# anthropic-cybersecurity-skills

A library of 754 structured cybersecurity skills across 26 domains. Useful when your agent works through an incident or hunts for threats.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 1600 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/anthropic-cybersecurity-skills/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/anthropic-cybersecurity-skills

## What it does

The skill hands your agent a library of 754 security write-ups split into 26 domains. Every entry sits in its own folder: `SKILL.md` with YAML frontmatter, `references/standards.md` for framework mappings, `references/workflows.md` for procedures, Python helpers under `scripts/`, and templates plus checklists in `assets/`. Mappings cover MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, MITRE D3FEND and NIST AI RMF.

Loading happens in stages. The agent reads frontmatter first to keep token cost low, then pulls the full skill body only when it needs it. You can look skills up by domain, by ATT&CK technique or by tag — the README ships Python snippets that walk the folders and parse the YAML. Those snippets import `pyyaml`, so without it the frontmatter parsing fails at the import line.

Installation runs through `npx skills add` with a flag naming your platform, and the skill file lands in that platform's directory. Six platforms are covered: Claude, Codex, Cursor, GitHub Copilot, Gemini CLI and OpenCode. GitHub Copilot uses a different command, `gh skill install`.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill anthropic-cybersecurity-skills -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/anthropic-cybersecurity-skills/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/anthropic-cybersecurity-skills/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill anthropic-cybersecurity-skills -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/anthropic-cybersecurity-skills/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill anthropic-cybersecurity-skills -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/anthropic-cybersecurity-skills/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills anthropic-cybersecurity-skills
```

2. **Manually: put the files in place**
- File: `.github/skills/anthropic-cybersecurity-skills/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill anthropic-cybersecurity-skills -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/anthropic-cybersecurity-skills
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/anthropic-cybersecurity-skills/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill anthropic-cybersecurity-skills -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/anthropic-cybersecurity-skills/SKILL.md

## When to use it
- work through a security incident from the first step
- map an attack to a MITRE ATT&CK technique
- run memory forensics on a dump
- check cloud security posture
- find the right skill by domain or tag

## Example prompts
- Help me investigate this security incident and tell me which skills to load
- Map this attack to MITRE ATT&CK techniques
- What security skills are available in the library?

## Similar
- [incident-response](https://affpapa.org/en/nevibecode/skills/incident-response.md) — skill · 634 installs
- [incident-triage](https://affpapa.org/en/nevibecode/skills/incident-triage.md) — skill · 361 installs
- [analyzing-malware-sandbox-evasion-techniques](https://affpapa.org/en/nevibecode/skills/analyzing-malware-sandbox-evasion-techniques.md) — skill · 363 installs
- [memory-forensics](https://affpapa.org/en/nevibecode/skills/memory-forensics.md) — skill · 11027 installs
- [analyzing-memory-dumps-with-volatility](https://affpapa.org/en/nevibecode/skills/analyzing-memory-dumps-with-volatility.md) — skill · 354 installs
- [quantakrypto pqc-tools](https://affpapa.org/en/nevibecode/mcp/quantakrypto-pqc-tools.md) — MCP server · ★ 15

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 69 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md