Agent skills for Security

341 agent skills are labelled for Security work. They are listed by code score, out of 100.

The 200 highest-scoring

iap-agent-platform-troubleshooting google/skills
Diagnoses Identity-Aware Proxy (IAP) denials of outbound requests from Gemini Enterprise Agent Platform agents that run on Agent Runtime and send traffic through Agent Gateway. Us…

Verified96A
skill-scanner getsentry/skills
Scan agent skills for security issues. Use when asked to "scan a skill", "audit a skill", "review skill security", "check skill for injection", "validate SKILL.md", or assess whet…

Verified88A
google-cloud-solution-multi-agent-security google/skills
Designs, deploys, and secures Google Cloud Agent Gateway solutions. Use when the user needs to configure multi-agent security, ingress (CLIENT_TO_AGENT), or egress (AGENT_TO_ANYWH…

Verified87A
secops-detection-engineering google/skills
Author, validate, test, and deploy YARA-L 2.0 detection rules and evaluate end-to-end detection coverage gaps in Google SecOps. Use when writing new detection rules, tuning existi…

Verified87A
api-gateway-backend-security-and-rate-limiting google/skills
Secures and rate limits backend services behind Google Cloud API Gateway across OpenAPI 2.0 and OpenAPI 3.0.x API configurations, including MCP-enabled gateways. Use when configur…

Verified86A
google-cloud-recipe-foundation-builder google/skills
Deploys a baseline landing zone foundation for a Google Cloud Organization, establishing security guardrails using Organization Policies, resource hierarchy folders and projects,…

Verified85A
cvss-scoring trailofbits/skills
Produces CVSS v4.0 vector strings from plain-text vulnerability descriptions by systematically evaluating base metrics. Use when scoring a vulnerability, generating a CVSS vector,…

Verified85A
exploiting-adcs-with-certipy mukul975/Anthropic-Cybersecurity-Skills
Use Certipy to enumerate AD CS certificate authorities and templates over LDAP/RPC, then exploit ESC1-ESC16 misconfigurations - SAN abuse, NTLM relay to web enrollment (ESC8), Sha…

Verified84B
cloud-armor-crs-rule-upgrader google/skills
Upgrades Google Cloud Armor security policies from OWASP CRS 3.0 and 3.3 to OWASP CRS 4.22. Preserves signature opt-in and opt-out lists, translates evaluatePreconfiguredExpr to n…

Verified84B
google-cloud-filestore-auditing google/skills
Audits Filestore instances on Google Cloud across projects for disaster recovery readiness (missing or stale backups), security access governance (overly permissive NFS export rul…

Verified84B
cosmos-vulnerability-scanner trailofbits/skills
Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWas…

Verified84B
security-model getsentry/skills
Define, review, or update SECURITY_MODEL.md files that tell security review tools a repository's threat model, trust boundaries, invariants, reportable finding classes, and exclus…

Verified84B
codeql trailofbits/skills
Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "build codeql database…

Verified83B
auditing-tls-certificate-transparency-logs mukul975/Anthropic-Cybersecurity-Skills
Monitors Certificate Transparency (CT) logs to detect unauthorized certificate issuance, discover subdomains via CT data, and alert on suspicious certificate activity for owned do…

Verified82B
conducting-api-security-testing mukul975/Anthropic-Cybersecurity-Skills
Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic. The te…

Verified82B
detecting-container-runtime-threats-with-falco mukul975/Anthropic-Cybersecurity-Skills
Deploys and operates Falco with the modern eBPF driver in Kubernetes and Docker, covering driver selection, Helm installation, output channels, and the built-in ruleset that detec…

Verified82B
detecting-typosquatting-packages mukul975/Anthropic-Cybersecurity-Skills
Flag misspelled, brandjacked, and typosquatted package names across npm, PyPI, and crates.io before installation, using edit-distance, keyboard-proximity, and known-target corpus…

Verified82B
performing-access-review-and-certification mukul975/Anthropic-Cybersecurity-Skills
Designs and runs access review and certification campaigns-scoping, reviewer selection, risk-based prioritization, micro-certification, and remediation tracking-to verify user acc…

Verified82B
graph-evolution trailofbits/skills
Compares Trailmark code graphs at two source code snapshots (git commits, tags, or directories) to surface security-relevant structural changes. Detects new attack paths, complexi…

Verified82B
post-patch-validation trailofbits/skills
Validates security patches with reproducible baseline-versus-patched evidence, including original exploits, root-cause variants, behavior preservation, regressions, and newly intr…

Verified82B
semgrep trailofbits/skills
Runs a Semgrep security scan over a codebase: detects languages, selects rulesets, presents the plan for explicit approval, then runs every approved ruleset through scripts/run-sc…

Verified82B
supabase-rls-policies github/awesome-copilot
Write, review, and test Supabase Row Level Security (RLS) policies so that one user cannot read or change another user's rows. Use when creating or changing tables, policies, view…

Verified81B
assessing-vector-and-embedding-weaknesses mukul975/Anthropic-Cybersecurity-Skills
Test RAG vector stores (Pinecone, Qdrant, Weaviate, Chroma, pgvector, FAISS) for embedding inversion, cross-tenant data leakage, and data poisoning per OWASP LLM08:2025. Use when…

Verified81B
auditing-foundry-smart-contract-security mukul975/Anthropic-Cybersecurity-Skills
Pre-deployment security audit of Solidity smart contracts in a Foundry project. Combines static analysis (Slither, Aderyn), symbolic execution (Mythril), and property-based testin…

Verified81B
detecting-ai-model-prompt-injection-attacks mukul975/Anthropic-Cybersecurity-Skills
Detects prompt injection using regex signature matching, heuristic scoring for structural anomalies, and DeBERTa-based transformer classification, flagging direct injections (syst…

Verified81B
performing-binary-exploitation-analysis mukul975/Anthropic-Cybersecurity-Skills
Analyze ELF binaries for memory-corruption vulnerabilities and build proof-of-concept exploits using pwntools, checksec, and ROPgadget for buffer overflows and ROP chains. Use whe…

Verified81B
performing-vulnerability-scanning-with-nessus mukul975/Anthropic-Cybersecurity-Skills
Performs authenticated and unauthenticated vulnerability scanning using Tenable Nessus to identify known vulnerabilities, misconfigurations, default credentials, and missing patch…

Verified81B
env-secrets-manager alirezarezvani/claude-skills
Use when auditing .env files, planning credential rotation, chasing a missing env var in production or hardening a repo against leaked secrets. Scans for committed secrets and dri…

Verified81B
yara-rule-authoring trailofbits/skills
Guides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules. Covers naming conventions, string select…

Verified81B
mcp-implementation-security-review github/awesome-copilot
Review the implementation source code of MCP (Model Context Protocol) servers, clients, and tool handlers against a security baseline — authentication, sessions, rate limiting, in…

Verified80B
npm-trusted-publishing github/awesome-copilot
Set up or fix npm trusted publishing (OIDC) in GitHub Actions and remove NPM_TOKEN. Use for ENEEDAUTH, E404 on PUT, E422 repository.url, or migrating off 2FA-bypass tokens before…

Verified80B
analyzing-linux-audit-logs-for-intrusion mukul975/Anthropic-Cybersecurity-Skills
Uses the Linux Audit framework (auditd) with ausearch and aureport utilities to detect intrusion attempts, unauthorized access, privilege escalation, and suspicious system activit…

Verified80B
benchmarking-kubernetes-with-kube-bench mukul975/Anthropic-Cybersecurity-Skills
Installs and runs the kube-bench tool against a Kubernetes cluster as a Job, DaemonSet, or standalone binary, selecting the correct benchmark version and targets (control plane, e…

Verified80B
building-ransomware-playbook-with-cisa-framework mukul975/Anthropic-Cybersecurity-Skills
Builds a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST Cybersecurity Framework, covering preparation, detection, containment…

Verified80B
deploying-decoy-files-for-ransomware-detection mukul975/Anthropic-Cybersecurity-Skills
Deploys canary files (honeytokens) across file systems to detect ransomware encryption activity in real time. Uses strategically placed decoy documents monitored via file integrit…

Verified80B
detecting-lateral-movement-with-zeek mukul975/Anthropic-Cybersecurity-Skills
Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to iden…

Verified80B
implementing-anti-ransomware-group-policy mukul975/Anthropic-Cybersecurity-Skills
Configures Windows Group Policy Objects to block ransomware execution and lateral spread, covering AppLocker rules, Software Restriction Policies, Controlled Folder Access, attack…

Verified80B
implementing-security-information-sharing-with-stix2 mukul975/Anthropic-Cybersecurity-Skills
Create, validate, and share STIX 2.1 threat intelligence objects (indicators, malware, campaigns, relationships, bundles) using the stix2 Python library, and publish them over TAX…

Verified80B
performing-privileged-account-access-review mukul975/Anthropic-Cybersecurity-Skills
Conducts systematic reviews of privileged accounts to validate access rights, identify excessive or stale permissions, and enforce least privilege across PAM infrastructure. Use w…

Verified80B
performing-web-application-penetration-test mukul975/Anthropic-Cybersecurity-Skills
Performs systematic security testing of web applications following the OWASP Web Security Testing Guide (WSTG) methodology to identify vulnerabilities in authentication, authoriza…

Verified80B
validating-backup-integrity-for-recovery mukul975/Anthropic-Cybersecurity-Skills
Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for…

Verified80B
isms-audit-expert alirezarezvani/claude-skills
Use for ISO 27001 audit work: internal or surveillance audits, Annex A control evidence, Statement of Applicability, nonconformities, Stage 1 and 2 prep. Plans risk-based audits w…

Verified80B
soc2-compliance alirezarezvani/claude-skills
Use when the user asks to prepare for SOC 2 audits, map Trust Service Criteria, build control matrices, collect audit evidence, perform gap analysis, or assess SOC 2 Type I vs Typ…

Verified80B
crypto-protocol-diagram trailofbits/skills
Extracts protocol message flow from source code, RFCs, academic papers, pseudocode, informal prose, ProVerif (.pv), or Tamarin (.spthy) models and generates Mermaid sequenceDiagra…

Verified80B
sarif-parsing trailofbits/skills
Parses and processes SARIF files from static analysis tools like CodeQL, Semgrep, or other scanners. Triggers on "parse sarif", "read scan results", "aggregate findings", "dedupli…

Verified80B
testing-handbook-generator trailofbits/skills
Generates Claude Code skills from the Trail of Bits Testing Handbook (appsec.guide), analyzing handbook pages and emitting SKILL.md files with the structure each skill type requir…

Verified80B
cloudflare-one cloudflare/skills
Design, configure, troubleshoot, or review Cloudflare One Zero Trust and SASE deployments. Use cloudflare-one-migrations for migration planning from other vendors. Also use when a…

Verified80B
configuring-tls-1-3-for-secure-communications mukul975/Anthropic-Cybersecurity-Skills
Configures TLS 1.3 (RFC 8446) on servers, covering cipher suite and key-exchange group selection, and validates the resulting configuration with openssl s_client and testssl.sh. U…

79B
deploying-software-defined-perimeter mukul975/Anthropic-Cybersecurity-Skills
Deploys a Software-Defined Perimeter per the CSA v2.0 specification, configuring Single Packet Authorization, mutual TLS, and SDP controller/gateway components to enforce zero tru…

79B
exploiting-ms17-010-eternalblue-vulnerability mukul975/Anthropic-Cybersecurity-Skills
Detects and exploits MS17-010 (EternalBlue), a critical remote code execution flaw in Microsoft's SMBv1 implementation, using Nmap's ms-17-010 NSE script for detection and Metaspl…

79B
hunting-bootkits-in-efi-system-partition mukul975/Anthropic-Cybersecurity-Skills
Baseline the EFI System Partition and hunt malicious EFI binaries such as ESPecter, BlackLotus, Bootkitty, and Glupteba by mounting the ESP, hashing and verifying boot loaders, sc…

79B
implementing-ransomware-kill-switch-detection mukul975/Anthropic-Cybersecurity-Skills
Analyzes ransomware kill switch mechanisms, including mutex-based execution guards, domain-based kill switches (e.g. WannaCry-style), and registry termination checks, then impleme…

79B
implementing-supply-chain-security-with-in-toto mukul975/Anthropic-Cybersecurity-Skills
Implements supply chain integrity verification for container builds with the in-toto framework: generating signing keys, defining a supply chain layout, recording pipeline steps a…

79B
orchestrating-llm-attacks-with-pyrit mukul975/Anthropic-Cybersecurity-Skills
Build automated multi-turn adversarial attacks against conversational LLM targets using Microsoft PyRIT's RedTeamingOrchestrator, CrescendoOrchestrator (gradual escalation), and T…

79B
performing-access-recertification-with-saviynt mukul975/Anthropic-Cybersecurity-Skills
Configure and execute access recertification campaigns in Saviynt Enterprise Identity Cloud to validate user entitlements, revoke excessive access, and maintain compliance with SO…

79B
performing-cloud-native-threat-hunting-with-aws-detective mukul975/Anthropic-Cybersecurity-Skills
Investigate AWS security incidents using Amazon Detective's behavior graphs, built from CloudTrail, VPC Flow Logs, GuardDuty, and EKS audit logs, to trace entity timelines and pro…

79B
performing-post-quantum-cryptography-migration mukul975/Anthropic-Cybersecurity-Skills
Assesses organizational readiness for post-quantum cryptography migration per NIST FIPS 203/204/205 standards. Performs cryptographic inventory scanning to identify quantum-vulner…

79B
red-teaming-llms-with-garak mukul975/Anthropic-Cybersecurity-Skills
Runs NVIDIA garak probe suites (jailbreak, prompt injection, data leakage, toxicity, and more) against an LLM endpoint - Hugging Face models, OpenAI-compatible APIs, or Bedrock -…

79B
information-security-manager-iso27001 alirezarezvani/claude-skills
Use when designing or running an ISO 27001 ISMS in HealthTech or MedTech: risk assessment, control implementation, certification or security incidents. Assesses risk with risk_ass…

79B
oss-forensics NousResearch/hermes-agent
GitHub supply-chain forensics: recovery, IOCs, reporting.

78B
sherlock NousResearch/hermes-agent
Find accounts for a username across 400+ platforms.

78B
analyzing-typosquatting-domains-with-dnstwist mukul975/Anthropic-Cybersecurity-Skills
Generate domain permutations with dnstwist and check DNS resolution to detect typosquatting, homograph phishing, and brand impersonation domains registered against your organizati…

78B
analyzing-windows-amcache-artifacts mukul975/Anthropic-Cybersecurity-Skills
Parses the Windows Amcache.hve registry hive with Eric Zimmerman's AmcacheParser and Timeline Explorer to extract evidence of program execution, application installation, and driv…

78B
attacking-oauth-with-device-code-phishing mukul975/Anthropic-Cybersecurity-Skills
Run OAuth 2.0 device-code and illicit-consent phishing attacks against Microsoft Entra ID, using TokenTactics-style tooling to steal access and refresh tokens, bypass MFA, and piv…

78B
auditing-kubernetes-rbac-privilege-escalation mukul975/Anthropic-Cybersecurity-Skills
Finds over-permissive RBAC roles and service-account token abuse paths in a Kubernetes cluster using kubectl auth can-i, rbac-police, kubectl-who-can, and rakkess, tracing which s…

78B
configuring-oauth2-authorization-flow mukul975/Anthropic-Cybersecurity-Skills
Configures secure OAuth 2.0 authorization flows, including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant, covering flow selection, PKCE implemen…

78B
detecting-oauth-token-theft mukul975/Anthropic-Cybersecurity-Skills
Detect and respond to OAuth token theft and replay in Microsoft Entra ID (Azure AD), covering access token theft, refresh token replay, Primary Refresh Token (PRT) abuse, pass-the…

78B
implementing-continuous-security-validation-with-bas mukul975/Anthropic-Cybersecurity-Skills
Deploys Breach and Attack Simulation (BAS) platforms such as SafeBreach, AttackIQ, Picus, Cymulate, Pentera, or SCYTHE to continuously validate endpoint, network, email-gateway, S…

78B
implementing-dmarc-dkim-spf-email-security mukul975/Anthropic-Cybersecurity-Skills
Configures SPF, DKIM, and DMARC DNS TXT records to authenticate outbound email, prevent domain spoofing, and enforce a rejection/quarantine policy on unauthenticated mail, includi…

78B
implementing-privileged-access-management-with-cyberark mukul975/Anthropic-Cybersecurity-Skills
Deploy CyberArk Privileged Access Management to discover, vault, rotate, and monitor privileged credentials across enterprise infrastructure, covering vault architecture, session…

78B
readonly-sql-guard davila7/claude-code-templates
Make an agent's database access provably read-only. Use when an agent runs caller-supplied SQL against a production/ERP/analytics database (a "query" MCP tool, text-to-SQL, an adm…

78B
ai-security alirezarezvani/claude-skills
Use when assessing an AI/ML system or LLM agent for prompt injection, jailbreaks, model inversion, data poisoning or tool abuse. Maps findings to MITRE ATLAS and scores robustness…

78B
red-team alirezarezvani/claude-skills
Use when planning or running an authorized red team engagement or attack path analysis. Plans the kill chain with engagement_planner.py: MITRE ATT&CK techniques, choke points, OPS…

78B
agent-platform-access-audit google/skills
Audits AI agent data access, blast radius, and blocked policy operations in Google Cloud by querying Cloud Audit Logs via BigQuery. Use when investigating what resources or servic…

78B
gke-workload-identity google/skills
Configures and diagnoses Workload Identity Federation for GKE authentication failures for Pods (403 "iam.serviceAccounts.getAccessToken" / permission denied, "could not find defau…

78B
google-cloud-scc-query google/skills
Queries and retrieves active security findings, external exposures, toxic combinations, vulnerabilities, threats, and sensitive data risks from Security Command Center on Google C…

78B
mermaid-to-proverif trailofbits/skills
Translates Mermaid sequenceDiagrams describing cryptographic protocols into ProVerif formal verification models (.pv files). Use when generating a ProVerif model, formally verifyi…

78B
rust-review trailofbits/skills
Performs comprehensive Rust security review for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS, FFI safety, and async runtime…

78B
agent-security-hardening affaan-m/ECC
Security hardening guidance for AI agent frameworks that process untrusted content, invoke tools, write workspace files, manage runtime identifiers, or handle credentials. Use whe…

77B
abusing-dpapi-for-credential-access mukul975/Anthropic-Cybersecurity-Skills
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome,…

77B
configuring-microsegmentation-for-zero-trust mukul975/Anthropic-Cybersecurity-Skills
Configures microsegmentation policies to enforce least-privilege workload-to-workload access using tools such as VMware NSX, Illumio, and Calico, preventing lateral movement in ze…

77B
defending-llms-with-guardrails mukul975/Anthropic-Cybersecurity-Skills
Deploys Llama Guard 3 safety classification, NeMo Guardrails programmable dialogue rails, and LLM Guard input/output scanner pipelines as complementary runtime defenses that inspe…

77B
designing-adversary-engagement-with-mitre-engage mukul975/Anthropic-Cybersecurity-Skills
Plan, run, and measure an adversary engagement operation using the MITRE Engage framework so that deployed deception is driven by strategy instead of deployed ad hoc. Covers the E…

77B
detecting-container-drift-at-runtime mukul975/Anthropic-Cybersecurity-Skills
Detects unauthorized runtime drift in containers by monitoring binary execution, filesystem changes, and configuration deviation from the original immutable image, using Falco and…

77B
detecting-dependency-confusion mukul975/Anthropic-Cybersecurity-Skills
Detect and prevent dependency confusion (public-over-private package name resolution) in npm, PyPI, and Maven by enumerating claimable internal package names with tools like `conf…

77B
detecting-qr-code-phishing-with-email-security mukul975/Anthropic-Cybersecurity-Skills
Detect and prevent QR code phishing (quishing) attacks that embed malicious URLs inside QR code images to bypass link-based email security, using image-based threat detection, OCR…

77B
escaping-containers-to-host mukul975/Anthropic-Cybersecurity-Skills
Exploits privileged pods, host mounts, runC CVEs, and exposed Docker sockets to break out of a container and reach the underlying host during an authorized container-security asse…

77B
exploiting-deeplink-vulnerabilities mukul975/Anthropic-Cybersecurity-Skills
Tests and exploits deep link (URL scheme and App Link) vulnerabilities in Android and iOS mobile applications to identify unauthorized access, data injection, intent hijacking, an…

77B
implementing-azure-ad-privileged-identity-management mukul975/Anthropic-Cybersecurity-Skills
Configure Microsoft Entra Privileged Identity Management (PIM) to convert standing privileged assignments into eligible, time-bound roles requiring justification, MFA, and approva…

77B
implementing-security-monitoring-with-datadog mukul975/Anthropic-Cybersecurity-Skills
Implements security monitoring using Datadog Cloud SIEM, Cloud Security Management (CSM), and Workload Protection to detect threats, enforce compliance, and respond to security ev…

77B
mapping-attack-paths-with-bloodhound-ce mukul975/Anthropic-Cybersecurity-Skills
Collect Active Directory data with SharpHound and Entra ID data with AzureHound, ingest into BloodHound Community Edition, and analyze on-prem, cloud, and hybrid attack paths usin…

77B
testing-for-system-prompt-leakage mukul975/Anthropic-Cybersecurity-Skills
Extracts LLM system prompts using direct requests, jailbreak/instruction-override framing, translation/encoding tricks, and few-shot replay, combining manual payloads with automat…

77B
detection-engineering-coverage-evaluation google/skills
Automates the end-to-end detection engineering workflow in Google SecOps using MCP tools. Use when fetching threat intelligence from blogs, generating Threat Detection Opportuniti…

77B
iam-helper-for-privileged-access-management google/skills
Manages the end-to-end lifecycle of on-demand, temporary access using Privileged Access Manager (PAM). Use when a user asks to create, read, update, or delete PAM entitlements, re…

77B
penetration-testing-with-strix usestrix/strix
Pentest a web app, API, codebase, repository, URL, domain, or IP with Strix — autonomous AI penetration testing that exploits and proves vulnerabilities (OWASP Top 10 and beyond —…

76B
tm7-threat-model github/awesome-copilot
Creates valid Microsoft Threat Modeling Tool (.tm7) files compatible with the Microsoft Threat Modeling Tool v7.3+. Use this skill whenever asked to create, generate, or modify a…

76B
analyzing-apt-group-with-mitre-navigator mukul975/Anthropic-Cybersecurity-Skills
Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups' TTPs for…

76B
detecting-ransomware-encryption-behavior mukul975/Anthropic-Cybersecurity-Skills
Detects ransomware encryption activity in real time using entropy analysis, file system I/O monitoring (Sysmon, watchdog, psutil), and behavioral scoring to identify mass file mod…

76B
supply-chain-guard davila7/claude-code-templates
Detect and remediate software supply chain attacks in npm, PyPI, crates.io, GitHub Actions, and CI/CD pipelines by scanning for known compromised packages, malicious versions, fil…

76B
assuredworkloads-frameworks-author google/skills
Authors custom cloud controls and customized frameworks for Assured Workloads when built-in resources cannot satisfy core requirements. Use when creating or synthesizing custom da…

76B
firebase-security-rules-auditor firebase/agent-skills
Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type saf…

76B
auditing-entra-id-with-aadinternals mukul975/Anthropic-Cybersecurity-Skills
Drive the AADInternals PowerShell toolkit to perform Microsoft Entra ID tenant reconnaissance, access-token acquisition across Microsoft APIs, and federation/AD FS backdoor testin…

75B
coercing-authentication-with-coercer-petitpotam mukul975/Anthropic-Cybersecurity-Skills
Trigger machine account authentication with PetitPotam (MS-EFSR) and Coercer (MS-RPRN, MS-DFSNM, MS-FSRVP, MS-EVEN) via Coercer's scan/coerce/fuzz modes, feeding the coerced NTLM…

75B
deploying-cloud-deception-with-decoy-resources mukul975/Anthropic-Cybersecurity-Skills
Deploy cloud-native deception across AWS, Azure, and GCP using decoy (honey) resources whose only purpose is to generate a high-fidelity alert the instant an attacker touches them…

75B
detecting-bluetooth-low-energy-attacks mukul975/Anthropic-Cybersecurity-Skills
Detects and analyzes Bluetooth Low Energy (BLE) security attacks including sniffing, replay attacks, GATT enumeration abuse, and Man-in-the-Middle interception. Uses Ubertooth One…

75B
enumerating-cloud-with-cloudfox mukul975/Anthropic-Cybersecurity-Skills
Run CloudFox's read-only Describe/List/Get enumeration (all-checks, role-trusts, secrets, endpoints, and permissions commands) to map AWS and Azure attack paths and surface exploi…

75B
exploiting-nopac-cve-2021-42278-42287 mukul975/Anthropic-Cybersecurity-Skills
Exploits the noPac Active Directory privilege-escalation chain (CVE-2021-42278 sAMAccountName spoofing plus CVE-2021-42287 KDC PAC confusion) using Impacket and secretsdump.py to…

75B
implementing-aes-encryption-for-data-at-rest mukul975/Anthropic-Cybersecurity-Skills
Guides implementing AES-256 encryption in GCM mode (FIPS 197) for files and data stores at rest, covering key derivation, IV/nonce management, and authenticated encryption. Use wh…

75B
implementing-aws-iam-permission-boundaries mukul975/Anthropic-Cybersecurity-Skills
Configures AWS IAM permission boundaries that cap the maximum permissions an identity-based policy can grant to a user or role, so effective permissions are the intersection of th…

75B
performing-ssl-certificate-lifecycle-management mukul975/Anthropic-Cybersecurity-Skills
Automates the full SSL/TLS certificate lifecycle, including generating Certificate Signing Requests, issuing, deploying, monitoring, renewing, and revoking X.509 certificates, usi…

75B
testing-oauth2-implementation-flaws mukul975/Anthropic-Cybersecurity-Skills
Tests OAuth 2.0 and OpenID Connect implementations for authorization code interception, redirect URI manipulation, CSRF in OAuth flows, token leakage, scope escalation, and PKCE b…

75B
triaging-security-alerts-in-splunk mukul975/Anthropic-Cybersecurity-Skills
Triages security alerts in Splunk Enterprise Security by classifying severity, investigating notable events, correlating related telemetry, and making escalation or closure decisi…

75B
secops-triage google/skills
Expert guidance for security alert triage in Google SecOps. Use when investigating and triaging security alerts, determining false positives vs. true positives, assessing entity r…

75B
android-permissions-security android/skills
Audits, detects gaps, and remediates Android permissions and IPC component security vulnerabilities. Use when reviewing AndroidManifest.xml, defining custom permissions, securing…

75B
convex-authz openclaw/clawhub
Audit and harden a Convex app's authorization: identity-from-arg impersonation, missing per-document ownership checks, public queries leaking data by a client-supplied id, and wri…

75B
gha-security-review getsentry/skills
GitHub Actions security review for workflow exploitation vulnerabilities. Use when asked to "review GitHub Actions", "audit workflows", "check CI security", "GHA security", "workf…

75B
security-and-hardening addyosmani/agent-skills
Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or…

74B
case-review zhaoxuya520/reverse-skill
Reviews a reverse-skill case package for scope readiness, Evidence to Finding to Path traceability, work item coverage, timeline references, and optional artifact hash integrity b…

74B
agent-owasp-compliance github/awesome-copilot
Check any AI agent codebase against the OWASP Agentic Security Initiative (ASI) Top 10 risks. Use this skill when: - Evaluating an agent system's security posture before productio…

74B
analyzing-linux-elf-malware mukul975/Anthropic-Cybersecurity-Skills
Analyze malicious Linux ELF binaries — botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure — through static analysis, dyn…

74B
analyzing-packed-malware-with-upx-unpacker mukul975/Anthropic-Cybersecurity-Skills
Identifies and unpacks UPX-packed malware samples, including binaries with modified UPX magic bytes or headers that block automated decompression, to recover the original executab…

74B
analyzing-ransomware-encryption-mechanisms mukul975/Anthropic-Cybersecurity-Skills
Analyzes encryption algorithms, key management, and file encryption routines used by ransomware families to assess decryption feasibility, identify implementation weaknesses, and…

74B
analyzing-ransomware-payment-wallets mukul975/Anthropic-Cybersecurity-Skills
Traces ransomware cryptocurrency payment flows using blockchain analysis tools such as Chainalysis Reactor, WalletExplorer, and blockchain.com APIs, identifying wallet clusters an…

74B
analyzing-uefi-bootkit-persistence mukul975/Anthropic-Cybersecurity-Skills
Analyzes UEFI bootkit persistence (SPI flash implants, ESP modifications, Secure Boot bypass, UEFI variable manipulation) using chipsec for firmware integrity verification, detect…

74B
building-role-mining-for-rbac-optimization mukul975/Anthropic-Cybersecurity-Skills
Apply bottom-up and top-down role mining techniques, including clustering algorithms and formal concept analysis, to discover optimal RBAC roles from existing user-permission assi…

74B
detecting-living-off-the-land-attacks mukul975/Anthropic-Cybersecurity-Skills
Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks. Monitors process creation, command-line arguments, and parent-child relationships to id…

74B
detecting-ransomware-precursors-in-network mukul975/Anthropic-Cybersecurity-Skills
Detects early-stage ransomware indicators in network traffic before encryption begins, including initial access broker activity, command-and-control beaconing, credential harvesti…

74B
implementing-api-gateway-security-controls mukul975/Anthropic-Cybersecurity-Skills
Configures API gateways such as Kong, AWS API Gateway, Azure APIM, or Apigee as a centralized security enforcement point, covering authentication enforcement, rate limiting and th…

74B
implementing-attack-path-analysis-with-xm-cyber mukul975/Anthropic-Cybersecurity-Skills
Deploys XM Cyber's continuous exposure management platform to build attack graphs that chain vulnerabilities, misconfigurations, identity risks, and credential weaknesses toward c…

74B
implementing-image-provenance-verification-with-cosign mukul975/Anthropic-Cybersecurity-Skills
Signs and verifies container image provenance with Sigstore Cosign, covering key-based and keyless OIDC signing (Fulcio, Rekor transparency log), SLSA attestations, and enforcing…

74B
implementing-zero-trust-network-access-with-zscaler mukul975/Anthropic-Cybersecurity-Skills
Configures Zero Trust Network Access using Zscaler Private Access (ZPA) to broker identity-based, context-aware connections between authenticated users and internal applications t…

74B
migrating-to-post-quantum-cryptography mukul975/Anthropic-Cybersecurity-Skills
Build a cryptographic inventory/CBOM with OpenSSL 3.5+, deploy hybrid post-quantum key exchange (X25519MLKEM768) on TLS/VPN/SSH endpoints, generate ML-KEM/ML-DSA keys and PQC/hybr…

74B
performing-firmware-malware-analysis mukul975/Anthropic-Cybersecurity-Skills
Analyzes firmware images for embedded malware, backdoors, and unauthorized modifications in routers, IoT devices, UEFI/BIOS, and embedded systems, covering firmware extraction, fi…

74B
performing-kubernetes-cis-benchmark-with-kube-bench mukul975/Anthropic-Cybersecurity-Skills
Turns kube-bench output into a finished CIS Kubernetes Benchmark audit: interpreting PASS/FAIL/WARN per control, judging which failures are genuine on a managed cluster, writing r…

74B
post-exploiting-microsoft-graph-with-graphrunner mukul975/Anthropic-Cybersecurity-Skills
Runs GraphRunner, a PowerShell post-exploitation toolset built on the Microsoft Graph API, to perform tenant recon, establish persistence (OAuth app injection, inbox rules), escal…

74B
testing-api-for-mass-assignment-vulnerability mukul975/Anthropic-Cybersecurity-Skills
Tests APIs for mass assignment (auto-binding), OWASP API3:2023, by identifying writable endpoints, adding undocumented fields to request bodies (role, isAdmin, price, balance), an…

74B
testing-ransomware-recovery-procedures mukul975/Anthropic-Cybersecurity-Skills
Tests and validates ransomware recovery procedures - backup restore operations (e.g. with Restic), RTO/RPO target verification, recovery sequencing, and clean-restore validation -…

74B
tracking-threat-actor-infrastructure mukul975/Anthropic-Cybersecurity-Skills
Discovers and maps adversary-controlled infrastructure (C2 servers, phishing domains, exploit-kit hosts, bulletproof hosting) by pivoting across passive DNS, certificate transpare…

74B
validating-tpm-measured-boot-attestation mukul975/Anthropic-Cybersecurity-Skills
Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes…

74B
secrets-vault-manager alirezarezvani/claude-skills
Use when setting up HashiCorp Vault, AWS Secrets Manager, Azure Key Vault or GCP Secret Manager, rotating secrets or auditing secret access. Generates config with vault_config_gen…

74B
gke-workload-security google/skills
Audits, configures, and hardens workload-level security controls for Google Kubernetes Engine (GKE) applications and namespaces. Covers running security audits (`audit_cluster.sh`…

74B
trailmark-structural trailofbits/skills
Runs full Trailmark structural analysis by building a graph, running `preanalysis()`, and reporting hotspots, taint, blast radius, privilege boundaries, attack surface, and versio…

74B
vector-forge trailofbits/skills
Mutation-driven test vector generation. Finds implementations of a cryptographic algorithm or protocol, runs mutation testing to identify escaped mutants, then generates new test…

74B
zeroize-audit trailofbits/skills
Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis, and control-flow verificat…

74B
cloudflare-one-migrations cloudflare/skills
Assess and plan migrations from existing VPN, SWG, or SASE platforms to Cloudflare One, including policy mapping, parity gaps, and rollout.

74B
security-bounty-hunter affaan-m/ECC
Hunt for exploitable, bounty-worthy security issues in repositories. Focuses on remotely reachable vulnerabilities that qualify for real reports instead of noisy local-only findin…

73B
1password NousResearch/hermes-agent
Set up op CLI, sign in, and read or inject secrets.

73B
security-research code-yeongyu/oh-my-openagent
Team Mode security research skill. Orchestrates 3 vulnerability hunters and 2 PoC engineers to audit a codebase in parallel, prove exploitability, classify root causes, and calibr…

73B
ida-reverse zhaoxuya520/reverse-skill
IDA Pro 逆向分析辅助技能。当用户提到逆向、反编译、分析二进制/PE/ELF/APK/DLL/SO、破解、找密码、漏洞分析、病毒分析、firmware 固件分析，或需要分析 exe/dll/so/elf/macho/sys 等文件时，务必使用此技能。 Ensure to use this skill when the user wants to an…

73B
security-review github/awesome-copilot
AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities th…

73B
conducting-pass-the-ticket-attack mukul975/Anthropic-Cybersecurity-Skills
Perform Pass-the-Ticket (PtT) lateral movement by extracting Kerberos TGT/TGS tickets from LSASS memory on a compromised host and injecting them into another session to impersonat…

73B
configuring-host-based-intrusion-detection mukul975/Anthropic-Cybersecurity-Skills
Configures host-based intrusion detection systems (HIDS) to monitor endpoint file integrity, system calls, and configuration changes for security violations. Use when deploying OS…

73B
deploying-edr-agent-with-crowdstrike mukul975/Anthropic-Cybersecurity-Skills
Deploys and configures CrowdStrike Falcon EDR agents across enterprise endpoints to enable real-time threat detection, behavioral analysis, and automated response. Use when onboar…

73B
detecting-entra-offensive-tools-in-graph-logs mukul975/Anthropic-Cybersecurity-Skills
Hunt AADGraphActivityLogs and MicrosoftGraphActivityLogs in Microsoft Sentinel/Log Analytics using KQL to fingerprint offensive Entra ID enumeration tools such as ROADtools, AADIn…

73B
detecting-malicious-npm-packages mukul975/Anthropic-Cybersecurity-Skills
Triage npm packages and lockfiles for install-script malware, credential exfiltration, and worming behavior using GuardDog, manual tarball inspection, and dynamic detonation with…

73B
detecting-process-injection-techniques mukul975/Anthropic-Cybersecurity-Skills
Detects and analyzes process injection techniques used by malware including classic DLL injection, process hollowing, APC injection, thread hijacking, and reflective loading. Uses…

73B
detecting-spearphishing-with-email-gateway mukul975/Anthropic-Cybersecurity-Skills
Detect and block spearphishing emails that use personalized, researched content to evade generic spam filters, by configuring email security gateway (SEG) impersonation protection…

73B
emulating-cloud-attacks-with-stratus-red-team mukul975/Anthropic-Cybersecurity-Skills
Install and run Stratus Red Team to detonate granular, MITRE ATT&CK-mapped AWS, Azure, GCP, and Kubernetes attack techniques through their warmup-detonate-revert-cleanup lifecycle…

73B
exploiting-aws-with-pacu mukul975/Anthropic-Cybersecurity-Skills
Runs the Pacu AWS exploitation framework end-to-end — session and credential setup, IAM enumeration, automated privilege-escalation scanning via iam__privesc_scan, and persistence…

73B
exploiting-vulnerabilities-with-metasploit-framework mukul975/Anthropic-Cybersecurity-Skills
Uses the Metasploit Framework (msfconsole and its exploit, auxiliary, and post-exploitation modules) to validate that identified CVEs and vulnerabilities are actually exploitable,…

73B
implementing-llm-guardrails-for-security mukul975/Anthropic-Cybersecurity-Skills
Implements input/output validation guardrails for LLM applications using NVIDIA NeMo Guardrails (Colang), custom Python validators for PII detection, and the Guardrails AI framewo…

73B
implementing-next-generation-firewall-with-palo-alto mukul975/Anthropic-Cybersecurity-Skills
Configures and deploys Palo Alto Networks next-generation firewalls end-to-end, covering App-ID application-aware policies, User-ID identity-based enforcement, zone-based security…

73B
implementing-taxii-server-with-opentaxii mukul975/Anthropic-Cybersecurity-Skills
Deploy and configure a TAXII 2.1 server (Medallion) with Docker, publish and consume STIX 2.1 bundles across collections, and integrate the feed with SIEM/SOAR platforms for autom…

73B
integrating-sast-into-github-actions-pipeline mukul975/Anthropic-Cybersecurity-Skills
Integrates CodeQL and Semgrep SAST scanning into GitHub Actions, covering scans on pull requests/pushes, rule tuning to cut false positives, SARIF upload to GitHub Advanced Securi…

73B
managing-third-party-vendor-risk mukul975/Anthropic-Cybersecurity-Skills
Build and run a third-party/vendor risk management (TPRM) program aligned to NIST SP 800-161 C-SCRM: inventory and tier vendors, issue SIG/CAIQ questionnaires, review SOC 2/ISO 27…

73B
performing-ai-driven-osint-correlation mukul975/Anthropic-Cybersecurity-Skills
Use AI/LLM-based reasoning with Sherlock, theHarvester, and SpiderFoot to correlate OSINT findings—usernames, emails, social profiles, domain records, breach databases, and dark-w…

73B
performing-dmarc-policy-enforcement-rollout mukul975/Anthropic-Cybersecurity-Skills
Execute a phased DMARC rollout by inventorying sending sources, configuring SPF/DKIM alignment, and progressing DNS policy from p=none monitoring through p=quarantine to p=reject…

73B
performing-kerberoasting-attack mukul975/Anthropic-Cybersecurity-Skills
Perform Kerberoasting, a post-exploitation technique that enumerates Active Directory service accounts with Service Principal Names (SPNs), requests their Kerberos TGS tickets, an…

73B
performing-kubernetes-penetration-testing mukul975/Anthropic-Cybersecurity-Skills
Evaluates Kubernetes cluster security by actively simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policy, and secrets, using kube-hunter,…

73B
performing-malware-hash-enrichment-with-virustotal mukul975/Anthropic-Cybersecurity-Skills
Enrich malware file hashes (MD5, SHA-1, SHA-256) using the VirusTotal API v3 to retrieve multi-engine detection rates, sandbox behavioral analysis, YARA rule matches, related indi…

73B
performing-phishing-simulation-with-gophish mukul975/Anthropic-Cybersecurity-Skills
Deploy and run authorized phishing awareness campaigns with GoPhish, covering admin panel setup, SMTP sending profiles, email template and landing page creation, target user group…

73B
relaying-ntlm-for-adcs-esc8 mukul975/Anthropic-Cybersecurity-Skills
Uses Impacket's ntlmrelayx.py with a coercion tool (PetitPotam, Coercer, printerbug) to relay NTLM authentication from a coerced domain controller into the AD CS HTTP web-enrollme…

73B
reverse-engineering-dotnet-malware-with-dnspy mukul975/Anthropic-Cybersecurity-Skills
Reverse engineers .NET malware samples using the dnSpy decompiler and debugger to read C#/VB.NET source, deobfuscate code protected by tools like ConfuserEx or SmartAssembly, and…

73B
pentest-checklist davila7/claude-code-templates
This skill should be used when the user asks to "plan a penetration test", "create a security assessment checklist", "prepare for penetration testing", "define pentest scope", "fo…

73B
skill-inspector NVIDIA/SkillSpector
Review AI agent skills before installation using NVIDIA SkillSpector and source-aware semantic review. Use when asked whether a skill or downloaded skill folder is safe, trustwort…

73B
android-intent-security android/skills
Audits, detects, and remediates Android Intent and component security vulnerabilities. Use this skill when auditing component configurations in AndroidManifest.xml (activities, se…

73B
sharp-edges trailofbits/skills
Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes. Use when reviewing API designs, configuration schemas, cryptographic libr…

73B
deal-with-security-advisory paperclipai/paperclip
Handle confidential GitHub Security Advisory response for Paperclip. Use when coordinating advisory triage, private-fork fixes, CVE/publication steps, and immediate security relea…

72B
radare2 zhaoxuya520/reverse-skill
Use this skill whenever the user wants to analyze binaries with radare2/r2 from the command line, including reverse engineering, disassembly, function analysis, strings/import ins…

72B
analyzing-indicators-of-compromise mukul975/Anthropic-Cybersecurity-Skills
Analyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to determine maliciousness confidence, campaign attribution, and b…

72B
analyzing-network-traffic-for-incidents mukul975/Anthropic-Cybersecurity-Skills
Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including command-and-control communications, lateral movement, data exfi…

72B
analyzing-sbom-for-supply-chain-vulnerabilities mukul975/Anthropic-Cybersecurity-Skills
Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON formats to identify supply chain vulnerabilities by correlating components against the NVD CVE database via the…

72B
building-phishing-reporting-button-workflow mukul975/Anthropic-Cybersecurity-Skills
Implement a phishing report button (Microsoft 365 built-in Report button or third-party like KnowBe4/Cofense) in email clients with a SOAR-driven automated triage workflow that cl…

72B
conducting-mobile-app-penetration-test mukul975/Anthropic-Cybersecurity-Skills
Conducts penetration testing of iOS and Android mobile applications following the OWASP Mobile Application Security Testing Guide (MASTG) to identify vulnerabilities in data stora…

72B
detecting-business-email-compromise mukul975/Anthropic-Cybersecurity-Skills
Detect Business Email Compromise (BEC) fraud, where attackers impersonate executives or vendors to trick employees into wire transfers or data disclosure without malicious links,…

72B
executing-red-team-exercise mukul975/Anthropic-Cybersecurity-Skills
Run a stealthy, MITRE ATT&CK-mapped adversary emulation against an organization's people, processes, and technology, using C2 infrastructure (Cobalt Strike, Sliver, Brute Ratel, M…

72B
exploiting-constrained-delegation-abuse mukul975/Anthropic-Cybersecurity-Skills
Exploits Kerberos Constrained Delegation misconfigurations in Active Directory using Impacket's findDelegation.py and getST.py (or Rubeus/Kekeo on Windows) to abuse S4U2Self and S…

72B
exploiting-prototype-pollution-in-javascript mukul975/Anthropic-Cybersecurity-Skills
Detects and exploits JavaScript prototype pollution vulnerabilities in client-side and server-side (Node.js) applications to achieve XSS, RCE, or authentication bypass through pro…

72B
implementing-google-workspace-phishing-protection mukul975/Anthropic-Cybersecurity-Skills
Configures Google Workspace advanced phishing and malware protection settings in the Admin Console — pre-delivery message scanning, attachment protection, spoofing/impersonation d…

72B
implementing-google-workspace-sso-configuration mukul975/Anthropic-Cybersecurity-Skills
Configures SAML 2.0 single sign-on for Google Workspace against a third-party identity provider (Okta, Azure AD/Entra ID, ADFS), with Workspace as the Service Provider, to central…

72B
implementing-hipaa-security-rule-safeguards mukul975/Anthropic-Cybersecurity-Skills
Implement the HIPAA Security Rule (45 CFR Part 164 Subpart C) to protect electronic protected health information (ePHI): conduct the required risk analysis, deploy the administrat…

72B
implementing-kubernetes-network-policy-with-calico mukul975/Anthropic-Cybersecurity-Skills
Installs Calico as the cluster CNI and writes standard Kubernetes NetworkPolicy under it, covering default-deny baselines, policy ordering and precedence, service-account-based se…

72B
implementing-network-access-control mukul975/Anthropic-Cybersecurity-Skills
Implements 802.1X port-based network access control using RADIUS authentication, PacketFence NAC, and switch configuration to enforce identity-based access policies, posture asses…

72B
implementing-opa-gatekeeper-for-policy-enforcement mukul975/Anthropic-Cybersecurity-Skills
Deploys OPA Gatekeeper via Helm as a Kubernetes admission controller and writes ConstraintTemplates with Rego plus instantiated Constraints to validate, mutate, or deny resource r…

72B
implementing-proofpoint-email-security-gateway mukul975/Anthropic-Cybersecurity-Skills
Deploy and configure Proofpoint Email Protection as a secure email gateway to detect and block phishing, malware, BEC, and spam before messages reach user inboxes.

72B
implementing-scim-provisioning-with-okta mukul975/Anthropic-Cybersecurity-Skills
Implement automated user lifecycle provisioning and deprovisioning using the SCIM 2.0 protocol with Okta as the identity provider. Use when automating account creation, attribute…

72B
mapping-mitre-attack-techniques mukul975/Anthropic-Cybersecurity-Skills
Maps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and guide control prioritizati…

72B
performing-cve-prioritization-with-kev-catalog mukul975/Anthropic-Cybersecurity-Skills
Fetch and parse the CISA Known Exploited Vulnerabilities (KEV) catalog, enrich it with EPSS scores and CVSS metrics, and build a multi-factor prioritization engine and report that…

72B
performing-service-account-audit mukul975/Anthropic-Cybersecurity-Skills
Audit service accounts across enterprise infrastructure to identify orphaned, over-privileged, and non-compliant accounts. This skill covers discovery of service accounts in Activ…

72B
broken-authentication davila7/claude-code-templates
This skill should be used when the user asks to "test for broken authentication vulnerabilities", "assess session management security", "perform credential stuffing tests", "evalu…

72B

Scores come from a snapshot of 300 public GitHub repositories taken on 12 November 2026. Every score is the result of fixed checks run by code; no AI is involved. How scoring works.