Anthropic Cybersecurity Skills
The largest open-source cybersecurity skills library for AI agents
817 production-grade cybersecurity skills · 29 security domains · 6 framework mappings · 26+ AI platforms
Get Started · What's Inside · Frameworks · Platforms · Contributing
⚠️ Community Project — This is an independent, community-created project. Not affiliated with Anthropic PBC.
🔐 Authorized & lawful use only. This library includes offensive and dual-use techniques (e.g. red-team C2, phishing simulation, exploitation) intended for authorized penetration testing, security research, defense, and education. Only use them against systems you own or have explicit written permission to test, and comply with all applicable laws and rules of engagement. You are solely responsible for how you use these skills. See SECURITY.md and CODE_OF_CONDUCT.md.
Give any AI agent the security skills of a senior analyst
A junior analyst knows which Volatility3 plugin to run on a suspicious memory dump, which Sigma rules catch Kerberoasting, and how to scope a cloud breach across three providers. Your AI agent doesn't — unless you give it these skills.
This repo contains 817 structured cybersecurity skills spanning 29 security domains, each following the agentskills.io open standard. The library maps across six industry frameworks — MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, MITRE D3FEND, NIST AI RMF, and the MITRE Fight Fraud Framework (F3) — with each skill mapped to the frameworks relevant to its type (a forensics skill carries ATT&CK + CSF; an AI-security skill adds ATLAS and AI RMF). Clone it, point your agent at it, and your next security investigation gets expert-level guidance in seconds.
Six frameworks, one skill library
Each skill maps to the frameworks that fit its subject — ATT&CK and NIST CSF are near-universal, while ATLAS, AI RMF, D3FEND, and F3 apply where they're relevant. Framework coverage across the 817 skills: MITRE ATT&CK 805 · NIST CSF 2.0 804 · MITRE D3FEND 139 · NIST AI RMF 97 · MITRE F3 94 · MITRE ATLAS 93.
Framework Version Framework scope What it maps
MITRE ATT&CK v19.1 15 tactics · Enterprise/Mobile/ICS Adversary behaviors and TTPs
NIST CSF 2.0 2.0 6 functions · 22 categories · 106 subcategories Organizational security posture
MITRE ATLAS 2026.07 101 techniques · 77 sub-techniques AI/ML adversarial threats
MITRE D3FEND v1.4.0 270 techniques Defensive countermeasures
NIST AI RMF 1.0 4 functions (Govern/Map/Measure/Manage) AI risk management
MITRE F3 (Fight Fraud Framework) v1.1 (2026-04-09) 8 tactics · 123 techniques · 94 fraud-relevant skills Cyber-enabled financial fraud TTPs
Example — each skill maps only to the frameworks relevant to it (one may hit all six, another just a couple):
Skill ATT&CK NIST CSF ATLAS D3FEND AI RMF F3
analyzing-network-traffic-of-malware
T1071
DE.CM
AML.T0047
D3-NTA
MEASURE-2.6
—
detecting-business-email-compromise
T1566
DE.AE
—
—
—
F1005.006 · monetization
🆕 MITRE Fight Fraud Framework (F3) — 94 fraud-relevant skills
The MITRE Fight Fraud Framework (F3) was released April 9, 2026 by MITRE's Center for Threat-Informed Defense (CTID), co-developed with JPMorganChase, Citigroup, Lloyds Banking Group, Standard Chartered, CrowdStrike, Verizon Business, FS-ISAC, and others. It is an ATT&CK-compatible TTP catalog for cyber-enabled financial fraud — filling the gap ATT&CK leaves after initial compromise.
F3 v1.1 adds two fraud-specific tactics that ATT&CK does not enumerate:
-
Positioning (
FA0001) — actions taken after access to collect/manipulate data and prepare the fraud (synthetic-identity seeding, account warming, beneficiary setup, SIM-swap pre-positioning, banking-session hijack). -
Monetization (
FA0002) — converting stolen assets into usable funds (money-mule layering, APP fraud, crypto off-ramping, card cash-out, refund/chargeback abuse).
Fraud-specific techniques use F1XXX IDs (e.g. F1005.003 Add Beneficiary, F1025.003 Wire Transfer, F1007 Adversary-in-the-Browser); reused ATT&CK techniques keep their T1XXX IDs. Mappings live in each skill's mitre_f3: frontmatter block — all 123 F3 v1.1 technique IDs were verified against the upstream STIX bundle. See docs/mitre-f3-mapping.md for the schema.
MITRE ATT&CK v19.1 — 805/817 skills mapped
Every skill carries a mitre_attack frontmatter list validated against MITRE ATT&CK v19.1 (the latest release) using the official mitreattack-python library — 290 distinct techniques and sub-techniques (146 base + 144 sub) across Enterprise, ICS, and Mobile. Zero revoked or deprecated IDs. v19.1's restructured Defense Evasion (now split into Stealth and Defense Impairment) is reflected below.
Tactic ID Skills
Reconnaissance TA0043 103
Resource Development TA0042 22
Initial Access TA0001 467
Execution TA0002 350
Persistence TA0003 444
Privilege Escalation TA0004 464
Stealth TA0005 442
Defense Impairment TA0112 92
Credential Access TA0006 202
Discovery TA0007 237
Lateral Movement TA0008 68
Collection TA0009 172
Command and Control TA0011 123
Exfiltration TA0010 82
Impact TA0040 50
Quick start
# Option 1: npx (recommended)
npx skills add mukul975/Anthropic-Cybersecurity-Skills
# Option 2: Git clone
git clone https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
cd Anthropic-Cybersecurity-Skills
Works immediately with Claude Code, GitHub Copilot, OpenAI Codex CLI, Cursor, Gemini CLI, and any agentskills.io-compatible platform.
🌍 GARS-2026 — Global Agentic AI Readiness Survey
I'm running a global academic study measuring how ready security professionals, developers, and enterprise teams actually are for agentic AI — MCP servers, tool calling, governance, and human-in-the-loop workflows.
If you use this repo, your response would be a genuinely valuable data point.
📋 Take the survey (10 min): Survey Link
-
60 questions · Anonymous · Supervised by SRH Berlin
-
You get 50 Casky Tokens for early access to casky.ai
-
Results published open access under CC-BY 4.0
🚀 Try it on the Playground
Experience Casky.ai hands-on — no setup required.
→ Launch Playground on Casky.ai
The playground lets you:
-
Run live cybersecurity skill exercises against real targets
-
See AI agents execute structured skills in real time
-
Explore MITRE ATT&CK mapped workflows interactively
-
Test threat hunting, DFIR, and penetration testing scenarios
No installation. No configuration. Just open and start.
Why this exists
The cybersecurity workforce gap hit 4.8 million unfilled roles globally in 2024 (ISC2). AI agents can help clos