecurity-Skills
Detects and analyzes Bluetooth Low Energy (BLE) security attacks including sniffing, replay attacks, GATT enumeration abuse, and Man-in-the-Middle interception. Uses Ubertooth One…
75B -
triaging-security-alerts-in-splunk mukul975/Anthropic-Cybersecurity-Skills
Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisi…
75B -
secops-triage google/skills
Expert guidance for security alert triage in Google SecOps. Use when investigating and triaging security alerts, determining false positives vs. true positives, assessing entity r…
75B -
analyzing-ransomware-payment-wallets mukul975/Anthropic-Cybersecurity-Skills
Traces ransomware cryptocurrency payment flows using blockchain analysis tools such as Chainalysis Reactor, WalletExplorer, and blockchain.com APIs, identifying wallet clusters an…
74B -
detecting-living-off-the-land-attacks mukul975/Anthropic-Cybersecurity-Skills
Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks. Monitors process creation, command-line arguments, and parent-child relationships to id…
74B -
detecting-ransomware-precursors-in-network mukul975/Anthropic-Cybersecurity-Skills
Detects early-stage ransomware indicators in network traffic before encryption begins, including initial access broker activity, command-and-control beaconing, credential harvesti…
74B -
implementing-attack-path-analysis-with-xm-cyber mukul975/Anthropic-Cybersecurity-Skills
Deploys XM Cyber's continuous exposure management platform to build attack graphs that chain vulnerabilities, misconfigurations, identity risks, and credential weaknesses toward c…
74B -
testing-ransomware-recovery-procedures mukul975/Anthropic-Cybersecurity-Skills
Tests and validates ransomware recovery procedures - backup restore operations (e.g. with Restic), RTO/RPO target verification, recovery sequencing, and clean-restore validation -…
74B -
tracking-threat-actor-infrastructure mukul975/Anthropic-Cybersecurity-Skills
Discovers and maps adversary-controlled infrastructure (C2 servers, phishing domains, exploit-kit hosts, bulletproof hosting) by pivoting across passive DNS, certificate transpare…
74B -
configuring-host-based-intrusion-detection mukul975/Anthropic-Cybersecurity-Skills
Configures host-based intrusion detection systems (HIDS) to monitor endpoint file integrity, system calls, and configuration changes for security violations. Use when deploying OS…
73B -
deploying-edr-agent-with-crowdstrike mukul975/Anthropic-Cybersecurity-Skills
Deploys and configures CrowdStrike Falcon EDR agents across enterprise endpoints to enable real-time threat detection, behavioral analysis, and automated response. Use when onboar…
73B -
detecting-entra-offensive-tools-in-graph-logs mukul975/Anthropic-Cybersecurity-Skills
Hunt AADGraphActivityLogs and MicrosoftGraphActivityLogs in Microsoft Sentinel/Log Analytics using KQL to fingerprint offensive Entra ID enumeration tools such as ROADtools, AADIn…
73B -
detecting-malicious-npm-packages mukul975/Anthropic-Cybersecurity-Skills
Triage npm packages and lockfiles for install-script malware, credential exfiltration, and worming behavior using GuardDog, manual tarball inspection, and dynamic detonation with…
73B -
detecting-process-injection-techniques mukul975/Anthropic-Cybersecurity-Skills
Detects and analyzes process injection techniques used by malware including classic DLL injection, process hollowing, APC injection, thread hijacking, and reflective loading. Uses…
73B -
detecting-spearphishing-with-email-gateway mukul975/Anthropic-Cybersecurity-Skills
Detect and block spearphishing emails that use personalized, researched content to evade generic spam filters, by configuring email security gateway (SEG) impersonation protection…
73B -
emulating-cloud-attacks-with-stratus-red-team mukul975/Anthropic-Cybersecurity-Skills
Install and run Stratus Red Team to detonate granular, MITRE ATT&CK-mapped AWS, Azure, GCP, and Kubernetes attack techniques through their warmup-detonate-revert-cleanup lifecycle…
73B -
implementing-taxii-server-with-opentaxii mukul975/Anthropic-Cybersecurity-Skills
Deploy and configure a TAXII 2.1 server (Medallion) with Docker, publish and consume STIX 2.1 bundles across collections, and integrate the feed with SIEM/SOAR platforms for autom…
73B -
managing-third-party-vendor-risk mukul975/Anthropic-Cybersecurity-Skills
Build and run a third-party/vendor risk management (TPRM) program aligned to NIST SP 800-161 C-SCRM: inventory and tier vendors, issue SIG/CAIQ questionnaires, review SOC 2/ISO 27…
73B -
performing-ai-driven-osint-correlation mukul975/Anthropic-Cybersecurity-Skills
Use AI/LLM-based reasoning with Sherlock, theHarvester, and SpiderFoot to correlate OSINT findings—usernames, emails, social profiles, domain records, breach databases, and dark-w…
73B -
performing-malware-hash-enrichment-with-virustotal mukul975/Anthropic-Cybersecurity-Skills
Enrich malware file hashes (MD5, SHA-1, SHA-256) using the VirusTotal API v3 to retrieve multi-engine detection rates, sandbox behavioral analysis, YARA rule matches, related indi…
73B -
performing-phishing-simulation-with-gophish mukul975/Anthropic-Cybersecurity-Skills
Deploy and run authorized phishing awareness campaigns with GoPhish, covering admin panel setup, SMTP sending profiles, email template and landing page creation, target user group…
73B -
deal-with-security-advisory paperclipai/paperclip
Handle confidential GitHub Security Advisory response for Paperclip. Use when coordinating advisory triage, private-fork fixes, CVE/publication steps, and immediate security relea…
72B -
analyzing-indicators-of-compromise mukul975/Anthropic-Cybersecurity-Skills
Analyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to determine maliciousness confidence, campaign attribution, and b…
72B -
analyzing-network-traffic-for-incidents mukul975/Anthropic-Cybersecurity-Skills
Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including command-and-control communications, lateral movement, data exfi…
72B -
analyzing-sbom-for-supply-chain-vulnerabilities mukul975/Anthropic-Cybersecurity-Skills
Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON formats to identify supply chain vulnerabilities by correlating components against the NVD CVE database via the…
72B -
building-phishing-reporting-button-workflow mukul975/Anthropic-Cybersecurity-Skills
Implement a phishing report button (Microsoft 365 built-in Report button or third-party like KnowBe4/Cofense) in email clients with a SOAR-driven automated triage workflow that cl…
72B -
detecting-business-email-compromise mukul975/Anthropic-Cybersecurity-Skills
Detect Business Email Compromise (BEC) fraud, where attackers impersonate executives or vendors to trick employees into wire transfers or data disclosure without malicious links,…
72B -
mapping-mitre-attack-techniques mukul975/Anthropic-Cybersecurity-Skills
Maps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and guide control prioritizati…
72B -
performing-cve-prioritization-with-kev-catalog mukul975/Anthropic-Cybersecurity-Skills
Fetch and parse the CISA Known Exploited Vulnerabilities (KEV) catalog, enrich it with EPSS scores and CVSS metrics, and build a multi-factor prioritization engine and report that…
72B -
performing-service-account-audit mukul975/Anthropic-Cybersecurity-Skills
Audit service accounts across enterprise infrastructure to identify orphaned, over-privileged, and non-compliant accounts. This skill covers discovery of service accounts in Activ…
72B -
fp-check trailofbits/skills
Systematically verifies suspected security bugs to eliminate false positives, producing a TRUE POSITIVE or FALSE POSITIVE verdict with documented evidence for each. Use when asked…
72B -
analyzing-malware-family-relationships-with-malpedia mukul975/Anthropic-Cybersecurity-Skills
Query the Malpedia API to look up malware family aliases and naming (platform.family_name), pull community/vendor YARA rules, link families to threat actors, and map family relati…
71B -
analyzing-threat-intelligence-feeds mukul975/Anthropic-Cybersecurity-Skills
Analyzes structured and unstructured threat intelligence feeds to extract actionable indicators, adversary tactics, and campaign context. Use when ingesting commercial or open-sou…
71B -
collecting-open-source-intelligence mukul975/Anthropic-Cybersecurity-Skills
Collects and synthesizes open-source intelligence (OSINT) about threat actors, malicious infrastructure, and attack campaigns using publicly available data sources, passive reconn…
71B -
configuring-snort-ids-for-intrusion-detection mukul975/Anthropic-Cybersecurity-Skills
Installs, configures, and tunes Snort 3 to monitor network traffic for malicious activity using custom and community rulesets, preprocessors, and alert output plugins. Use when de…
71B -
detecting-misconfigured-azure-storage mukul975/Anthropic-Cybersecurity-Skills
Audit Azure Storage accounts for public blob containers, missing encryption, overly permissive SAS tokens, disabled logging, and network access violations using Azure CLI, PowerSh…
71B -
detecting-rootkit-activity mukul975/Anthropic-Cybersecurity-Skills
Detects rootkit presence on compromised systems by identifying hidden processes, hooked system calls, modified kernel structures, and covert network connections using Volatility m…
71B -
detecting-secure-boot-bypass mukul975/Anthropic-Cybersecurity-Skills
Detect UEFI Secure Boot bypasses and bootkits such as BlackLotus and Bootkitty by verifying Secure Boot state, checking dbx revocation currency, and hashing EFI boot binaries agai…
71B -
detecting-typosquatting-packages-in-npm-pypi mukul975/Anthropic-Cybersecurity-Skills
Detects typosquatting attacks in npm and PyPI package registries by analyzing package name similarity using Levenshtein distance and other string metrics, examining publish date h…
71B -
hunting-evtx-with-chainsaw mukul975/Anthropic-Cybersecurity-Skills
Run Chainsaw against collected Windows EVTX files to hunt with the SigmaHQ rule corpus, built-in detection rules, and high-speed keyword/regex search, plus analyze shimcache, SRUM…
71B -
hunting-for-defense-evasion-via-timestomping mukul975/Anthropic-Cybersecurity-Skills
Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT. Uses analyzeMFT and Python to identify files with anom…
71B -
implementing-aws-security-hub mukul975/Anthropic-Cybersecurity-Skills
Deploy AWS Security Hub as a centralized CSPM platform, backed by AWS Config, aggregating findings from GuardDuty, Inspector, Macie, and third-party tools; enable CIS Foundations,…
71B -
implementing-threat-modeling-with-mitre-attack mukul975/Anthropic-Cybersecurity-Skills
Implements threat modeling using the MITRE ATT&CK framework to map adversary TTPs against organizational assets, assess detection coverage gaps, and prioritize defensive investmen…
71B -
monitoring-darkweb-sources mukul975/Anthropic-Cybersecurity-Skills
Monitors dark web forums, marketplaces, paste sites, and ransomware leak sites for mentions of organizational assets, leaked credentials, threatened attacks, and threat actor comm…
71B -
monitoring-scada-modbus-traffic-anomalies mukul975/Anthropic-Cybersecurity-Skills
Monitors Modbus TCP traffic on SCADA and ICS networks to detect anomalous function code usage, unauthorized register writes, and suspicious communication patterns. The analyst use…
71B -
performing-authenticated-vulnerability-scan mukul975/Anthropic-Cybersecurity-Skills
Plan and run authenticated (credentialed) vulnerability scans with scanners such as Nessus, Qualys, OpenVAS, or Rapid7 InsightVM, using SSH, SMB, WinRM, or SNMPv3 credentials to i…
71B -
performing-insider-threat-investigation mukul975/Anthropic-Cybersecurity-Skills
Investigates insider threat incidents involving employees, contractors, or trusted partners who misuse authorized access to steal data, sabotage systems, or violate security polic…
71B -
processing-stix-taxii-feeds mukul975/Anthropic-Cybersecurity-Skills
Processes STIX 2.1 threat intelligence bundles delivered via TAXII 2.1 servers, normalizing objects into platform-native schemas and routing them to appropriate consuming systems.…
71B -
google-cloud-scc-remediation google/skills
Remediates Google Cloud Security Command Center findings, including IAM permission fixes, cloud resource misconfigurations, vulnerabilities, and Toxic Combinations. Use when asked…
71B -
secops-cases google/skills
Manage Google Security Operations (SecOps) SOAR cases throughout their lifecycle. Use when listing, creating, inspecting, updating, or closing SOAR cases; adding investigative com…
71B -
building-detection-rules-with-sigma mukul975/Anthropic-Cybersecurity-Skills
Builds vendor-agnostic detection rules using the Sigma rule format for threat detection across SIEM platforms including Splunk, Elastic, and Microsoft Sentinel. Use when creating…
70B -
building-vulnerability-scanning-workflow mukul975/Anthropic-Cybersecurity-Skills
Builds a structured vulnerability scanning workflow using tools like Nessus, Qualys, and OpenVAS to discover, prioritize, and track remediation of security vulnerabilities across…
70B -
configuring-suricata-for-network-monitoring mukul975/Anthropic-Cybersecurity-Skills
Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for high-throughput, protocol-aware traffic inspection (HTTP, TLS, DNS,…
70B -
deploying-osquery-for-endpoint-monitoring mukul975/Anthropic-Cybersecurity-Skills
Deploys and configures osquery for real-time endpoint monitoring using SQL-based queries to inspect running processes, open ports, installed software, and system configuration. Us…
70B -
detecting-compromised-cloud-credentials mukul975/Anthropic-Cybersecurity-Skills
Detect compromised cloud credentials across AWS, Azure, and GCP by analyzing anomalous API activity, impossible-travel patterns, and credential-stuffing indicators using GuardDuty…
70B -
detecting-fileless-attacks-on-endpoints mukul975/Anthropic-Cybersecurity-Skills
Detects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk, evading traditional antivirus. Use when building detections f…
70B -
detecting-golden-ticket-attacks-in-kerberos-logs mukul975/Anthropic-Cybersecurity-Skills
Detect Golden Ticket attacks in Active Directory using Splunk and KQL queries against domain controller event logs, looking for Kerberos TGT anomalies such as mismatched encryptio…
70B -
detecting-mobile-malware-behavior mukul975/Anthropic-Cybersecurity-Skills
Detects and analyzes malicious behavior in mobile applications through behavioral analysis, permission abuse detection, network traffic monitoring, and dynamic instrumentation. Us…
70B -
detecting-model-extraction-attacks mukul975/Anthropic-Cybersecurity-Skills
Detect MITRE ATLAS AML.T0024 attacks (model stealing, inversion, membership inference) performed via inference-API abuse, by monitoring per-principal query volume/distribution, ra…
70B -
hunting-for-dcsync-attacks mukul975/Anthropic-Cybersecurity-Skills
Detect DCSync attacks (MITRE ATT&CK T1003.006) by analyzing Windows Event ID 4662 (AccessMask 0x100) for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All requests iss…
70B -
implementing-anti-phishing-training-program mukul975/Anthropic-Cybersecurity-Skills
Guides designing, deploying, and measuring an anti-phishing security awareness program - baseline phishing simulations, interactive training modules, just-in-time learning, and me…
70B -
implementing-dragos-platform-for-ot-monitoring mukul975/Anthropic-Cybersecurity-Skills
Deploys and configures Dragos Platform sensors and detection analytics for OT/ICS network monitoring, using industrial protocol parsers and threat-intel packs to detect groups lik…
70B -
implementing-patch-management-workflow mukul975/Anthropic-Cybersecurity-Skills
Patch management is the systematic process of identifying, testing, deploying, and verifying software updates to remediate vulnerabilities across an organization's IT infrastructu…
70B -
modeling-threats-with-opencti mukul975/Anthropic-Cybersecurity-Skills
Deploy OpenCTI (Filigran) via Docker Compose and use the pycti Python client to model threat actors, intrusion sets, campaigns, and indicators as a STIX 2.1 knowledge graph with r…
70B -
performing-entitlement-review-with-sailpoint-iiq mukul975/Anthropic-Cybersecurity-Skills
Runs entitlement review and access certification campaigns in SailPoint IdentityIQ, covering manager certifications, targeted entitlement reviews, role-based access validation, se…
70B -
performing-ioc-enrichment-automation mukul975/Anthropic-Cybersecurity-Skills
Automates Indicator of Compromise (IOC) enrichment by orchestrating lookups across VirusTotal, AbuseIPDB, Shodan, MISP, and other intelligence sources to provide contextual scorin…
70B -
incident-reporting-navigator davila7/claude-code-templates
Use when a security incident, data breach, or actively exploited vulnerability raises the question "who must we notify, where, and by when?" Screens one incident across the EU rep…
70B -
wireshark-analysis davila7/claude-code-templates
This skill should be used when the user asks to "analyze network traffic with Wireshark", "capture packets for troubleshooting", "filter PCAP files", "follow TCP/UDP streams", "de…
70B -
access-lifecycle alirezarezvani/claude-skills
Use when preparing or running a user access review, checking that leavers lost their access, finding orphaned or ownerless service accounts, answering an auditor's access-control…
70B -
vulnerability-triage-brocards trailofbits/skills
This skill should be used when the user asks to "triage a vulnerability report", "assess a CVE", "evaluate a bug bounty submission", "decide if a finding is valid", "review a secu…
70B
Scores come from a snapshot of 300 public GitHub repositories taken on 12 November 2026. Every score is the result of fixed checks run by code; no AI is involved. How scoring works.