Anthropic Cybersecurity Skills: the largest open library of cybersecurity skills for AI agents

Everything worth knowing about mukul975/Anthropic-Cybersecurity-Skills: a library of 817 Markdown-structured skills that gives any AI agent the workflows of a senior security analyst, mapped to six industry frameworks and built on the open agentskills.io standard.

What Anthropic Cybersecurity Skills is

Anthropic Cybersecurity Skills is not a model, a server, or an exploitation tool — it’s an operational knowledge library made up of 817 structured skills (the README announces 818 in some counters) spread across 34 security domains. Each skill is a folder with a SKILL.md file that follows the open agentskills.io standard: YAML metadata for agent discovery and a Markdown body describing when to use it, its preconditions, the step-by-step flow, and how to verify the result.

The stated purpose is closing an AI agent’s knowledge gap: a junior analyst knows which Volatility3 plugin to run against a memory dump or which Sigma rules catch Kerberoasting, but a generic agent doesn’t unless given those instructions. The library maps each skill to six frameworks: MITRE ATT&CK (805 of 817 mapped), NIST CSF 2.0 (804), MITRE D3FEND (139), NIST AI RMF (97), the MITRE Fight Fraud Framework F3 (94), and MITRE ATLAS (93). Domains range from cloud security (66 skills), SOC operations (63), and threat hunting (58), down to fine-grained domains like red team and firmware (6), deception technology (6), or blockchain (2).

An important caveat the README itself puts front and center: it’s an independent community project, with no affiliation to Anthropic PBC (the “Anthropic” in the title refers to the agent ecosystem where the skills format was born, not the company). The material includes offensive and dual-use techniques — red-team C2 networks, phishing simulation, exploitation — and is intended only for authorized penetration testing, defensive research, and education, with explicit written permission for tested systems.

Origin: Mahipal Jangra and the 4.8-million-professional gap

The repository was created on February 25, 2026 by Mahipal Jangra (mukul975), a GitHub profile self-identified as “Cybersecurity | Dev | Street Photographer, MSc, Research & AI Security,” with a stated residence in Berlin and a personal blog at Mahipal.engineer. The README’s BibTeX citation confirms the full name: Jangra, Mahipal.

The README explains the motivation with numbers: the cybersecurity professional gap reached 4.8 million unfilled positions globally in 2024 (per ISC2, cited in the README). Existing security-tooling repositories offer wordlists, payloads, or exploit code, but none hands an agent the structured decision flow of a senior analyst: when to use each technique, which preconditions to check, how to execute step by step, and how to verify results. The author sums it up: “This isn’t a collection of scripts or checklists. It’s an AI-native knowledge base.”

The project launched with an unusual scale ambition for a community repo: the first formal release, v1.0.0 on March 11, 2026, already contained 734 skills across 26 domains with MITRE ATT&CK and NIST CSF 2.0 mapping and even a layer for the ATT&CK Navigator. Growth from there was fast: v1.1.0 (March 21), v1.2.0 (April 6, adding three more frameworks: ATLAS, D3FEND, and AI RMF), and v1.3.0 (June 22, the latest), which took the library from 762 to 817 skills, added the sixth framework (MITRE F3), and created three new domains: AI security, supply chain security, and hardware and firmware security.

The README also promotes the author’s own academic study, GARS-2026 (Global Agentic AI Readiness Survey), supervised by SRH Berlin, on how prepared security professionals and teams are for agentic AI, with results to be published open access under CC-BY 4.0. The same README links a “playground” at casky.ai, an environment for running skill exercises with no install; that third-party promotion inside the README is a tension worth noting: the library is open source under Apache 2.0, but its official page (mahipal.engineer) mixes the project with promotion of the study and that platform.

Philosophy and principles

Several verifiable principles emerge from the repository’s materials:

Operational knowledge, not summaries: each skill encodes a real professional’s workflow (trigger condition, preconditions, workflow with concrete commands, verification), not a popular-science article.
Progressive token-based discovery: each skill costs roughly 30 tokens in frontmatter alone and between 500 and 2,000 in its full payload, so an agent can scan all 817 skills in a single pass without exhausting the context window and load only the ones that fit.
Framework mapping as verification: technique identifiers (T1003, DE.CM-01, AML.T0047, D3-NTA, F1005.006…) were programmatically validated against each framework’s official versions (the v1.3.0 note states F3 v1.1’s 123 techniques were checked against the upstream STIX bundle, and ATT&CK IDs were revalidated with the official mitreattack-python library).
Open standard as the contract: the entire format follows agentskills.io, so the library works with zero configuration on any platform supporting that standard, and isn’t locked to a single agent.
Authorized use by default: the README’s warning banner and SECURITY.md define the legal scope of the offensive material.

Progressive token-based skill scanning: an AI agent scanning a massive grid of 817 frontmatter chips, with twelve candidates highlighted before loading the full payload

How it works

The documented flow for an agent, per the README:

The user makes a request, e.g. “analyze this memory dump for credential theft.”
The agent scans the 817 skills’ frontmatter (~30 tokens each), and by matching tags, descriptions, and domain, identifies candidates (the README’s example: 12).
It loads the best full matches (the example: performing-memory-forensics-with-volatility3, hunting-for-credential-dumping-lsass, analyzing-windows-event-logs-for-credential-access).
It executes the Workflow section step by step and confirms with the Verification section (in the example, confirming IOCs and mapping the finding to ATT&CK T1003, Credential Dumping).

An AI agent performing memory forensics in a simulated incident-response scenario: LSASS processes and credential artifacts highlighted over a glowing memory dump

Every skill’s structure is uniform:

skills/performing-memory-forensics-with-volatility3/
├── SKILL.md              ← definition (YAML frontmatter + Markdown body)
├── references/
│   ├── standards.md      ← MITRE/NIST mappings
│   └── workflows.md      ← deep technical reference
├── scripts/
│   └── process.py        ← helper scripts
└── assets/
    └── template.md       ← report and checklist templates

The structure of a single skill folder: a central Markdown document opening to reveal YAML metadata, workflow steps, preconditions, verification checks, reference files, and helper scripts

The real frontmatter includes name, description (keyword-rich for discovery), domain, subdomain, tags, and the framework fields: atlas_techniques, d3fend_techniques, nist_ai_rmf, nist_csf, version, author, and license. The Markdown body has four fixed sections: When to Use, Prerequisites, Workflow, and Verification.

Mapping cybersecurity skills to six industry frameworks: interlocking neon rings representing MITRE ATT&CK, NIST CSF, MITRE D3FEND, NIST AI RMF, MITRE F3, and MITRE ATLAS, connected to a central skill matrix

Declared compatibility spans 26+ platforms: coding assistants (Claude Code, GitHub Copilot, Cursor, Windsurf, Cline, Aider, Continue, Roo Code, Amazon Q, Tabnine, Sourcegraph Cody, JetBrains AI), command-line agents (OpenAI Codex CLI, Gemini CLI), autonomous agents (Devin, Replit Agent, SWE-agent, OpenHands), and frameworks (LangChain, CrewAI, AutoGen, Semantic Kernel, Haystack, Vercel AI SDK, any MCP-compatible agent). The README also includes a compatibility badge for Nous Research’s Hermes.

An open agent-skills standard with cross-platform compatibility: a universal connector radiating light toward 26+ abstract clients — coding assistants, autonomous agents, and MCP tool nodes

The ecosystem

Repositories from the author (mukul975 / Mahipal Jangra)

mukul975/cve-mcp-server: a “production-grade” MCP server that exposes Claude to 27 security-intelligence tools across 21 APIs (CVE search, etc.); 1,302 stars and 225 forks (created April 14, 2026). It’s the natural complementary piece: while the skills library supplies knowledge, this MCP supplies data access.
mukul975/Privacy-Data-Protection-Skills: 282+ privacy and data-protection skills (GDPR, CCPA, EU AI Act, HIPAA, LGPD…), same skills pattern; 258 stars and 57 forks (created March 14, 2026). It’s the non-offensive “sibling” of the main library.
mukul975/Threatswarm: 27 limited-scope AI agents that execute the full attack chain (reconnaissance → exploitation → post-exploitation → DFIR); 74 stars and 23 forks (created April 29, 2026).
mukul975/Malware-Sandbox-mcp: an MCP for detonating files and URLs in cloud malware sandboxes (Hybrid Analysis, tria.ge, ANY.RUN) and enriching IOCs; 27 stars and 8 forks (created June 11, 2026).
mukul975/claude-team-dashboard: a real-time monitoring panel for Claude Code agent teams; 68 stars and 25 forks.
mukul975/awesome-ai-agents (17★), mukul975/awesome-cyber-skills (18★), mukul975/awesome-security (10★), and mukul975/awesome-mitre-attack (4★): the author’s own curated lists.
mukul975/BHUSA-Anthropic-CyberSecurity-Skills (5★, August 5, 2026) and mukul975/Bhusa-Antropic-demo (0★): working repositories for the Black Hat USA 2026 showcase.

The author also maintains database MCP servers (mysql-mcp-server, postgres-mcp-server) and a Windows automation one, showing a work profile centered on MCP and agent tooling.

Ports, translations, and mirrors

jeffrey1205/Anthropic-Cybersecurity-Skills-cn: a community Chinese translation (“Anthropic-Cybersecurity-Skills 中文翻译”); 3 stars (created May 27, 2026). It’s the only non-English port found in the search.
costrict-plugins-repo/mukul975-anthropic-cybersecurity-skills-cybersecurity-skills: an auto-generated mirror from the costrict platform (“mirror… auto-generated, do not edit”); 66 stars (created May 19, 2026).
No translations into other languages or re-implementation forks of a scale comparable to other skills categories were found.

vercel-labs/skills (30,018★): the npx skills tool that installs this library; it’s the open skills ecosystem’s infrastructure.
agentskills/agentskills: the agentskills.io standard’s specification and documentation.
0x4m4/hexstrike-ai (listed in ottosulin/awesome-ai-security): an MCP agent that lets Claude, GPT, and Copilot run 150+ cybersecurity tools for automated pentesting; a distinct adjacent project: HexStrike automates tool execution, while this library supplies workflow knowledge.
jaskaranhundal/usap-skills (listed in the same awesome list): 80 cybersecurity skills + 13 orchestrator agents with a typed output contract and a resolvable-evidence gate; it’s the most direct competitor in format (cybersecurity skills for agents) found in the sources consulted.
VoltAgent/awesome-agent-skills (33,371★) and ottosulin/awesome-ai-security (1,435★): the indexes where the library is catalogued alongside projects in the category.

Official and semi-official status

Standard: the library follows the open agentskills.io standard, maintained by the public agentskills/agentskills repository. This standard defines the canonical shape of a “skill” (a folder with a mandatory SKILL.md, optional scripts/, references/, and assets/) and now has an official Discord server. Being standard-conformant means any client implementing it can consume the library with no adaptation.
npx skills installer: the recommended install uses npx skills add mukul975/Anthropic-Cybersecurity-Skills. The npm skills package is from vercel-labs (“The open agent skills tool,” 30,018 stars per the API), meaning the recommended installer isn’t from the library’s author but from Vercel Labs; it’s semi-official infrastructure of the agent ecosystem.
Black Hat USA 2026: the project’s official page (mahipal.engineer/Anthropic-Cybersecurity-Skills) displays a “Featured — Black Hat USA 2026 · Arsenal Lab” badge, and the author maintains linked working repositories (mukul975/BHUSA-Anthropic-CyberSecurity-Skills and mukul975/Bhusa-Antropic-demo, both created August 5, 2026). Not verified in this research: Black Hat’s arsenal website wasn’t reachable from this environment (connection refused), so the convention presence couldn’t be directly confirmed; it should be read as the project’s own claim.
Directories: it’s listed on SkillsLLM (skillsllm.com/skill/anthropic-cybersecurity-skills), a verifying skills directory that shows it as “Verified” with 31,653 stars at check time, with a “Third-Party Software Notice” and a vulnerability-scan option.
Curated (awesome) lists: it appears in VoltAgent/awesome-agent-skills (33,371 stars) as “753 cybersecurity skills across 38 domains” (figures somewhat stale relative to the README), in ottosulin/awesome-ai-security (1,435 stars), and in RoggeOhta/awesome-codex-cli per the README.

In practice, being in the largest skills index (awesome-agent-skills), installing via the ecosystem’s npx skills tool, and being agentskills.io-conformant makes this library the de facto reference for the “cybersecurity skills for agents” category, within what these sources allow asserting; no formal certification from a vendor or MITRE is on record.

Quick-start guide

Installation and first boot

There are no binaries to compile or services to start — the library is content the agent reads.

# Recommended option 1: the ecosystem's installer (Vercel Labs' npm package)
npx skills add mukul975/Anthropic-Cybersecurity-Skills

# Option 2: manual clone
git clone https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
cd Anthropic-Cybersecurity-Skills

There are no configuration steps on first use: once in the platform’s skills directory (Claude Code, Codex CLI, Cursor, Gemini CLI, Copilot, or any of the 26+ compatible ones), the agent discovers all 817 skills via frontmatter and loads them on demand. The v1.3.0 note fixed a bug where plugin.json still said version 1.0.0 on installs: as of that version, plugin.json, marketplace.json, and the README auto-sync the count and version on every skills change.

Common workflows

Memory analysis (DFIR): ask “analyze this memory dump for credential theft”; the agent locates skills like performing-memory-forensics-with-volatility3 and hunting-for-credential-dumping-lsass, runs the workflow (Volatility3 plugins, LSASS-access pattern, correlation with event logs), and verifies IOCs, mapping the finding to T1003.
Bank fraud detection: the 94 F3-mapped skills let you follow an intrusion through to financial loss, using MITRE F3’s F1XXX identifiers (e.g. F1005.003 Add Beneficiary, F1025.003 Wire Transfer) and F3’s two exclusive tactics: Positioning and Monetization.
SIEM threat hunting: the Threat Hunting domain (58 skills) covers hypothesis-driven hunting, LOTL detection, EVTX hunting, and fleet-level hunting; for example, analyzing-network-traffic-of-malware maps to T1071 + DE.CM + AML.T0047 + D3-NTA.
Authorized red team: the Red Teaming domain (35 skills) covers ADCS/Certipy, BloodHound CE, C2 with Sliver/Havoc, and NTLM relay, with the permanent reminder that it only applies to systems you own or have written permission for.

Essential configuration

Since it’s not an application, the “settings” are the points a new user touches first:

Your platform’s skills directory: where npx skills or the clone deposits folders; if the agent doesn’t discover the skills, the problem is almost always the install destination.
SCOPE.md: the scope document; useful for knowing what’s covered and what’s out before relying on the library as a complete reference.
Each skill’s references/standards.md: where ATT&CK mappings and Navigator layers live; the piece that turns a finding into a framework-aligned report.
SECURITY.md and the README’s warning banner: define the legal use of the offensive material; worth reading before running any script in a sensitive environment.
docs/mitre-f3-mapping.md: the schema for the frontmatter’s mitre_f3 blocks, if working with fraud detection.

Common pitfalls and fixes

Antivirus flags the ZIP as malware: discussion #53 (“Is this a scam project? My Chrome browser detected a virus during download,” May 12, 2026, 4 comments) documents the case: user yydeepfam got a Trojan:Script/Wacatac.H!ml detection downloading the ZIP. The maintainer replied it’s a heuristic detection (the H!ml suffix indicates machine learning, not a signature) typical of Windows Defender on ZIPs with many offensive-themed Python/PowerShell scripts; recommended checking VirusTotal, cloning with git clone instead of downloading the ZIP, and reading scripts before running them. The same thread carries a comment from bokifide: their SOC got about 100 CrowdStrike alerts cloning the repo, and CrowdStrike removed the scripts before they could be used — a real practical risk for teams with strict EDR: the library may require deliberate, documented exclusions, or its use limited to isolated environments.
The skill count varies by source: the README says 818, the repo description and the v1.3.0 note say 817, the homepage says 754 (an older figure), and awesome-agent-skills says 753. The v1.3.0 note explains that as of that version the count auto-syncs across README, marketplace.json, and plugin.json; the lower figures come from earlier snapshots.
Skills aren’t direct execution instructions: the library gives the flow and commands, but agents must run on compatible platforms; if the agent “guesses” commands without the skills, the README warns critical steps get missed.

Integrations and migration

With MCP: the library combines with the author’s own MCP servers (cve-mcp-server for CVE intelligence, Malware-Sandbox-mcp for sandbox detonation), and with any MCP-compatible agent; the skills supply “what to do and how,” the MCPs supply “access to data and tools.”
With the agentskills.io standard: any client of the standard can consume it unchanged; for a custom agent, just point its skills loader at the cloned folder.
Migrating from other collections: “words and payloads” repositories (wordlists, exploits) aren’t replaced — they’re complemented. For projects in the same format, the verifiable difference is scope: jaskaranhundal/usap-skills offers 80 skills with a typed output contract and human-approval gating, while this library offers 817 skills mapped to six frameworks without that orchestration layer.
Migrating between versions: skills are independent folders; updating is a git pull (or re-running npx skills add), and framework mappings are revalidated by the project on every release (v1.3.0 revalidated everything against ATT&CK v19.1).

Repo numbers

Measured August 30, 2026, GitHub API.

Metric	Value
Stars	31,692
Forks	3,814
Subscribers (real watchers)	248
Commits on `main`	244
Open issues per the API	50
Primary language	Python (skill scripts)
License	Apache-2.0
Created	February 25, 2026
Last push	August 24, 2026
Latest release	`v1.3.0`, June 22, 2026

The top contributors per the README’s acknowledgments section (ordered by contribution count) are mukul975 (maintainer), valorisa (18), juliosuas (13), Daytona39264 (3), kevglynn (2), andrewibrah (2), and 9 contributors with one contribution each; the README states 14 contributors total. The 244-commit count came from the final page of the commits API’s pagination link. As always with the GitHub API, open_issues_count (50) may include open pull requests: the repo page showed 20 issues and 30 open pull requests, which sum to 50, so it should be read as the combined total, not an issues-only count. The API’s watchers_count field mirrors the star count; that’s why subscribers_count (248) is reported separately as the real subscriber number.

How to contribute

The process documented in CONTRIBUTING.md and the README:

Read SCOPE.md first to check the topic fits the library’s scope.
Follow CONTRIBUTING.md’s template to write the skill (frontmatter + four body sections).
Submit one skill per pull request, titled Add skill: your-skill-name.
Every PR is reviewed personally by the maintainer, “for technical accuracy and agentskills.io standard compliance.” The README admits the review queue “is longer than I’d like” and that some pull requests have been open for months; small, focused PRs move faster.
Beyond new skills, improvements to existing ones are equally valued (framework mappings, workflow fixes, tool-reference updates, new scripts and templates).

The README explicitly flags the finer-grained domains as the most valuable for new contributions: Data Protection and Purple Team (one skill each) and Blockchain, Wireless, and Privacy Compliance (two each). The project follows the Contributor Covenant as its code of conduct, and responsible disclosure is governed by SECURITY.md (48-hour acknowledgment). There’s a good first issue label to get started.

How the community received it

The evidence gathered in this research shows enthusiasm concentrated on social accounts and directories, a GitHub community discussion with concrete criticism, and an absence of large verifiable public threads on Hacker News:

Hacker News: searches for “Anthropic Cybersecurity Skills,” “mukul975,” “agentskills.io,” and variants returned no significant threads about this repository in the window checked. No points or comments are inferred beyond what the sources show.
GitHub Discussions (the project’s actual forum, active since April 2026):
- #53 “Is this a scam project? My Chrome browser detected a virus during download.” (yydeepfam, May 12, 2026, 2 votes, 4 comments): the most concrete criticism found; the debate over the antivirus false positive closes with the maintainer’s recommendations and bokifide’s CrowdStrike anecdote (see “Common pitfalls”).
- “#59” “v1.2.0 Released — Five Framework Coverage” (announcement, April 6, 6 votes) and “#58” “Adding MITRE Fight Fraud Framework (F3) mapping” (announcement, April 20, 2 votes): version announcements get brief reactions.
- “#54” “Is it possible to make a bulk selection or a select all button?” (fontvu, June 12, 6 votes, no reply): a UX request for the install selector.
- “#55” “Add IEC 62443 4-1, 4-2, and CRA and MITRE EMB3D it would be good” (HarishB1984, May 5, 2 votes): a request for more frameworks.
- “#52” “Feature Request: Add automated safety scanning for new AI skills via CI/CD” (ashp15205, July 1): a request for automated safety scanning, a sensitive topic given the library’s offensive content.
- “#56” “Interest in this project” (agustinafilosofia20-stack, May 28) and “#57” “What should we add in v1.3.0?” (mukul975, April 6, with participation from ai-craftsman404): signs of interest and open roadmap management.
X/Twitter: the project’s homepage collects screenshots from security accounts; the most relevant found in this research: @VivekIntel (Vivek, a cybersecurity content creator) with at least four threads between May 20 and June 25, 2026 (“one of the largest open-source cybersecurity skill libraries built for AI agents”); @RoyAmal (Amal Roy, May 29), who highlighted that the interest isn’t in “asking questions, generating payloads, and summarizing vulnerabilities” but in “operational security workflows”; and @RituWithAI (June 26), on using local terminals with the playbooks. The README also quotes Hasan Toor (@hasantoxr): “A database of real, organized security skills that any AI agent can plug into and use. Not tutorials. Not blog posts.,” and fazal-sec (Medium): “It’s a structured operational knowledge base designed for AI-driven security workflows.” Those quotes are the author’s own selection; the viral reach of each thread wasn’t verified.
Directories: SkillsLLM lists it as “Verified” with 31,653 stars (checked August 30, 2026) and applies its third-party software notice.
Reddit: no verifiable dedicated thread was found in the subreddits checked (r/cybersecurity, r/LocalLLaMA, r/programming, r/devops); direct Reddit access was blocked for this research, and PullPush’s public API returned no mentions of the project, so no Reddit presence is asserted.

In summary: verifiable public reception is strong in star volume (31,692 in six months), in directories and curated lists, and on security accounts on X; the criticism found is concrete and operational (antivirus false positives, a long review queue, inconsistent counts between sources), not about content quality.

Anthropic Cybersecurity Skills vs. other approaches

Approach	Verifiable overlap	Verifiable difference
`jaskaranhundal/usap-skills`	Cybersecurity skills for agents with ATT&CK + NIST CSF mapping, listed on the same awesome list.	80 skills + 13 orchestrator agents with an 11-field typed output contract, a “resolvable evidence” gate, and human approval for every mutating action; this library prioritizes scope (817 skills, 6 frameworks) over that orchestration scaffolding.
`0x4m4/hexstrike-ai`	Makes AI agents run cybersecurity automatedly.	An MCP server that automates 150+ pentesting tools; not a workflow knowledge library with framework mapping.
`mukul975/Threatswarm` (same author)	An AI agent for the full attack chain.	27 limited-scope execution agents; complements the library instead of replacing it: one executes, the other explains the procedure.
Exploit/wordlist collections	Offer offensive material.	Give payloads with no decision flow; this project’s README defines its proposition directly against that.

The most useful comparison is by role: within the “knowledge for security agents” category, this library is the widest-scope one found, and its differences from direct competitors lie in control scaffolding (USAP) or asset type (execution MCPs like HexStrike).

Use cases

SOC and threat-hunting analysts working with Claude Code, Codex CLI, Copilot, or another compatible agent: it lets the agent follow senior-level flows (63 SOC skills, 58 hunting skills) with concrete commands and verification, for example in log triage, LOTL hunting, or event correlation, instead of improvising queries.
DFIR teams: the Digital Forensics domain (41 skills: disk imaging, memory forensics, timelines with Hayabusa/KAPE/Plaso) and Incident Response (26 skills) give a standard path from the dump to mapping the finding to ATT&CK, with report templates in assets/.
Financial fraud detection teams: the 94 F3-mapped skills (v1.3.0) are the only case found connecting an intrusion to its Positioning and Monetization tactics (F1005.003 Add Beneficiary, F1025.003 Wire Transfer), relevant for banks and providers following the new April 2026 MITRE F3 framework.
Authorized red teams and pentesters: the Red Teaming (35), Penetration Testing (23), and 6 C2/lateral-movement skills (Sliver, Havoc, NetExec, NTLM relay) domains document the offensive tooling flow; the written-permission requirement and the EDR false-positive warning (discussion #53) mark the operational limits.
Agent architects who need a portable security “brain”: any agentskills.io-standard client can consume the library with zero configuration; for environments that also need live data, it combines with the same author’s cve-mcp-server and Malware-Sandbox-mcp.
Academia and research: the README includes a BibTeX citation, and the author ties adoption to the GARS-2026 study (supervised by SRH Berlin, open access CC-BY 4.0), so the repo also serves as a corpus of 817 workflows tagged against six frameworks.
Teams with strict EDR (CrowdStrike, Windows Defender): the bokifide case (100 alerts on clone) is a practical warning: productive use requires an exclusion policy, script review, and preferring a git clone over ZIPs; anyone who can’t manage that should limit themselves to reading the library or to isolated environments.

Resources

Repository: https://github.com/mukul975/Anthropic-Cybersecurity-Skills
Official documentation (author’s homepage): https://mahipal.engineer/Anthropic-Cybersecurity-Skills/
Skills standard: https://agentskills.io
Official skills: https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills
Releases and release notes: https://github.com/mukul975/Anthropic-Cybersecurity-Skills/releases
SkillsLLM listing: https://skillsllm.com/skill/anthropic-cybersecurity-skills
awesome-agent-skills listing: https://github.com/VoltAgent/awesome-agent-skills
awesome-ai-security listing: https://github.com/ottosulin/awesome-ai-security
Ecosystem installer: https://github.com/vercel-labs/skills (npx skills)
Author’s MCP complement: https://github.com/mukul975/cve-mcp-server
Community: https://github.com/mukul975/Anthropic-Cybersecurity-Skills/discussions (Announcements, General, Ideas, Polls, Q&A, Show and tell categories) and https://github.com/mukul975/Anthropic-Cybersecurity-Skills/issues
Featured discussion (antivirus false positive): https://github.com/mukul975/Anthropic-Cybersecurity-Skills/discussions/53
Star history: https://star-history.dera.page/#mukul975/Anthropic-Cybersecurity-Skills&Date

Note: this article combines the repository’s README and CONTRIBUTING.md, release notes v1.0.0–v1.3.0, the GitHub API, GitHub Discussions, the author’s homepage, SkillsLLM, and awesome lists checked on August 30, 2026. The Black Hat USA 2026 presence is a claim from the project’s homepage that couldn’t be directly verified from this environment. Star and fork figures change over time.