Security & Compliance Skills
902 curated security and compliance skills for AI coding agents. Access control, vulnerability scanning, compliance audit - all license-verified.
Monitoring Scada Modbus Traffic Anomalies
Monitors Modbus TCP traffic on SCADA and ICS networks to detect anomalous function code usage, unauthorized register writes, and suspicious communication patterns. The analyst uses deep packet inspection with pymodbus, Scapy, and Zeek to baseline normal PLC/RTU communication behavior, then applies statistical and rule-based anomaly detection to identify reconnaissance, parameter manipulation, and denial-of-service attacks targeting Modbus devices on port 502. Activates for requests involving Modbus traffic analysis, SCADA network monitoring, ICS anomaly detection, PLC security monitoring, or OT network threat detection.
by mukul975/Anthropic-Cybersecurity-Skills / skills/monitoring-scada-modbus-traffic-anomalies
Nemo Guardrails
NVIDIA's runtime safety framework for LLM applications. Features jailbreak detection, input/output validation, fact-checking, hallucination detection, PII filtering, toxicity detection. Uses Colang 2.0 DSL for programmable rails. Production-ready, runs on T4 GPU.
by Orchestra-Research/AI-Research-SKILLs / 07-safety-alignment/nemo-guardrails
OAuth
Implements OAuth 2.0/2.1 authorization flows in Fastify applications — configures authorization code with PKCE, client credentials, device flow, refresh token rotation, JWT validation, and token introspection/revocation endpoints. Use when setting up authentication, authorization, login flows, access tokens, API security, or securing Fastify routes with OAuth; also applies when troubleshooting token validation errors, mismatched redirect URIs, CSRF issues, scope problems, or RFC 6749/6750/7636/8252/8628 compliance questions.
by mcollina/skills / skills/oauth
Openclaw Ghsa Maintainer
Inspect, patch, validate, publish, or confirm OpenClaw GHSA security advisories and private-fork state.
by openclaw/openclaw / .agents/skills/openclaw-ghsa-maintainer
Oss Forensics
Supply chain investigation, evidence recovery, and forensic analysis for GitHub repositories. Covers deleted commit recovery, force-push detection, IOC extraction, multi-source evidence collection, hypothesis formation/validation, and structured forensic reporting. Inspired by RAPTOR's 1800+ line OSS Forensics system.
by NousResearch/hermes-agent / optional-skills/security/oss-forensics
Patent Novelty Check
Assess patent novelty and non-obviousness against prior art. Use when user says "专利查新", "patent novelty", "可专利性评估", "patentability check", or wants to evaluate if an invention is patentable.
by wanshuiyin/Auto-claude-code-research-in-sleep / skills/skills-codex/patent-novelty-check
Performing Access Recertification With Saviynt
Configure and execute access recertification campaigns in Saviynt Enterprise Identity Cloud to validate user entitlements, revoke excessive access, and maintain compliance with SOX, SOC2, and HIPAA.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-access-recertification-with-saviynt
Performing Access Review And Certification
Conduct systematic access reviews and certifications to ensure users have appropriate access rights aligned with their roles. This skill covers review campaign design, reviewer selection, risk-based p
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-access-review-and-certification
Performing Active Directory Bloodhound Analysis
Use BloodHound and SharpHound to enumerate Active Directory relationships and identify attack paths from compromised users to Domain Admin.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-active-directory-bloodhound-analysis
Performing Active Directory Compromise Investigation
Investigate Active Directory compromise by analyzing authentication logs, replication metadata, Group Policy changes, and Kerberos ticket anomalies to identify attacker persistence and lateral movement paths.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-active-directory-compromise-investigation
Performing Active Directory Forest Trust Attack
Enumerate and audit Active Directory forest trust relationships using impacket for SID filtering analysis, trust key extraction, cross-forest SID history abuse detection, and inter-realm Kerberos ticket assessment.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-active-directory-forest-trust-attack
Performing Active Directory Penetration Test
Conduct a focused Active Directory penetration test to enumerate domain objects, discover attack paths with BloodHound, exploit Kerberos weaknesses, escalate privileges via ADCS/DCSync, and demonstrate domain compromise.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-active-directory-penetration-test
Performing Active Directory Vulnerability Assessment
Assess Active Directory security posture using PingCastle, BloodHound, and Purple Knight to identify misconfigurations, privilege escalation paths, and attack vectors.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-active-directory-vulnerability-assessment
Performing Adversary In The Middle Phishing Detection
Detect and respond to Adversary-in-the-Middle (AiTM) phishing attacks that use reverse proxy kits like EvilProxy, Evilginx, and Tycoon 2FA to bypass MFA and steal session tokens.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-adversary-in-the-middle-phishing-detection
Performing Agentless Vulnerability Scanning
Configure and execute agentless vulnerability scanning using network protocols, cloud snapshot analysis, and API-based discovery to assess systems without installing endpoint agents.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-agentless-vulnerability-scanning
Performing AI Driven Osint Correlation
Use AI and LLM-based reasoning to correlate findings across multiple OSINT sources—username enumeration, email lookups, social media profiles, domain records, breach databases, and dark-web mentions—into unified intelligence profiles with confidence scoring and link analysis.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-ai-driven-osint-correlation
Performing Alert Triage With Elastic Siem
Perform systematic alert triage in Elastic Security SIEM to rapidly classify, prioritize, and investigate security alerts for SOC operations.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-alert-triage-with-elastic-siem
Performing Android App Static Analysis With Mobsf
Performs automated static analysis of Android applications using Mobile Security Framework (MobSF) to identify hardcoded secrets, insecure permissions, vulnerable components, weak cryptography, and code-level security flaws without executing the application. Use when assessing Android APK/AAB files for security vulnerabilities before deployment, during penetration testing, or as part of CI/CD security gates. Activates for requests involving Android static analysis, MobSF scanning, APK security assessment, or mobile application code review.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-android-app-static-analysis-with-mobsf
Performing API Fuzzing With Restler
Uses Microsoft RESTler to perform stateful REST API fuzzing by automatically generating and executing test sequences that exercise API endpoints, discover producer-consumer dependencies between requests, and find security and reliability bugs. The tester compiles an OpenAPI specification into a RESTler fuzzing grammar, configures authentication, runs test/fuzz-lean/fuzz modes, and analyzes results for 500 errors, authentication bypasses, resource leaks, and payload injection vulnerabilities. Activates for requests involving API fuzzing, RESTler testing, stateful API testing, or automated API security scanning.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-api-fuzzing-with-restler
Performing API Inventory And Discovery
Performs API inventory and discovery to identify all API endpoints in an organization's environment including documented, undocumented, shadow, zombie, and deprecated APIs. The tester uses passive traffic analysis, active scanning, DNS enumeration, JavaScript analysis, and cloud resource inventory to build a comprehensive API catalog. Maps to OWASP API9:2023 Improper Inventory Management. Activates for requests involving API discovery, shadow API detection, API inventory audit, or attack surface mapping.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-api-inventory-and-discovery
Performing API Rate Limiting Bypass
Tests API rate limiting implementations for bypass vulnerabilities by manipulating request headers, IP addresses, HTTP methods, API versions, and encoding schemes to circumvent request throttling controls. The tester identifies rate limit headers, determines enforcement mechanisms, and attempts bypasses including X-Forwarded-For spoofing, parameter pollution, case variation, and endpoint path manipulation. Maps to OWASP API4:2023 Unrestricted Resource Consumption. Activates for requests involving rate limit bypass, API throttling evasion, brute force protection testing, or API abuse prevention assessment.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-api-rate-limiting-bypass
Performing API Security Testing With Postman
Uses Postman to perform structured API security testing by building collections that test for OWASP API Security Top 10 vulnerabilities including authentication bypass, authorization flaws, injection, and data exposure. The tester creates environments with multiple user roles, writes test scripts for automated security validation, and integrates Postman with OWASP ZAP and Newman for CI/CD security testing. Activates for requests involving Postman security testing, API security collection, automated API testing, or OWASP API testing with Postman.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-api-security-testing-with-postman
Performing Arp Spoofing Attack Simulation
Simulates ARP spoofing attacks in authorized lab or pentest environments using arpspoof, Ettercap, and Scapy to demonstrate man-in-the-middle risks, test network detection capabilities, and validate ARP inspection countermeasures.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-arp-spoofing-attack-simulation
Performing Asset Criticality Scoring For Vulns
Develop and apply a multi-factor asset criticality scoring model to weight vulnerability prioritization based on business impact, data sensitivity, and operational importance.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-asset-criticality-scoring-for-vulns
Performing Authenticated Scan With Openvas
Configure and execute authenticated vulnerability scans using OpenVAS/Greenbone Vulnerability Management with SSH and SMB credentials for comprehensive host-level assessment.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-authenticated-scan-with-openvas
Performing Authenticated Vulnerability Scan
Authenticated (credentialed) vulnerability scanning uses valid system credentials to log into target hosts and perform deep inspection of installed software, patches, configurations, and security sett
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-authenticated-vulnerability-scan
Performing Automated Malware Analysis With Cape
Deploy and operate CAPEv2 sandbox for automated malware analysis with behavioral monitoring, payload extraction, configuration parsing, and anti-evasion capabilities.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-automated-malware-analysis-with-cape
Performing AWS Account Enumeration With Scout Suite
Perform comprehensive security posture assessment of AWS accounts using ScoutSuite to enumerate resources, identify misconfigurations, and generate actionable security reports.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-aws-account-enumeration-with-scout-suite
Performing AWS Privilege Escalation Assessment
Performing authorized privilege escalation assessments in AWS environments to identify IAM misconfigurations that allow users or roles to elevate their permissions using Pacu, CloudFox, Principal Mapper, and manual IAM policy analysis techniques.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-aws-privilege-escalation-assessment
Performing Bandwidth Throttling Attack Simulation
Simulates bandwidth throttling and network degradation attacks using tc, iperf3, and Scapy in authorized environments to test quality-of-service controls, application resilience, and network monitoring detection of traffic manipulation attacks.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-bandwidth-throttling-attack-simulation
Performing Binary Exploitation Analysis
Analyze binary exploitation techniques including buffer overflows and ROP chains using pwntools Python library. Covers checksec analysis, gadget discovery with ROPgadget, and exploit development for CTF and authorized security assessments.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-binary-exploitation-analysis
Performing Blind Ssrf Exploitation
Detect and exploit blind Server-Side Request Forgery vulnerabilities using out-of-band techniques, DNS interactions, and timing analysis to access internal services and cloud metadata endpoints.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-blind-ssrf-exploitation
Performing Bluetooth Security Assessment
Assess Bluetooth Low Energy device security by scanning, enumerating GATT services, and detecting vulnerabilities
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-bluetooth-security-assessment
Performing Brand Monitoring For Impersonation
Monitor for brand impersonation attacks across domains, social media, mobile apps, and dark web channels to detect phishing campaigns, fake sites, and unauthorized brand usage targeting your organization.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-brand-monitoring-for-impersonation
Performing Clickjacking Attack Test
Testing web applications for clickjacking vulnerabilities by assessing frame embedding controls and crafting proof-of-concept overlay attacks during authorized security assessments.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-clickjacking-attack-test
Performing Cloud Asset Inventory With Cartography
Perform comprehensive cloud asset inventory and relationship mapping using Cartography to build a Neo4j security graph of infrastructure assets, IAM permissions, and attack paths across AWS, GCP, and Azure.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-cloud-asset-inventory-with-cartography
Performing Cloud Forensics Investigation
Conduct forensic investigations in cloud environments by collecting and analyzing logs, snapshots, and metadata from AWS, Azure, and GCP services.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-cloud-forensics-investigation
Performing Cloud Forensics With AWS Cloudtrail
Perform forensic investigation of AWS environments using CloudTrail logs to reconstruct attacker activity, identify compromised credentials, and analyze API call patterns.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-cloud-forensics-with-aws-cloudtrail
Performing Cloud Incident Containment Procedures
Execute cloud-native incident containment across AWS, Azure, and GCP by isolating compromised resources, revoking credentials, preserving forensic evidence, and applying security group restrictions to prevent lateral movement.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-cloud-incident-containment-procedures
Performing Cloud Log Forensics With Athena
Uses AWS Athena to query CloudTrail, VPC Flow Logs, S3 access logs, and ALB logs for forensic investigation. Covers CREATE TABLE DDL with partition projection, forensic SQL queries for detecting unauthorized access, data exfiltration, lateral movement, and privilege escalation. Use when investigating AWS security incidents or building cloud-native forensic workflows at scale.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-cloud-log-forensics-with-athena
Performing Cloud Native Forensics With Falco
Uses Falco YAML rules for runtime threat detection in containers and Kubernetes, monitoring syscalls for shell spawns, file tampering, network anomalies, and privilege escalation. Manages Falco rules via the Falco gRPC API and parses Falco alert output. Use when building container runtime security or investigating k8s cluster compromises.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-cloud-native-forensics-with-falco
Performing Cloud Native Threat Hunting With AWS Detective
Hunt for threats in AWS environments using Detective behavior graphs, entity investigation timelines, GuardDuty finding correlation, and automated entity profiling across IAM users, EC2 instances, and IP addresses.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-cloud-native-threat-hunting-with-aws-detective
Performing Cloud Penetration Testing With Pacu
Performing authorized AWS penetration testing using Pacu, the open-source AWS exploitation framework, to enumerate IAM configurations, discover privilege escalation paths, test credential harvesting, and validate security controls through systematic attack simulation.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-cloud-penetration-testing-with-pacu
Performing Cloud Storage Forensic Acquisition
Perform forensic acquisition and analysis of cloud storage services including Google Drive, OneDrive, Dropbox, and Box by collecting both API-based remote data and local sync client artifacts from endpoint devices.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-cloud-storage-forensic-acquisition
Performing Container Escape Detection
Detects container escape attempts by analyzing namespace configurations, privileged container checks, dangerous capability assignments, and host path mounts using the kubernetes Python client. Identifies CVE-2022-0492 style escapes via cgroup abuse. Use when auditing container security posture or investigating escape attempts.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-container-escape-detection
Performing Container Image Hardening
This skill covers hardening container images by minimizing attack surface, removing unnecessary packages, implementing multi-stage builds, configuring non-root users, and applying CIS Docker Benchmark recommendations to produce secure production-ready images.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-container-image-hardening
Performing Container Security Scanning with Trivy
Scan container images, filesystems, and Kubernetes manifests for vulnerabilities, misconfigurations, exposed
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-container-security-scanning-with-trivy
Performing Content Security Policy Bypass
Analyze and bypass Content Security Policy implementations to achieve cross-site scripting by exploiting misconfigurations, JSONP endpoints, unsafe directives, and policy injection techniques.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-content-security-policy-bypass
Performing Credential Access With Lazagne
Extract stored credentials from compromised endpoints using the LaZagne post-exploitation tool to recover passwords from browsers, databases, system vaults, and applications during authorized red team operations.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-credential-access-with-lazagne
Performing Cryptographic Audit Of Application
A cryptographic audit systematically reviews an application's use of cryptographic primitives, protocols, and key management to identify vulnerabilities such as weak algorithms, insecure modes, hardco
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-cryptographic-audit-of-application
Performing Csrf Attack Simulation
Testing web applications for Cross-Site Request Forgery vulnerabilities by crafting forged requests that exploit authenticated user sessions during authorized security assessments.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-csrf-attack-simulation
Performing Cve Prioritization With Kev Catalog
Leverage the CISA Known Exploited Vulnerabilities catalog alongside EPSS and CVSS to prioritize CVE remediation based on real-world exploitation evidence.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-cve-prioritization-with-kev-catalog
Performing Dark Web Monitoring For Threats
Dark web monitoring involves systematically scanning Tor hidden services, underground forums, paste sites, and dark web marketplaces to identify threats targeting an organization, including leaked cre
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-dark-web-monitoring-for-threats
Performing Deception Technology Deployment
Deploys deception technology including honeypots, honeytokens, and decoy systems to detect attackers who have bypassed perimeter defenses, providing high-fidelity alerts with near-zero false positive rates. Use when SOC teams need early warning of lateral movement, credential abuse, or internal reconnaissance by deploying convincing traps across the network.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-deception-technology-deployment
Performing Directory Traversal Testing
Testing web applications for path traversal vulnerabilities that allow reading or writing arbitrary files on the server by manipulating file path parameters.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-directory-traversal-testing
Performing Disk Forensics Investigation
Conducts disk forensics investigations using forensic imaging, file system analysis, artifact recovery, and timeline reconstruction to support incident response cases. Utilizes tools such as FTK Imager, Autopsy, and The Sleuth Kit for evidence acquisition, deleted file recovery, and artifact examination. Activates for requests involving disk forensics, hard drive analysis, forensic imaging, file recovery, evidence acquisition, or digital forensic investigation.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-disk-forensics-investigation
Performing Dmarc Policy Enforcement Rollout
Execute a phased DMARC rollout from p=none monitoring through p=quarantine to p=reject enforcement, ensuring all legitimate email sources are authenticated before blocking unauthorized senders.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-dmarc-policy-enforcement-rollout
Performing DNS Enumeration And Zone Transfer
Enumerates DNS records, attempts zone transfers, brute-forces subdomains, and maps DNS infrastructure during authorized reconnaissance to identify attack surface, misconfigurations, and information disclosure in target domains.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-dns-enumeration-and-zone-transfer
Performing DNS Tunneling Detection
Detects DNS tunneling by computing Shannon entropy of DNS query names, analyzing query length distributions, inspecting TXT record payloads, and identifying high subdomain cardinality. Uses scapy for packet capture analysis and statistical methods to distinguish legitimate DNS from covert channels. Use when hunting for data exfiltration.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-dns-tunneling-detection
Performing Docker Bench Security Assessment
Docker Bench for Security is an open-source script that checks dozens of common best practices around deploying Docker containers in production. Based on the CIS Docker Benchmark, it audits host confi
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-docker-bench-security-assessment
Performing Dynamic Analysis Of Android App
Performs runtime dynamic analysis of Android applications using Frida, Objection, and Android Debug Bridge to observe application behavior during execution, intercept function calls, modify runtime values, and identify vulnerabilities that static analysis misses. Use when testing Android apps for runtime security flaws, hooking sensitive methods, bypassing client-side protections, or analyzing obfuscated applications. Activates for requests involving Android dynamic analysis, runtime hooking, Frida Android instrumentation, or live app behavior analysis.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-dynamic-analysis-of-android-app
Performing Dynamic Analysis With Any Run
Performs interactive dynamic malware analysis using the ANY.RUN cloud sandbox to observe real-time execution behavior, interact with malware prompts, and capture process trees, network traffic, and system changes. Activates for requests involving interactive sandbox analysis, cloud-based malware detonation, real-time behavioral observation, or ANY.RUN usage.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-dynamic-analysis-with-any-run
Performing Endpoint Forensics Investigation
Performs digital forensics investigation on compromised endpoints including memory acquisition, disk imaging, artifact analysis, and timeline reconstruction. Use when investigating security incidents, collecting evidence for legal proceedings, or analyzing endpoint compromise scope. Activates for requests involving endpoint forensics, memory analysis, disk forensics, or incident investigation.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-endpoint-forensics-investigation
Performing Endpoint Vulnerability Remediation
Performs vulnerability remediation on endpoints by prioritizing CVEs based on risk scoring, deploying patches, applying configuration changes, and validating fixes. Use when remediating findings from vulnerability scans, responding to critical CVE advisories, or maintaining endpoint compliance with patch management SLAs. Activates for requests involving vulnerability remediation, CVE patching, endpoint vulnerability management, or security fix deployment.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-endpoint-vulnerability-remediation
Performing Entitlement Review With Sailpoint Iiq
Performs entitlement review and access certification campaigns using SailPoint IdentityIQ including manager certifications, targeted entitlement reviews, role-based access validation, SOD violation remediation, and automated revocation workflows. Activates for requests involving access reviews, entitlement certifications, SailPoint IIQ governance, or periodic user access recertification.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-entitlement-review-with-sailpoint-iiq
Performing External Network Penetration Test
Conduct a comprehensive external network penetration test to identify vulnerabilities in internet-facing infrastructure using PTES methodology, reconnaissance, scanning, exploitation, and reporting.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-external-network-penetration-test
Performing False Positive Reduction In Siem
Perform systematic SIEM false positive reduction through rule tuning, threshold adjustment, correlation refinement, and threat intelligence enrichment to combat alert fatigue.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-false-positive-reduction-in-siem
Performing File Carving With Foremost
Recover files from disk images and unallocated space using Foremost's header-footer signature carving to extract evidence regardless of file system state.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-file-carving-with-foremost
Performing Firmware Extraction With Binwalk
Performs firmware image extraction and analysis using binwalk to identify embedded filesystems, compressed archives, bootloaders, kernel images, and cryptographic material. Covers entropy analysis for detecting encrypted or compressed regions, recursive extraction of nested archives, SquashFS/CramFS/JFFS2 filesystem mounting, and string analysis for credential and configuration discovery. Activates for requests involving firmware reverse engineering, IoT device analysis, embedded system security assessment, or router/camera firmware extraction.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-firmware-extraction-with-binwalk
Performing Firmware Malware Analysis
Analyzes firmware images for embedded malware, backdoors, and unauthorized modifications targeting routers, IoT devices, UEFI/BIOS, and embedded systems. Covers firmware extraction, filesystem analysis, binary reverse engineering, and bootkit detection. Activates for requests involving firmware security analysis, IoT malware investigation, UEFI rootkit detection, or embedded device compromise assessment.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-firmware-malware-analysis
Performing Fuzzing With Aflplusplus
Perform coverage-guided fuzzing of compiled binaries using AFL++ (American Fuzzy Lop Plus Plus) to discover memory corruption, crashes, and security vulnerabilities. The tester instruments target binaries with afl-cc/afl-clang-fast, manages input corpora with afl-cmin and afl-tmin, runs parallel fuzzing campaigns with afl-fuzz, and triages crashes using CASR or GDB scripts. Activates for requests involving binary fuzzing, crash discovery, coverage-guided testing, or AFL++ fuzzing campaigns.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-fuzzing-with-aflplusplus
Performing GCP Penetration Testing With Gcpbucketbrute
Perform GCP security testing using GCPBucketBrute for storage bucket enumeration, gcloud IAM privilege escalation path analysis, and service account permission auditing
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-gcp-penetration-testing-with-gcpbucketbrute
Performing GCP Security Assessment With Forseti
Performing comprehensive security assessments of Google Cloud Platform environments using Forseti Security, Security Command Center, and gcloud CLI to audit IAM policies, firewall rules, storage permissions, and compliance against CIS GCP Foundations Benchmark.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-gcp-security-assessment-with-forseti
Performing GraphQL Depth Limit Attack
Execute and test GraphQL depth limit attacks using deeply nested recursive queries to identify denial-of-service vulnerabilities in GraphQL APIs.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-graphql-depth-limit-attack
Performing GraphQL Introspection Attack
Performs GraphQL introspection attacks to extract the full API schema including types, queries, mutations, subscriptions, and field definitions from GraphQL endpoints. The tester uses introspection queries to map the attack surface, identifies sensitive fields and mutations, tests for query depth and complexity limits, and exploits GraphQL-specific vulnerabilities including batching attacks, alias-based brute force, and nested query DoS. Activates for requests involving GraphQL security testing, introspection attack, GraphQL enumeration, or GraphQL API penetration testing.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-graphql-introspection-attack
Performing GraphQL Security Assessment
Assessing GraphQL API endpoints for introspection leaks, injection attacks, authorization flaws, and denial-of-service vulnerabilities during authorized security tests.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-graphql-security-assessment
Performing Hardware Security Module Integration
Integrate Hardware Security Modules (HSMs) using PKCS#11 interface for cryptographic key management, signing operations, and secure key storage with python-pkcs11, AWS CloudHSM, and YubiHSM2.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-hardware-security-module-integration
Performing Hash Cracking With Hashcat
Hash cracking is an essential skill for penetration testers and security auditors to evaluate password strength. Hashcat is the world's fastest password recovery tool, supporting over 300 hash types w
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-hash-cracking-with-hashcat
Performing HTTP Parameter Pollution Attack
Execute HTTP Parameter Pollution attacks to bypass input validation, WAF rules, and security controls by injecting duplicate parameters that are processed differently by front-end and back-end systems.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-http-parameter-pollution-attack
Performing Ics Asset Discovery With Claroty
Perform comprehensive ICS/OT asset discovery using Claroty xDome platform, leveraging passive monitoring, Claroty Edge active queries, and integration ecosystem to gain full visibility into industrial control system assets including PLCs, RTUs, HMIs, and network infrastructure across Purdue Model levels.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-ics-asset-discovery-with-claroty
Performing Indicator Lifecycle Management
Indicator lifecycle management tracks IOCs from initial discovery through validation, enrichment, deployment, monitoring, and eventual retirement. This skill covers implementing systematic processes f
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-indicator-lifecycle-management
Performing Initial Access With Evilginx3
Perform authorized initial access using EvilGinx3 adversary-in-the-middle phishing framework to capture session tokens and bypass multi-factor authentication during red team engagements.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-initial-access-with-evilginx3
Performing Insider Threat Investigation
Investigates insider threat incidents involving employees, contractors, or trusted partners who misuse authorized access to steal data, sabotage systems, or violate security policies. Combines digital forensics, user behavior analytics, and HR/legal coordination to build an evidence-based case. Activates for requests involving insider threat investigation, employee data theft, privilege misuse, user behavior anomaly, or internal threat detection.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-insider-threat-investigation
Performing Ioc Enrichment Automation
Automates Indicator of Compromise (IOC) enrichment by orchestrating lookups across VirusTotal, AbuseIPDB, Shodan, MISP, and other intelligence sources to provide contextual scoring and disposition recommendations. Use when SOC analysts need rapid multi-source enrichment of IPs, domains, URLs, and file hashes during alert triage or incident investigation.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-ioc-enrichment-automation
Performing iOS App Security Assessment
Performs comprehensive iOS application security assessments using Frida for dynamic instrumentation, Objection for runtime exploration, SSL pinning bypass for traffic interception, keychain extraction for credential analysis, and IPA static analysis for binary-level review. Use when conducting authorized iOS penetration tests, evaluating mobile app security posture against OWASP MASTG, or assessing iOS app data protection and transport security controls. Activates for requests involving iOS app pentesting, Frida-based iOS instrumentation, mobile app SSL pinning bypass, or IPA reverse engineering.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-ios-app-security-assessment
Performing IoT Security Assessment
Performs comprehensive security assessments of IoT devices and their ecosystems by testing hardware interfaces, firmware, network communications, cloud APIs, and companion mobile applications. The tester uses firmware extraction and analysis, hardware debugging via UART and JTAG, network protocol analysis, and runtime exploitation to identify vulnerabilities across all layers of the IoT stack. Activates for requests involving IoT security testing, embedded device assessment, firmware security analysis, or smart device penetration testing.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-iot-security-assessment
Performing Ip Reputation Analysis With Shodan
Analyze IP address reputation using the Shodan API to identify open ports, running services, known vulnerabilities, and hosting context for threat intelligence enrichment and incident triage.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-ip-reputation-analysis-with-shodan
Performing JWT None Algorithm Attack
Execute and test the JWT none algorithm attack to bypass signature verification by manipulating the alg header field in JSON Web Tokens.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-jwt-none-algorithm-attack
Performing Kerberoasting Attack
Kerberoasting is a post-exploitation technique that targets service accounts in Active Directory by requesting Kerberos TGS (Ticket Granting Service) tickets for accounts with Service Principal Names
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-kerberoasting-attack
Performing Kubernetes Cis Benchmark With Kube Bench
Audit Kubernetes cluster security posture against CIS benchmarks using kube-bench with automated checks for control plane, worker nodes, and RBAC.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-kubernetes-cis-benchmark-with-kube-bench
Performing Kubernetes Etcd Security Assessment
Assess the security posture of Kubernetes etcd clusters by evaluating encryption at rest, TLS configuration, access controls, backup encryption, and network isolation.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-kubernetes-etcd-security-assessment
Performing Kubernetes Penetration Testing
Kubernetes penetration testing systematically evaluates cluster security by simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policies, and secrets. Using tools
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-kubernetes-penetration-testing
Performing Lateral Movement Detection
Detects lateral movement techniques including Pass-the-Hash, PsExec, WMI execution, RDP pivoting, and SMB-based spreading using SIEM correlation of Windows event logs, network flow data, and endpoint telemetry mapped to MITRE ATT&CK Lateral Movement (TA0008) techniques.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-lateral-movement-detection
Performing Lateral Movement With Wmiexec
Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-lateral-movement-with-wmiexec
Performing Linux Log Forensics Investigation
Perform forensic investigation of Linux system logs including syslog, auth.log, systemd journal, kern.log, and application logs to reconstruct user activity, detect unauthorized access, and establish event timelines on compromised Linux systems.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-linux-log-forensics-investigation
Performing Log Analysis For Forensic Investigation
Collect, parse, and correlate system, application, and security logs to reconstruct events and establish timelines during forensic investigations.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-log-analysis-for-forensic-investigation
Performing Log Source Onboarding In Siem
Perform structured log source onboarding into SIEM platforms by configuring collectors, parsers, normalization, and validation for complete security visibility.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-log-source-onboarding-in-siem
Performing Malware Hash Enrichment With Virustotal
Enrich malware file hashes using the VirusTotal API to retrieve detection rates, behavioral analysis, YARA matches, and contextual threat intelligence for incident triage and IOC validation.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-malware-hash-enrichment-with-virustotal
Performing Malware Ioc Extraction
Malware IOC extraction is the process of analyzing malicious software to identify actionable indicators of compromise including file hashes, network indicators (C2 domains, IP addresses, URLs), regist
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-malware-ioc-extraction
Performing Malware Persistence Investigation
Systematically investigate all persistence mechanisms on Windows and Linux systems to identify how malware survives reboots and maintains access.
by mukul975/Anthropic-Cybersecurity-Skills / skills/performing-malware-persistence-investigation