README

Anthropic Cybersecurity Skills

 The largest open-source cybersecurity skills library for AI agents

















818 production-grade cybersecurity skills · 34 security domains · 6 framework mappings · 26+ AI platforms

Get Started · What's Inside · Frameworks · Platforms · Contributing



---

 ⚠️ Community Project — This is an independent, community-created project. Not affiliated with Anthropic PBC.

 🔐 Authorized & lawful use only. This library includes offensive and dual-use techniques (e.g. red-team C2, phishing simulation, exploitation) intended for authorized penetration testing, security research, defense, and education. Only use them against systems you own or have explicit written permission to test, and comply with all applicable laws and rules of engagement. You are solely responsible for how you use these skills. See SECURITY.md and CODE_OF_CONDUCT.md.

 Give any AI agent the security skills of a senior analyst

A junior analyst knows which Volatility3 plugin to run on a suspicious memory dump, which Sigma rules catch Kerberoasting, and how to scope a cloud breach across three providers. Your AI agent doesn't — unless you give it these skills.

This repo contains 818 structured cybersecurity skills spanning 34 security domains, each following the agentskills.io open standard.  The library maps across six industry frameworks — MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, MITRE D3FEND, NIST AI RMF, and the MITRE Fight Fraud Framework (F3) — with each skill mapped to the frameworks relevant to its type (a forensics skill carries ATT&CK + CSF; an AI-security skill adds ATLAS and AI RMF).  Clone it, point your agent at it, and your next security investigation gets expert-level guidance in seconds.

 Six frameworks, one skill library

Each skill maps to the frameworks that fit its subject — ATT&CK and NIST CSF are near-universal, while ATLAS, AI RMF, D3FEND, and F3 apply where they're relevant. Framework coverage across the 817 skills: MITRE ATT&CK 805 · NIST CSF 2.0 804 · MITRE D3FEND 139 · NIST AI RMF 97 · MITRE F3 94 · MITRE ATLAS 93.

| Framework | Version | Framework scope | What it maps |
|---|---|---|---|
| MITRE ATT&CK | v19.1 | 15 tactics · Enterprise/Mobile/ICS | Adversary behaviors and TTPs |
| NIST CSF 2.0 | 2.0 | 6 functions · 22 categories · 106 subcategories | Organizational security posture |
| MITRE ATLAS | 2026.07 | 101 techniques · 77 sub-techniques | AI/ML adversarial threats |
| MITRE D3FEND | v1.4.0 | 270 techniques | Defensive countermeasures |
| NIST AI RMF | 1.0 | 4 functions (Govern/Map/Measure/Manage) | AI risk management |
| MITRE F3 (Fight Fraud Framework) | v1.1 (2026-04-09) | 8 tactics · 123 techniques · 94 fraud-relevant skills | Cyber-enabled financial fraud TTPs |

Example — each skill maps only to the frameworks relevant to it (one may hit all six, another just a couple):

| Skill | ATT&CK | NIST CSF | ATLAS | D3FEND | AI RMF | F3 |
|---|---|---|---|---|---|---|
| analyzing-network-traffic-of-malware | T

Top issues

Discussions

Latest release

v1.3.0

This release grows the library from 762 to 817 skills, adds a sixth framework (MITRE F3), and fixes the plugin version that installs were reporting as 1.0.

 55 new skills

Built around the fastest-growing attack and skills areas from the 2025-2026 ISC2, WEF, CrowdStrike, and Mandiant reports. Three new domains, plus depth in six existing ones.

New domains:
- AI Security (12 skills) covers LLM red-teaming with garak and PyRIT, direct and indirect prompt injection, RAG poisoning, MCP tool-poisoning, agentic tool-invocation controls, and runtime guardrails.
- Supply Chain Security (5 sk