Security & Compliance Skills
902 curated security and compliance skills for AI coding agents. Access control, vulnerability scanning, compliance audit - all license-verified.
Detecting Suspicious OAuth Application Consent
Detect risky OAuth application consent grants in Azure AD / Microsoft Entra ID using Microsoft Graph API, audit logs, and permission analysis to identify illicit consent grant attacks.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-suspicious-oauth-application-consent
Detecting Suspicious Powershell Execution
Detect suspicious PowerShell execution patterns including encoded commands, download cradles, AMSI bypass attempts, and constrained language mode evasion.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-suspicious-powershell-execution
Detecting T1003 Credential Dumping With Edr
Detect OS credential dumping techniques targeting LSASS memory, SAM database, NTDS.dit, and cached credentials using EDR telemetry, Sysmon process access monitoring, and Windows security event correlation.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-t1003-credential-dumping-with-edr
Detecting T1055 Process Injection With Sysmon
Detect process injection techniques (T1055) including classic DLL injection, process hollowing, and APC injection by analyzing Sysmon events for cross-process memory operations, remote thread creation, and anomalous DLL loading patterns.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-t1055-process-injection-with-sysmon
Detecting T1548 Abuse Elevation Control Mechanism
Detect abuse of elevation control mechanisms including UAC bypass, sudo exploitation, and setuid/setgid manipulation by monitoring registry modifications, process elevation flags, and unusual parent-child process relationships.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-t1548-abuse-elevation-control-mechanism
Detecting Typosquatting Packages In npm Pypi
Detects typosquatting attacks in npm and PyPI package registries by analyzing package name similarity using Levenshtein distance and other string metrics, examining publish date heuristics to identify recently created packages mimicking established ones, and flagging download count anomalies where suspicious packages have disproportionately low usage compared to their legitimate targets. The analyst queries the PyPI JSON API and npm registry API to gather package metadata for automated comparison. Activates for requests involving package typosquatting detection, dependency confusion analysis, malicious package identification, or software supply chain threat hunting in package registries.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-typosquatting-packages-in-npm-pypi
Detecting Wmi Persistence
Detect WMI event subscription persistence by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation.
by mukul975/Anthropic-Cybersecurity-Skills / skills/detecting-wmi-persistence
Django Access Review
Django access control and IDOR security review. Use when reviewing Django views, DRF viewsets, ORM queries, or any Python/Django code handling user authorization. Trigger keywords: "IDOR", "access control", "authorization", "Django permissions", "object permissions", "tenant isolation", "broken access".
by getsentry/skills / skills/django-access-review
Domain Intel
Passive domain reconnaissance using Python stdlib. Subdomain discovery, SSL certificate inspection, WHOIS lookups, DNS records, domain availability checks, and bulk multi-domain analysis. No API keys required.
by NousResearch/hermes-agent / optional-skills/research/domain-intel
Dpa Review
Review a Data Processing Agreement against your DPA playbook — auto-detects whether you're processor or controller and applies the right half of the playbook. Use when the user says "review this DPA", "check this data processing addendum", "customer sent their DPA", "is this DPA okay", or attaches a DPA.
by anthropics/claude-for-legal / privacy-legal/skills/dpa-review
Draft Nda
Draft a detailed Non-Disclosure Agreement between two parties covering information types, jurisdiction, and clauses needing legal review. Use when creating confidentiality agreements or preparing an NDA for a partnership.
by phuryn/pm-skills / pm-toolkit/skills/draft-nda
Dsar Response
Walk through a Data Subject Access Request (or deletion, portability, correction request) and draft the response — verify identity, locate data system-by-system, assess exemptions, draft the acknowledgment and substantive response letters. Use when a DSAR comes in, the user pastes an access/deletion/portability/correction request, or says "DSAR came in", "access request", "right to be forgotten", or "someone wants their data".
by anthropics/claude-for-legal / privacy-legal/skills/dsar-response
Elasticsearch Audit
Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.
by elastic/agent-skills / skills/elasticsearch/elasticsearch-audit
Elasticsearch Authn
Authenticate to Elasticsearch using native, file-based, LDAP/AD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured.
by elastic/agent-skills / skills/elasticsearch/elasticsearch-authn
Elasticsearch Authz
Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP/SAML.
by elastic/agent-skills / skills/elasticsearch/elasticsearch-authz
Elasticsearch Security Troubleshooting
Diagnose and resolve Elasticsearch security errors: 401/403 failures, TLS problems, expired API keys, role mapping mismatches, and Kibana login issues. Use when the user reports a security error.
by elastic/agent-skills / skills/elasticsearch/elasticsearch-security-troubleshooting
Employment Contract Templates
Create employment contracts, offer letters, and HR policy documents following legal best practices. Use when drafting employment agreements, creating HR policies, or standardizing employment documentation.
by wshobson/agents / plugins/hr-legal-compliance/skills/employment-contract-templates
Entra Agent ID
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmi_path, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmi_path token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Azure RBAC (use azure-rbac), Microsoft Foundry agent authoring (use microsoft-foundry).
by microsoft/skills / .github/plugins/azure-skills/skills/entra-agent-id
Entra Agent ID
Microsoft Entra Agent ID (preview) for creating OAuth2-capable AI agent identities via Microsoft Graph beta API. Covers Agent Identity Blueprints, BlueprintPrincipals, Agent Identities, required permissions, sponsors, and Workload Identity Federation. Includes Microsoft Entra SDK for AgentID (containerized sidecar) for polyglot agent authentication (Docker/Kubernetes), 3P agent integration, autonomous and interactive agent patterns. Triggers: "agent identity", "agent id", "Agent Identity Blueprint", "BlueprintPrincipal", "entra agent", "agent identity provisioning", "Graph agent identity", "entra sidecar", "agent id sidecar", "auth sidecar", "3P agent", "third-party agent identity", "polyglot agent auth".
by microsoft/skills / .github/skills/entra-agent-id
Entra Agent User
Create Agent Users in Microsoft Entra ID from Agent Identities, enabling AI agents to act as digital workers with user identity capabilities in Microsoft 365 and Azure environments.
by github/awesome-copilot / skills/entra-agent-user
Entra App Registration
Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Azure RBAC or role assignments (use azure-rbac), Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.
by microsoft/skills / .github/plugins/azure-skills/skills/entra-app-registration
Eradicating Malware From Infected Systems
Systematically remove malware, backdoors, and attacker persistence mechanisms from infected systems while ensuring complete eradication and preventing re-infection.
by mukul975/Anthropic-Cybersecurity-Skills / skills/eradicating-malware-from-infected-systems
Evaluating Threat Intelligence Platforms
Evaluates and selects Threat Intelligence Platform (TIP) products based on organizational requirements including feed integration capability, STIX/TAXII support, workflow automation, analyst interface, and total cost of ownership. Use when conducting a TIP procurement, migrating between TIP solutions, or assessing whether the current TIP meets program maturity requirements. Activates for requests involving ThreatConnect, MISP, OpenCTI, Anomali, EclecticIQ, or TIP procurement decisions.
by mukul975/Anthropic-Cybersecurity-Skills / skills/evaluating-threat-intelligence-platforms
Executing Active Directory Attack Simulation
Executes authorized attack simulations against Active Directory environments to identify misconfigurations, weak credentials, dangerous privilege paths, and exploitable trust relationships that could lead to domain compromise. The tester uses BloodHound for attack path analysis, Mimikatz for credential extraction, and Impacket for protocol-level attacks including Kerberoasting, AS-REP Roasting, and delegation abuse. Activates for requests involving Active Directory pentest, AD attack simulation, domain compromise testing, or Kerberos attack assessment.
by mukul975/Anthropic-Cybersecurity-Skills / skills/executing-active-directory-attack-simulation
Executing Phishing Simulation Campaign
Executes authorized phishing simulation campaigns to assess an organization's susceptibility to email-based social engineering attacks. The tester designs realistic phishing scenarios, builds credential harvesting infrastructure, sends targeted phishing emails, and tracks open rates, click-through rates, and credential submission rates to measure human security awareness. Activates for requests involving phishing simulation, social engineering assessment, email security testing, or security awareness measurement.
by mukul975/Anthropic-Cybersecurity-Skills / skills/executing-phishing-simulation-campaign
Executing Red Team Engagement Planning
Red team engagement planning is the foundational phase that defines scope, objectives, rules of engagement (ROE), threat model selection, and operational timelines before any offensive testing begins.
by mukul975/Anthropic-Cybersecurity-Skills / skills/executing-red-team-engagement-planning
Executing Red Team Exercise
Executes comprehensive red team exercises that simulate real-world adversary operations against an organization's people, processes, and technology. The red team operates with stealth as a primary objective, employing the full attack lifecycle from initial reconnaissance through objective completion while testing the organization's detection and response capabilities. This differs from penetration testing by focusing on adversary emulation rather than vulnerability identification. Activates for requests involving red team exercise, adversary simulation, adversary emulation, or full-scope offensive security assessment.
by mukul975/Anthropic-Cybersecurity-Skills / skills/executing-red-team-exercise
Exploiting Active Directory Certificate Services Esc1
Exploit misconfigured Active Directory Certificate Services (AD CS) ESC1 vulnerability to request certificates as high-privileged users and escalate domain privileges during authorized red team assessments.
by mukul975/Anthropic-Cybersecurity-Skills / skills/exploiting-active-directory-certificate-services-esc1
Exploiting Active Directory With Bloodhound
BloodHound is a graph-based Active Directory reconnaissance tool that uses graph theory to reveal hidden and unintended relationships within AD environments. Red teams use BloodHound to identify attac
by mukul975/Anthropic-Cybersecurity-Skills / skills/exploiting-active-directory-with-bloodhound
Exploiting API Injection Vulnerabilities
Tests APIs for injection vulnerabilities including SQL injection, NoSQL injection, OS command injection, LDAP injection, and Server-Side Request Forgery (SSRF) through API parameters, headers, and request bodies. The tester crafts malicious payloads targeting different backend technologies and injection contexts to extract data, execute commands, or access internal services. Maps to OWASP API8:2023 Security Misconfiguration and API7:2023 SSRF. Activates for requests involving API injection testing, SQLi in APIs, NoSQL injection, SSRF testing, or API input validation assessment.
by mukul975/Anthropic-Cybersecurity-Skills / skills/exploiting-api-injection-vulnerabilities
Exploiting Bgp Hijacking Vulnerabilities
Analyzes and simulates BGP hijacking scenarios in authorized lab environments to assess route origin validation, RPKI deployment, and BGP monitoring defenses against prefix hijacking and route leak attacks on internet routing infrastructure.
by mukul975/Anthropic-Cybersecurity-Skills / skills/exploiting-bgp-hijacking-vulnerabilities
Exploiting Broken Function Level Authorization
Tests APIs for Broken Function Level Authorization (BFLA) vulnerabilities where regular users can invoke administrative functions or access privileged API endpoints by directly calling them. The tester identifies admin and privileged endpoints, then attempts to access them with regular user credentials by manipulating HTTP methods, URL paths, and request parameters. Maps to OWASP API5:2023 Broken Function Level Authorization. Activates for requests involving BFLA testing, admin endpoint bypass, function-level access control testing, or API privilege escalation.
by mukul975/Anthropic-Cybersecurity-Skills / skills/exploiting-broken-function-level-authorization
Exploiting Broken Link Hijacking
Discover and exploit broken link hijacking vulnerabilities by identifying references to expired domains, decommissioned cloud resources, and dead external services that can be claimed by an attacker.
by mukul975/Anthropic-Cybersecurity-Skills / skills/exploiting-broken-link-hijacking
Exploiting Constrained Delegation Abuse
Exploit Kerberos Constrained Delegation misconfigurations in Active Directory to impersonate privileged users via S4U2self and S4U2proxy extensions for lateral movement and privilege escalation.
by mukul975/Anthropic-Cybersecurity-Skills / skills/exploiting-constrained-delegation-abuse
Exploiting Deeplink Vulnerabilities
Tests and exploits deep link (URL scheme and App Link) vulnerabilities in Android and iOS mobile applications to identify unauthorized access, data injection, intent hijacking, and redirect manipulation. Use when assessing mobile app attack surface through custom URI schemes, Android App Links, iOS Universal Links, or intent-based navigation. Activates for requests involving deep link security testing, URL scheme exploitation, mobile intent abuse, or link hijacking.
by mukul975/Anthropic-Cybersecurity-Skills / skills/exploiting-deeplink-vulnerabilities
Exploiting Excessive Data Exposure In API
Tests APIs for excessive data exposure where endpoints return more data than the client application needs, relying on the frontend to filter sensitive fields. The tester intercepts API responses and analyzes them for leaked PII, internal identifiers, debug information, or sensitive business data that the UI does not display but the API transmits. This maps to OWASP API3:2023 Broken Object Property Level Authorization. Activates for requests involving API data leakage testing, excessive data exposure, response filtering bypass, or API over-fetching.
by mukul975/Anthropic-Cybersecurity-Skills / skills/exploiting-excessive-data-exposure-in-api
Exploiting HTTP Request Smuggling
Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.
by mukul975/Anthropic-Cybersecurity-Skills / skills/exploiting-http-request-smuggling
Exploiting Idor Vulnerabilities
Identifying and exploiting Insecure Direct Object Reference vulnerabilities to access unauthorized resources by manipulating object identifiers in API requests and URLs.
by mukul975/Anthropic-Cybersecurity-Skills / skills/exploiting-idor-vulnerabilities
Exploiting Insecure Data Storage In Mobile
Identifies and exploits insecure local data storage vulnerabilities in Android and iOS mobile applications including unencrypted databases, world-readable files, insecure SharedPreferences, plaintext credential storage, and improper keychain/keystore usage. Use when performing mobile penetration testing focused on OWASP M9 (Insecure Data Storage) or assessing compliance with MASVS-STORAGE requirements. Activates for requests involving mobile data storage security, local storage exploitation, SharedPreferences analysis, or mobile data leakage assessment.
by mukul975/Anthropic-Cybersecurity-Skills / skills/exploiting-insecure-data-storage-in-mobile
Exploiting Insecure Deserialization
Identifying and exploiting insecure deserialization vulnerabilities in Java, PHP, Python, and .NET applications to achieve remote code execution during authorized penetration tests.
by mukul975/Anthropic-Cybersecurity-Skills / skills/exploiting-insecure-deserialization
Exploiting Ipv6 Vulnerabilities
Identifies and exploits IPv6-specific vulnerabilities including SLAAC spoofing, Router Advertisement flooding, and IPv6 tunneling during authorized assessments to test dual-stack security controls and IPv6-aware network defenses.
by mukul975/Anthropic-Cybersecurity-Skills / skills/exploiting-ipv6-vulnerabilities
Exploiting JWT Algorithm Confusion Attack
Exploits JWT algorithm confusion vulnerabilities where the server's token verification library accepts the algorithm specified in the JWT header rather than enforcing a fixed algorithm. The tester manipulates the alg header to switch from RS256 to HS256 (using the RSA public key as the HMAC secret), sets alg to none to bypass signature verification, or exploits kid/jku/x5u header injection to supply attacker-controlled keys. Activates for requests involving JWT algorithm confusion, alg none attack, key confusion attack, or JWT signature bypass.
by mukul975/Anthropic-Cybersecurity-Skills / skills/exploiting-jwt-algorithm-confusion-attack
Exploiting Kerberoasting With Impacket
Perform Kerberoasting attacks using Impacket's GetUserSPNs to extract and crack Kerberos TGS tickets for Active Directory service accounts.
by mukul975/Anthropic-Cybersecurity-Skills / skills/exploiting-kerberoasting-with-impacket
Exploiting Mass Assignment In Rest Apis
Discover and exploit mass assignment vulnerabilities in REST APIs to escalate privileges, modify restricted fields, and bypass authorization controls by injecting unexpected parameters in API requests.
by mukul975/Anthropic-Cybersecurity-Skills / skills/exploiting-mass-assignment-in-rest-apis
Exploiting Ms17 010 Eternalblue Vulnerability
MS17-010 (EternalBlue) is a critical vulnerability in Microsoft's SMBv1 implementation that allows remote code execution. Originally discovered by the NSA and leaked by the Shadow Brokers in 2017, it
by mukul975/Anthropic-Cybersecurity-Skills / skills/exploiting-ms17-010-eternalblue-vulnerability
Exploiting Nopac Cve 2021 42278 42287
Exploit the noPac vulnerability chain (CVE-2021-42278 sAMAccountName spoofing and CVE-2021-42287 KDC PAC confusion) to escalate from standard domain user to Domain Admin in Active Directory environments.
by mukul975/Anthropic-Cybersecurity-Skills / skills/exploiting-nopac-cve-2021-42278-42287
Exploiting Nosql Injection Vulnerabilities
Detect and exploit NoSQL injection vulnerabilities in MongoDB, CouchDB, and other NoSQL databases to demonstrate authentication bypass, data extraction, and unauthorized access risks.
by mukul975/Anthropic-Cybersecurity-Skills / skills/exploiting-nosql-injection-vulnerabilities
Exploiting OAuth Misconfiguration
Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.
by mukul975/Anthropic-Cybersecurity-Skills / skills/exploiting-oauth-misconfiguration
Exploiting Prototype Pollution In Javascript
Detect and exploit JavaScript prototype pollution vulnerabilities on both client-side and server-side applications to achieve XSS, RCE, and authentication bypass through property injection.
by mukul975/Anthropic-Cybersecurity-Skills / skills/exploiting-prototype-pollution-in-javascript
Exploiting Race Condition Vulnerabilities
Detect and exploit race condition vulnerabilities in web applications using Turbo Intruder's single-packet attack technique to bypass rate limits, duplicate transactions, and exploit time-of-check-to-time-of-use flaws.
by mukul975/Anthropic-Cybersecurity-Skills / skills/exploiting-race-condition-vulnerabilities
Exploiting Server Side Request Forgery
Identifying and exploiting SSRF vulnerabilities to access internal services, cloud metadata, and restricted network resources during authorized penetration tests.
by mukul975/Anthropic-Cybersecurity-Skills / skills/exploiting-server-side-request-forgery
Exploiting Smb Vulnerabilities With Metasploit
Identifies and exploits SMB protocol vulnerabilities using Metasploit Framework during authorized penetration tests to demonstrate risks from unpatched Windows systems, misconfigured shares, and weak authentication in enterprise networks.
by mukul975/Anthropic-Cybersecurity-Skills / skills/exploiting-smb-vulnerabilities-with-metasploit
Exploiting SQL Injection Vulnerabilities
Identifies and exploits SQL injection vulnerabilities in web applications during authorized penetration tests using manual techniques and automated tools like sqlmap. The tester detects injection points through error-based, union-based, blind boolean, and time-based blind techniques across all major database engines (MySQL, PostgreSQL, MSSQL, Oracle) to demonstrate data extraction, authentication bypass, and potential remote code execution. Activates for requests involving SQL injection testing, SQLi exploitation, database security assessment, or injection vulnerability verification.
by mukul975/Anthropic-Cybersecurity-Skills / skills/exploiting-sql-injection-vulnerabilities
Exploiting SQL Injection With Sqlmap
Detecting and exploiting SQL injection vulnerabilities using sqlmap to extract database contents during authorized penetration tests.
by mukul975/Anthropic-Cybersecurity-Skills / skills/exploiting-sql-injection-with-sqlmap
Exploiting Template Injection Vulnerabilities
Detecting and exploiting Server-Side Template Injection (SSTI) vulnerabilities across Jinja2, Twig, Freemarker, and other template engines to achieve remote code execution.
by mukul975/Anthropic-Cybersecurity-Skills / skills/exploiting-template-injection-vulnerabilities
Exploiting Type Juggling Vulnerabilities
Exploit PHP type juggling vulnerabilities caused by loose comparison operators to bypass authentication, circumvent hash verification, and manipulate application logic through type coercion attacks.
by mukul975/Anthropic-Cybersecurity-Skills / skills/exploiting-type-juggling-vulnerabilities
Exploiting Vulnerabilities With Metasploit Framework
The Metasploit Framework is the world's most widely used penetration testing platform, maintained by Rapid7. It contains over 2,300 exploits, 1,200 auxiliary modules, and 400 post-exploitation modules
by mukul975/Anthropic-Cybersecurity-Skills / skills/exploiting-vulnerabilities-with-metasploit-framework
Exploiting Websocket Vulnerabilities
Testing WebSocket implementations for authentication bypass, cross-site hijacking, injection attacks, and insecure message handling during authorized security assessments.
by mukul975/Anthropic-Cybersecurity-Skills / skills/exploiting-websocket-vulnerabilities
Exploiting Zerologon Vulnerability Cve 2020 1472
Exploit the Zerologon vulnerability (CVE-2020-1472) in the Netlogon Remote Protocol to achieve domain controller compromise by resetting the machine account password to empty.
by mukul975/Anthropic-Cybersecurity-Skills / skills/exploiting-zerologon-vulnerability-cve-2020-1472
Extracting Browser History Artifacts
Extract and analyze browser history, cookies, cache, downloads, and bookmarks from Chrome, Firefox, and Edge for forensic evidence of user web activity.
by mukul975/Anthropic-Cybersecurity-Skills / skills/extracting-browser-history-artifacts
Extracting Config From Agent Tesla Rat
Extract embedded configuration from Agent Tesla RAT samples including SMTP/FTP/Telegram exfiltration credentials, keylogger settings, and C2 endpoints using .NET decompilation and memory analysis.
by mukul975/Anthropic-Cybersecurity-Skills / skills/extracting-config-from-agent-tesla-rat
Extracting Credentials From Memory Dump
Extract cached credentials, password hashes, Kerberos tickets, and authentication tokens from memory dumps using Volatility and Mimikatz for forensic investigation.
by mukul975/Anthropic-Cybersecurity-Skills / skills/extracting-credentials-from-memory-dump
Extracting Iocs From Malware Samples
Extracts indicators of compromise (IOCs) from malware samples including file hashes, network indicators (IPs, domains, URLs), host artifacts (file paths, registry keys, mutexes), and behavioral patterns for threat intelligence sharing and detection rule creation. Activates for requests involving IOC extraction, threat indicator harvesting, malware indicator collection, or building detection content from samples.
by mukul975/Anthropic-Cybersecurity-Skills / skills/extracting-iocs-from-malware-samples
Extracting Memory Artifacts With Rekall
Uses Rekall memory forensics framework to analyze memory dumps for process hollowing, injected code via VAD anomalies, hidden processes, and rootkit detection. Applies plugins like pslist, psscan, vadinfo, malfind, and dlllist to extract forensic artifacts from Windows memory images. Use during incident response memory analysis.
by mukul975/Anthropic-Cybersecurity-Skills / skills/extracting-memory-artifacts-with-rekall
Extracting Windows Event Logs Artifacts
Extract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw, Hayabusa, and EvtxECmd to detect lateral movement, persistence, and privilege escalation.
by mukul975/Anthropic-Cybersecurity-Skills / skills/extracting-windows-event-logs-artifacts
Flowstudio Power Automate Governance
Govern Power Automate flows and Power Apps at scale using the FlowStudio MCP cached store. Classify flows by business impact, detect orphaned resources, audit connector usage, enforce compliance standards, manage notification rules, and compute governance scores — all without Dataverse or the CoE Starter Kit. Load this skill when asked to: tag or classify flows, set business impact, assign ownership, detect orphans, audit connectors, check compliance, compute archive scores, manage notification rules, run a governance review, generate a compliance report, offboard a maker, or any task that involves writing governance metadata to flows. Requires a FlowStudio for Teams or MCP Pro+ subscription — see https://mcp.flowstudio.app
by github/awesome-copilot / skills/flowstudio-power-automate-governance
Gdpr Compliant
Apply GDPR-compliant engineering practices across your codebase. Use this skill whenever you are designing APIs, writing data models, building authentication flows, implementing logging, handling user data, writing retention/deletion jobs, designing cloud infrastructure, or reviewing pull requests for privacy compliance. Trigger this skill for any task involving personal data, user accounts, cookies, analytics, emails, audit logs, encryption, pseudonymization, anonymization, data exports, breach response, CI/CD pipelines that process real data, or any question framed as "is this GDPR-compliant?". Inspired by CNIL developer guidance and GDPR Articles 5, 25, 32, 33, 35.
by github/awesome-copilot / skills/gdpr-compliant
GDPR Data Handling
Implement GDPR-compliant data handling with consent management, data subject rights, and privacy by design. Use when building systems that process EU personal data, implementing privacy controls, or conducting GDPR compliance reviews.
by wshobson/agents / plugins/hr-legal-compliance/skills/gdpr-data-handling
Gem Reviewer
Security auditing, code review, OWASP scanning, PRD compliance verification.
by github/awesome-copilot / agents/gem-reviewer.agent.md
Generating Threat Intelligence Reports
Generates structured cyber threat intelligence reports at strategic, operational, and tactical levels tailored to specific audiences including executives, security operations teams, and technical analysts. Use when producing finished intelligence products from raw collection data, creating sector threat briefings, or delivering post-incident intelligence assessments. Activates for requests involving CTI report writing, threat briefings, intelligence products, finished intelligence, or executive security reporting.
by mukul975/Anthropic-Cybersecurity-Skills / skills/generating-threat-intelligence-reports
Gha Security Review
GitHub Actions security review for workflow exploitation vulnerabilities. Use when asked to "review GitHub Actions", "audit workflows", "check CI security", "GHA security", "workflow security review", or review .github/workflows/ for pwn requests, expression injection, credential theft, and supply chain attacks. Exploitation-focused with concrete PoC scenarios.
by getsentry/skills / skills/gha-security-review
Hardening Docker Containers For Production
Hardening Docker containers for production involves applying security best practices aligned with CIS Docker Benchmark v1.8.0 to minimize attack surface, prevent privilege escalation, and enforce leas
by mukul975/Anthropic-Cybersecurity-Skills / skills/hardening-docker-containers-for-production
Hardening Docker Daemon Configuration
Harden the Docker daemon by configuring daemon.json with user namespace remapping, TLS authentication, rootless mode, and CIS benchmark controls.
by mukul975/Anthropic-Cybersecurity-Skills / skills/hardening-docker-daemon-configuration
Hardening Linux Endpoint With Cis Benchmark
Hardens Linux endpoints using CIS Benchmark recommendations for Ubuntu, RHEL, and CentOS to reduce attack surface, enforce security baselines, and meet compliance requirements. Use when deploying new Linux servers, remediating audit findings, or establishing security baselines for Linux infrastructure. Activates for requests involving Linux hardening, CIS benchmarks for Linux, server security baselines, or Linux configuration compliance.
by mukul975/Anthropic-Cybersecurity-Skills / skills/hardening-linux-endpoint-with-cis-benchmark
Hardening Windows Endpoint With Cis Benchmark
Hardens Windows endpoints using CIS (Center for Internet Security) Benchmark recommendations to reduce attack surface, enforce security baselines, and meet compliance requirements. Use when deploying new Windows workstations or servers, remediating audit findings, or establishing organization-wide security baselines. Activates for requests involving Windows hardening, CIS benchmarks, GPO security baselines, or endpoint configuration compliance.
by mukul975/Anthropic-Cybersecurity-Skills / skills/hardening-windows-endpoint-with-cis-benchmark
Healthcheck
Audit/harden OpenClaw hosts: SSH, firewall, updates, exposure, backups, disk encryption, gateway security.
by openclaw/openclaw / skills/healthcheck
Hipaa Check
Check code for HIPAA compliance violations and PII/PHI exposure. Use when reviewing healthcare applications, checking for data privacy issues, or when user asks about HIPAA compliance.
by prshahbs/healthcare-claude-skills / .claude/skills/hipaa-check
Hone
Auditing and optimizing AI CLI configuration. Audits Codex CLI (~/.codex/), Antigravity CLI (~/.gemini/ — `agy`), and Claude Code (~/.claude/) configs (config.toml/settings.json/CLAUDE.md/hooks/MCP) and proposes Before/After diff improvements. Never edits configs directly. Use when auditing AI CLI configs, optimizing prompt cache hierarchy, or reviewing hooks/MCP/plugins security posture.
by simota/agent-skills / hone
Hunting Advanced Persistent Threats
Proactively hunts for Advanced Persistent Threat (APT) activity within enterprise environments using hypothesis-driven searches across endpoint telemetry, network logs, and memory artifacts. Use when conducting scheduled threat hunting cycles, investigating anomalous behavior flagged by UEBA, or validating that known APT TTPs are not present in the environment. Activates for requests involving MITRE ATT&CK, Velociraptor, osquery, Zeek, or threat hunting playbooks.
by mukul975/Anthropic-Cybersecurity-Skills / skills/hunting-advanced-persistent-threats
Hunting Credential Stuffing Attacks
Detects credential stuffing attacks by analyzing authentication logs for login velocity anomalies, ASN diversity, password spray patterns, and geographic distribution of failed logins. Uses statistical analysis on Splunk or raw log data. Use when investigating account takeover campaigns or building detection rules for auth abuse.
by mukul975/Anthropic-Cybersecurity-Skills / skills/hunting-credential-stuffing-attacks
Hunting For Anomalous Powershell Execution
Hunt for malicious PowerShell activity by analyzing Script Block Logging (Event 4104), Module Logging (Event 4103), and process creation events. The analyst parses Windows Event Log EVTX files to detect obfuscated commands, AMSI bypass attempts, encoded payloads, credential dumping keywords, and suspicious download cradles. Activates for requests involving PowerShell threat hunting, script block analysis, encoded command detection, or AMSI bypass identification.
by mukul975/Anthropic-Cybersecurity-Skills / skills/hunting-for-anomalous-powershell-execution
Hunting For Beaconing With Frequency Analysis
Identify command-and-control beaconing patterns in network traffic by applying statistical frequency analysis, jitter calculation, and coefficient of variation scoring to detect periodic callbacks from compromised endpoints.
by mukul975/Anthropic-Cybersecurity-Skills / skills/hunting-for-beaconing-with-frequency-analysis
Hunting For Cobalt Strike Beacons
Detect Cobalt Strike beacon network activity using default TLS certificate signatures (serial 8BB00EE), JA3/JA3S/JARM fingerprints, HTTP C2 profile pattern matching, beacon jitter analysis, and named pipe detection via Zeek, Suricata, and Python PCAP analysis.
by mukul975/Anthropic-Cybersecurity-Skills / skills/hunting-for-cobalt-strike-beacons
Hunting For Command And Control Beaconing
Detect C2 beaconing patterns in network traffic using frequency analysis, jitter detection, and domain reputation to identify compromised endpoints communicating with adversary infrastructure.
by mukul975/Anthropic-Cybersecurity-Skills / skills/hunting-for-command-and-control-beaconing
Hunting For Data Exfiltration Indicators
Hunt for data exfiltration through network traffic analysis, detecting unusual data flows, DNS tunneling, cloud storage uploads, and encrypted channel abuse.
by mukul975/Anthropic-Cybersecurity-Skills / skills/hunting-for-data-exfiltration-indicators
Hunting For Data Staging Before Exfiltration
Detect data staging activity before exfiltration by monitoring for archive creation with 7-Zip/RAR, unusual temp folder access, large file consolidation, and staging directory patterns via EDR and process telemetry
by mukul975/Anthropic-Cybersecurity-Skills / skills/hunting-for-data-staging-before-exfiltration
Hunting For Dcom Lateral Movement
Hunt for DCOM-based lateral movement by detecting abuse of MMC20.Application, ShellBrowserWindow, and ShellWindows COM objects through Sysmon Event ID 1 (process creation) and Event ID 3 (network connection) correlation, WMI event analysis, RPC endpoint mapper traffic on port 135, and DCOM-specific parent-child process relationships.
by mukul975/Anthropic-Cybersecurity-Skills / skills/hunting-for-dcom-lateral-movement
Hunting For Dcsync Attacks
Detect DCSync attacks by analyzing Windows Event ID 4662 for unauthorized DS-Replication-Get-Changes requests from non-domain-controller accounts.
by mukul975/Anthropic-Cybersecurity-Skills / skills/hunting-for-dcsync-attacks
Hunting For Defense Evasion Via Timestomping
Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT. Uses analyzeMFT and Python to identify files with anomalous temporal patterns indicating anti-forensic timestomping activity.
by mukul975/Anthropic-Cybersecurity-Skills / skills/hunting-for-defense-evasion-via-timestomping
Hunting For DNS Based Persistence
Hunt for DNS-based persistence mechanisms including DNS hijacking, dangling CNAME records, wildcard DNS abuse, and unauthorized zone modifications using passive DNS databases, SecurityTrails API, and DNS audit log analysis.
by mukul975/Anthropic-Cybersecurity-Skills / skills/hunting-for-dns-based-persistence
Hunting For DNS Tunneling With Zeek
Detect DNS tunneling and data exfiltration by analyzing Zeek dns.log for high-entropy subdomain queries, excessive query volume, long query lengths, and unusual DNS record types indicating covert channel communication.
by mukul975/Anthropic-Cybersecurity-Skills / skills/hunting-for-dns-tunneling-with-zeek
Hunting For Domain Fronting C2 Traffic
Detect domain fronting C2 traffic by analyzing SNI vs HTTP Host header mismatches in proxy logs and TLS certificate discrepancies using pyOpenSSL for certificate inspection
by mukul975/Anthropic-Cybersecurity-Skills / skills/hunting-for-domain-fronting-c2-traffic
Hunting For Lateral Movement Via Wmi
Detect WMI-based lateral movement by analyzing Windows Event ID 4688 process creation and Sysmon Event ID 1 for WmiPrvSE.exe child process patterns, remote process execution, and WMI event subscription persistence.
by mukul975/Anthropic-Cybersecurity-Skills / skills/hunting-for-lateral-movement-via-wmi
Hunting For Living Off The Cloud Techniques
Hunt for adversary abuse of legitimate cloud services for C2, data staging, and exfiltration including abuse
by mukul975/Anthropic-Cybersecurity-Skills / skills/hunting-for-living-off-the-cloud-techniques
Hunting For Living Off The Land Binaries
Proactively hunt for adversary abuse of legitimate system binaries (LOLBins) to execute malicious payloads while evading detection.
by mukul975/Anthropic-Cybersecurity-Skills / skills/hunting-for-living-off-the-land-binaries
Hunting For Lolbins Execution In Endpoint Logs
Hunt for adversary abuse of Living Off the Land Binaries (LOLBins) by analyzing endpoint process creation logs for suspicious execution patterns of legitimate Windows system binaries used for malicious purposes.
by mukul975/Anthropic-Cybersecurity-Skills / skills/hunting-for-lolbins-execution-in-endpoint-logs
Hunting For Ntlm Relay Attacks
Detect NTLM relay attacks by analyzing Windows Event 4624 logon type 3 with NTLMSSP authentication, identifying IP-to-hostname mismatches, Responder traffic signatures, SMB signing status, and suspicious authentication patterns across the domain.
by mukul975/Anthropic-Cybersecurity-Skills / skills/hunting-for-ntlm-relay-attacks
Hunting For Persistence Mechanisms In Windows
Systematically hunt for adversary persistence mechanisms across Windows endpoints including registry, services, startup folders, and WMI subscriptions.
by mukul975/Anthropic-Cybersecurity-Skills / skills/hunting-for-persistence-mechanisms-in-windows
Hunting For Persistence Via Wmi Subscriptions
Hunt for adversary persistence through Windows Management Instrumentation event subscriptions by monitoring WMI consumer, filter, and binding creation events that execute malicious code triggered by system events.
by mukul975/Anthropic-Cybersecurity-Skills / skills/hunting-for-persistence-via-wmi-subscriptions
Hunting For Process Injection Techniques
Detect process injection techniques (T1055) including CreateRemoteThread, process hollowing, and DLL injection via Sysmon Event IDs 8 and 10 and EDR process telemetry
by mukul975/Anthropic-Cybersecurity-Skills / skills/hunting-for-process-injection-techniques