---
title: "Anthropic-Cybersecurity-Skills"
type: "tool"
slug: "mukul975-anthropic-cybersecurity-skills"
canonical_url: "https://www.graphcanon.com/tools/mukul975-anthropic-cybersecurity-skills"
github_url: "https://github.com/mukul975/Anthropic-Cybersecurity-Skills"
homepage_url: "https://mahipal.engineer/Anthropic-Cybersecurity-Skills/"
stars: 24853
forks: 2841
primary_language: "Python"
license: "Apache-2.0"
categories: ["ai-agents", "developer-tools"]
tags: ["incident-response", "cybersecurity", "ethical-hacking", "infosec", "claude-code", "ai-agents", "cloud-security", "devsecops"]
updated_at: "2026-07-07T18:24:26.374756+00:00"
---
# Anthropic-Cybersecurity-Skills
> Repository for cybersecurity skills mapped to multiple frameworks with support for various AI platforms
Mukul975/Anthropic-Cybersecurity-Skills provides over 817 structured cybersecurity skills across 29 domains, aligned with MITRE ATT&CK, NIST CSF, D3FEND, and other security frameworks. It is designed for use with AI agents like Claude Code, GitHub Copilot, etc.
## Facts
- Repository: https://github.com/mukul975/Anthropic-Cybersecurity-Skills
- Homepage: https://mahipal.engineer/Anthropic-Cybersecurity-Skills/
- Stars: 24,853 · Forks: 2,841 · Open issues: 33 · Watchers: 168
- Primary language: Python
- License: Apache-2.0
- Last pushed: 2026-06-26T14:37:50+00:00
## Categories
- [AI Agents](/categories/ai-agents.md)
- [Developer Tools](/categories/developer-tools.md)
## Tags
incident-response, cybersecurity, ethical-hacking, infosec, claude code, ai-agents, cloud-security, devsecops
## Related tools
- [ECC](/tools/affaan-m-ecc.md) - The agent harness performance optimization system (★ 226,962)
- [hermes-agent](/tools/nousresearch-hermes-agent.md) - The self-improving AI agent built by Nous Research (★ 210,880)
- [AutoGPT](/tools/significant-gravitas-autogpt.md) - AutoGPT: Build, Deploy, and Run AI Agents (★ 185,417)
- [ollama](/tools/ollama-ollama.md) - Get up and running with Kimi-K2.6, GLM-5.1, MiniMax, DeepSeek, gpt-oss, Qwen, Gemma and other models. (★ 175,659)
- [prompts.chat](/tools/f-prompts-chat.md) - The world's largest open-source prompt library for AI (★ 165,019)
- [JavaGuide](/tools/snailclimb-javaguide.md) - Snailclimb/JavaGuide: 面试 & 后端通用面试指南，覆盖计算机基础、数据库、分布式、高并发、系统设计与 AI 应用开发 (★ 156,863)
- [langflow](/tools/langflow-ai-langflow.md) - Langflow is a powerful platform for building and deploying AI-powered agents and workflows. (★ 151,298)
- [dify](/tools/langgenius-dify.md) - Production-ready platform for agentic workflow development (★ 148,070)
## README (excerpt)
```text
# Anthropic Cybersecurity Skills
### The largest open-source cybersecurity skills library for AI agents
**817 production-grade cybersecurity skills · 29 security domains · 6 framework mappings · 26+ AI platforms**
[Get Started](#quick-start) · [What's Inside](#whats-inside--29-security-domains) · [Frameworks](#five-frameworks-one-skill-library) · [Platforms](#compatible-platforms) · [Contributing](#contributing)
---
> ⚠️ **Community Project** — This is an independent, community-created project. Not affiliated with Anthropic PBC.
>
> 🔐 **Authorized & lawful use only.** This library includes offensive and dual-use techniques (e.g. red-team C2, phishing simulation, exploitation) intended for **authorized penetration testing, security research, defense, and education**. Only use them against systems you own or have **explicit written permission** to test, and comply with all applicable laws and rules of engagement. You are solely responsible for how you use these skills. See [SECURITY.md](SECURITY.md) and [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md).
## Give any AI agent the security skills of a senior analyst
A junior analyst knows which Volatility3 plugin to run on a suspicious memory dump, which Sigma rules catch Kerberoasting, and how to scope a cloud breach across three providers. **Your AI agent doesn't — unless you give it these skills.**
This repo contains **817 structured cybersecurity skills** spanning **29 security domains**, each following the [agentskills.io](https://agentskills.io) open standard. Every skill is mapped to **six industry frameworks** — MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, MITRE D3FEND, NIST AI RMF, and the MITRE Fight Fraud Framework (F3) — making this the only open-source skills library with unified cross-framework coverage. Clone it, point your agent at it, and your next security investigation gets expert-level guidance in seconds.
## Six frameworks, one skill library
No other open-source skills library maps every skill to all of these frameworks. One skill, six compliance checkboxes.
| Framework | Version | Scope in this repo | What it maps |
|---|---|---|---|
| [MITRE ATT&CK](https://attack.mitre.org) | v19.1 | 15 tactics · 286 techniques | Adversary behaviors and TTPs |
| [NIST CSF 2.0](https://www.nist.gov/cyberframework) | 2.0 | 6 functions · 22 categories | Organizational security posture |
| [MITRE ATLAS](https://atlas.mitre.org) | v5.4 | 16 tactics · 84 techniques | AI/ML adversarial threats |
| [MITRE D3FEND](https://d3fend.mitre.org) | v1.3 | 7 categories · 267 techniques | Defensive countermeasures |
| [NIST AI RMF](https://airc.nist.gov/AI_RMF) | 1.0 | 4 functions · 72 subcategories | AI risk management |
| [MITRE F3 (Fight Fraud Framework)](https://ctid.mitre.org/fraud/) | v1.1 (2026-04-09) | 8 tactics · 123 techniques · 94 fraud-relevant skills | Cyber-enabled financial fraud TTPs |
**Example — a single skill maps across all six:**
| Skill | ATT&CK | NIST CSF | ATLAS | D3FEND | AI RMF | F3 |
|---|---|---|---|---|---|---|
| `analyzing-network-traffic-of-malware` | T1071 | DE.CM | AML.T0047 | D3-NTA | MEASURE-2.6 | — |
| `detecting-business-email-compromise` | T1566 | DE.AE | — | — | — | F1005.006 · monetization |
### 🆕 MITRE Fight Fraud Framework (F3) — 94 fraud-relevant skills
The **[MITRE Fight Fraud Framework (F3)](https://ctid.mitre.org/fraud/)** was released **April 9, 2026** by MITRE's Center for Threat-Informed Defense (CTID), co-developed with JPMorganChase, Citigroup, Lloyds Banking Group, Standard Chartered, CrowdStrike, Verizon Business, FS-ISAC, and others. It is an ATT&CK-compatible TTP catalog for **cyber-enabled financial fraud** — filling the gap ATT&CK leaves after initial compromise.
F3 v1.1 adds **two fraud-specific tactics** that ATT&CK does not enumerate:
- **Positioning** (`FA0001`) — action
```
---
**Machine-readable endpoints**
- JSON: [`/api/graphcanon/tools/mukul975-anthropic-cybersecurity-skills`](/api/graphcanon/tools/mukul975-anthropic-cybersecurity-skills)
- LLM index: [/llms.txt](/llms.txt)
- Full corpus: [/llms-full.txt](/llms-full.txt)
_GraphCanon - The knowledge graph for AI development. https://www.graphcanon.com/_