Cybersecurity Skills (754)

Why use it

Key features

754 skills, all defensive — no exploit/offense surface
Mapped to 5 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF
26 security domains incl. AI security and AI red-teaming defense
Apache 2.0
Cross-agent: ships in agentskills.io format
Maintained by Mukul Kantiwal

Live Demo

What it looks like in practice

ready

Install

Author repository · Claude Skills documentation

Use Cases

Real-world ways to use Cybersecurity Skills (754)

Run a NIST IR-aligned response on a suspected compromise

👤 Solo SREs / small SOCs without a runbook library ⏱ ~90 min advanced

When to use: An alert fired and you need a structured response, not panic-googling.

Flow

Triage

Use the IR skill. Suspected compromise on host X — guide me through NIST SP 800-61 R2 phases. Stop after Containment.✓ Copied

→ Phase-by-phase checklist with concrete commands
Collect

What evidence should I capture before isolating the host? Give me the exact osquery / GRR commands.✓ Copied

→ Specific commands; no hand-waving
Document

Generate the IR report scaffold mapped to MITRE ATT&CK techniques observed.✓ Copied

→ Report with mapped TTPs

Outcome: A defensible IR record linked to standards.

Pitfalls

Skill suggests offensive steps — It shouldn't — it's defensive-only. If you see anything offensive, that's a bug; report upstream.

Combine with: filesystem

Run an OWASP-aligned AppSec review on a service

👤 Devs without a dedicated security team ⏱ ~120 min advanced

When to use: Pre-launch — you need a review you can defend in an audit.

Flow

Inventory

Use the AppSec skill on /service/. Map the attack surface (auth, data flows, deps, infra).✓ Copied

→ Attack surface map with annotations
Threat-model

STRIDE the surface. Output the threats with likelihood and impact.✓ Copied

→ STRIDE table
Mitigation plan

For HIGH likelihood threats, propose mitigations with NIST CSF mapping.✓ Copied

→ Plan with control IDs

Outcome: An AppSec review with audit-ready citations.

Pitfalls

Generic mitigations that don't fit your stack — Pass repo paths; skill tailors to detected language/framework

Combine with: github

Defensive review of an AI feature you're shipping

👤 Teams building AI features ⏱ ~90 min advanced

When to use: You're shipping an LLM feature; you want a NIST AI RMF + MITRE ATLAS review.

Flow

Profile risks

Use the AI security skill. List ATLAS risks relevant to a chat assistant with tool calls.✓ Copied

→ Tactic-grouped risks (prompt injection, model evasion, supply chain)
Defenses

For each risk, propose specific defenses with NIST AI RMF function (Govern/Map/Measure/Manage).✓ Copied

→ Defenses with function tags
Test plan

Write a red-team test plan I can hand to a contractor.✓ Copied

→ Plan with concrete attacks to try

Outcome: Pre-launch AI security baseline.

Pitfalls

Skill prescribes controls that double your latency — It tags severity; tier-1 controls only for v1 launch

Combinations

Pair with other MCPs for X10 leverage

anthropic-cybersecurity-skills + github

File security findings as issues

Open a GitHub issue per HIGH finding, with NIST CSF reference.✓ Copied

anthropic-cybersecurity-skills + filesystem

Persist reports as audit evidence

Save the IR report to /security/reports/$(date +%F)/.✓ Copied

Tools

What this MCP exposes

Tool	Inputs	When to call
ir.runbook	phase, scenario	During an incident
appsec.review	path	Pre-launch / quarterly
ai.atlas_review	feature_description	Before shipping AI features
framework.map	finding, target_framework	Audit prep

Cost & Limits

What this costs to run

API quota: N/A — local skill
Tokens per call: Comprehensive reviews: 20–50k tokens
Monetary: Free (Apache 2.0)
Tip: For routine work, scope to one domain (just IR, just AppSec) to keep cost bounded

Security

Permissions, secrets, blast radius

Minimum scopes: filesystem-read

Credential storage: None

Data egress: Local

Skills are advisory — they don't replace human judgement, especially for live IR

Troubleshooting

Common errors and fixes

Output is too generic

Provide specific paths, alert text, or service description; skill tailors to context

Framework mapping cites a control that doesn't exist

Pass --framework-version to pin to a specific revision (e.g. NIST CSF 2.0)

Skill flags too many findings

Filter by severity ≥ HIGH for first pass

Alternatives