Cybersecurity Agent Skills v1.0.0
The largest open-source cybersecurity skills library for AI coding agents. 734 hands-on, structured skills spanning 26 security domains -- from threat hunting and malware analysis to cloud security and OT/ICS defense.
Highlights
- 734 skills across 26 cybersecurity domains
- Full MITRE ATT&CK coverage -- all 14 Enterprise tactics mapped
- Aligned to NIST CSF 2.0 functions (Identify, Protect, Detect, Respond, Recover)
- Works with 26+ AI agent platforms via the agentskills.io standard
- Each skill includes structured workflows, scripts, reference configs, and validation steps
Domain Coverage
| Domain | Skills | Description |
|---|---|---|
| Cloud Security | 60 | AWS, Azure, GCP hardening, CSPM, cloud forensics |
| Threat Hunting | 55 | Proactive detection, hypothesis-driven hunts, LOTL |
| Threat Intelligence | 50 | STIX/TAXII, MISP, feed integration, actor profiling |
| Web Application Security | 42 | OWASP Top 10, SQLi, XSS, SSRF, deserialization |
| Network Security | 40 | IDS/IPS, firewall rules, VLAN, traffic analysis |
| Malware Analysis | 39 | Static/dynamic analysis, reverse engineering, sandboxing |
| Digital Forensics | 37 | Disk imaging, memory forensics, timeline reconstruction |
| Security Operations | 36 | SIEM correlation, log analysis, alert triage |
| Identity & Access Management | 35 | IAM policies, PAM, zero trust identity, Okta, SailPoint |
| SOC Operations | 33 | Playbooks, escalation, metrics, tabletop exercises |
| Container Security | 30 | K8s RBAC, image scanning, Falco, container forensics |
| OT/ICS Security | 28 | Modbus, DNP3, IEC 62443, historian defense, SCADA |
| API Security | 28 | GraphQL, REST, SOAP, OWASP API Top 10, WAF bypass |
| Vulnerability Management | 25 | Nessus, scanning workflows, patch prioritization |
| Incident Response | 25 | Breach containment, ransomware response, IR playbooks |
| Red Teaming | 24 | Full-scope engagements, AD attacks, phishing simulation |
| Penetration Testing | 23 | Network, web, cloud, mobile, wireless pentesting |
| Endpoint Security | 17 | EDR, LOTL detection, fileless malware, persistence |
| DevSecOps | 17 | CI/CD security, code signing, Terraform auditing |
| Phishing Defense | 16 | Email authentication, BEC detection, phishing IR |
| Cryptography | 14 | TLS, Ed25519, certificate transparency, key management |
| Zero Trust Architecture | 13 | BeyondCorp, CISA maturity model, microsegmentation |
| Mobile Security | 12 | Android/iOS analysis, mobile pentesting, MDM forensics |
| Ransomware Defense | 7 | Precursor detection, response, recovery, encryption analysis |
| Compliance & Governance | 5 | CIS benchmarks, SOC2, regulatory frameworks |
| Deception Technology | 2 | Honeytokens, breach detection canaries |
Total: 734 skills
MITRE ATT&CK Enterprise Coverage
All 14 tactics in the MITRE ATT&CK Enterprise Matrix (v18) are covered:
| Tactic | ID | Coverage | Key Skills |
|---|---|---|---|
| Reconnaissance | TA0043 | Strong | OSINT, subdomain enumeration, DNS recon |
| Resource Development | TA0042 | Moderate | Phishing infrastructure, C2 setup detection |
| Initial Access | TA0001 | Strong | Phishing simulation, exploit detection, forced browsing |
| Execution | TA0002 | Strong | PowerShell analysis, fileless malware, script block logging |
| Persistence | TA0003 | Strong | Scheduled tasks, registry, service accounts, LOTL |
| Privilege Escalation | TA0004 | Strong | Kerberoasting, AD attacks, cloud privilege escalation |
| Defense Evasion | TA0005 | Strong | Obfuscation, rootkit analysis, evasion technique detection |
| Credential Access | TA0006 | Strong | Mimikatz detection, pass-the-hash, credential dumping |
| Discovery | TA0007 | Moderate | BloodHound, AD enumeration, network scanning |
| Lateral Movement | TA0008 | Strong | SMB exploits, lateral movement detection with Splunk |
| Collection | TA0009 | Moderate | Email forensics, data staging detection |
| Command and Control | TA0011 | Strong | C2 beaconing, DNS tunneling, Cobalt Strike analysis |
| Exfiltration | TA0010 | Strong | DNS exfiltration, DLP controls, data loss detection |
| Impact | TA0040 | Strong | Ransomware defense, encryption analysis, recovery |
NIST CSF 2.0 Alignment
| Function | Skills | Examples |
|---|---|---|
| Identify (ID) | 120+ | Asset discovery, threat landscape assessment, risk analysis |
| Protect (PR) | 150+ | IAM hardening, WAF rules, zero trust, encryption |
| Detect (DE) | 200+ | Threat hunting, SIEM correlation, anomaly detection |
| Respond (RS) | 160+ | Incident response, forensics, breach containment |
| Recover (RC) | 40+ | Ransomware recovery, BCP, disaster recovery |
Compatible Platforms
Directly tested with:
- Claude Code (Anthropic)
- GitHub Copilot
- OpenAI Codex
- Gemini CLI (Google)
- Cursor
Compatible with 26+ AI agent platforms via the agentskills.io open standard, including Windsurf, Cline, Aider, Continue, and more.
Quick Start
Option 1: Clone and use directly
git clone https://github.com/anthropics/cybersecurity-skills.git
cd cybersecurity-skills
# Point your AI agent at any skill directoryOption 2: Use a specific skill
# Copy a single skill into your project
cp -r skills/hunting-for-command-and-control-beaconing/ ./my-project/Option 3: Browse by domain
# List all cloud security skills
ls skills/ | grep -i cloud
# List all threat hunting skills
ls skills/ | grep -i huntingWhat's New in v1.0.0
This is the initial stable release of the Cybersecurity Agent Skills library.
- 734 structured skills with workflows, scripts, reference configs, and validation
- Full MITRE ATT&CK mapping -- every Enterprise tactic has corresponding skills
- NIST CSF 2.0 alignment across all five core functions
- Standardized SKILL.md format with consistent frontmatter (name, domain, subdomain, tags, version)
- Issue templates for contributing new skills, reporting bugs, and requesting features
- ATT&CK Navigator layer for visual coverage mapping
- Apache 2.0 license -- free for commercial and personal use
Breaking Changes
None. This is the first release.
Repository Structure
skills/
<skill-name>/
SKILL.md # Skill definition with frontmatter and workflow
scripts/ # Automation scripts (Python, Bash, PowerShell)
references/ # Reference configs, sample data, templates
Contributing
We welcome contributions! See CONTRIBUTING.md for guidelines.
- Use the New Skill issue template to propose additions
- Each skill must include SKILL.md with standard frontmatter
- Scripts should be functional, not placeholder code
- Include validation steps so users can verify their work
Contributors
Thanks to all contributors who made this release possible. See the contributors page.
License
Apache License 2.0 -- see LICENSE for details.