Anthropic Cybersecurity Skills

# anthropic-cybersecurity-skills

> Skill by [ara.so](https://ara.so) — Security Skills collection.

## Overview

The Anthropic Cybersecurity Skills library provides 754 production-grade cybersecurity skills spanning 26 security domains. Each skill is structured following the agentskills.io standard and mapped to five industry frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, MITRE D3FEND, and NIST AI RMF. This enables AI agents to perform security operations with expert-level guidance.

## Installation

```bash
# Option 1: Using npx (recommended)
npx skills add mukul975/Anthropic-Cybersecurity-Skills

# Option 2: Git clone
git clone https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
cd Anthropic-Cybersecurity-Skills

# Option 3: Add as submodule
git submodule add https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills/cybersecurity
```

## Directory Structure

```
skills/
├── {skill-name}/
│   ├── SKILL.md              # Skill definition with YAML frontmatter
│   ├── references/
│   │   ├── standards.md      # Framework mappings
│   │   └── workflows.md      # Technical procedures
│   ├── scripts/
│   │   └── *.py              # Helper scripts
│   └── assets/
│       └── *.md              # Templates and checklists
```

## Discovering Skills

### By Domain

Skills are organized into 26 domains. List all domains:

```python
import os
import yaml

def list_domains():
    domains = {}
    for skill_dir in os.listdir('skills'):
        skill_path = f'skills/{skill_dir}/SKILL.md'
        if os.path.exists(skill_path):
            with open(skill_path, 'r') as f:
                content = f.read()
                # Extract YAML frontmatter
                if content.startswith('---'):
                    yaml_end = content.find('---', 3)
                    frontmatter = yaml.safe_load(content[3:yaml_end])
                    domain = frontmatter.get('domain', 'unknown')
                    subdomain = frontmatter.get('subdomain', 'general')
                    
                    if domain not in domains:
                        domains[domain] = {}
                    if subdomain not in domains[domain]:
                        domains[domain][subdomain] = []
                    domains[domain][subdomain].append(frontmatter['name'])
    
    return domains

# Usage
domains = list_domains()
for domain, subdomains in domains.items():
    print(f"\n{domain.upper()}")
    for subdomain, skills in subdomains.items():
        print(f"  {subdomain}: {len(skills)} skills")
```

### By Framework Mapping

Find skills mapped to specific ATT&CK techniques:

```python
def find_by_attack_technique(technique_id):
    """Find skills mapped to a specific ATT&CK technique"""
    matching_skills = []
    
    for skill_dir in os.listdir('skills'):
        skill_path = f'skills/{skill_dir}/SKILL.md'
        if os.path.exists(skill_path):
            with open(skill_path, 'r') as f:
                content = f.read()
                if content.startswith('---'):
                    yaml_end = content.find('---', 3)
                    frontmatter = yaml.safe_load(content[3:yaml_end])
                    
                    # Check ATT&CK mappings in references
                    refs_path = f'skills/{skill_dir}/references/standards.md'
                    if os.path.exists(refs_path):
                        with open(refs_path, 'r') as ref_file:
                            if technique_id in ref_