Security · For devops and sre engineers

Performs vulnerability remediation on endpoints by prioritizing CVEs based on risk scoring, deploying patches, applying configuration changes, and validating fixes.

mukul975/Anthropic-Cybersecurity-Skills

Conducts systematic reviews of privileged accounts to validate access rights, identify excessive or stale permissions, and enforce least privilege across PAM infrastructure.

mukul975/Anthropic-Cybersecurity-Skills

Develops precise YARA and YARA-X rules for malware detection by identifying unique strings, byte sequences, PE header traits, and behavioral indicators in unpacked malware artifacts while minimizing…

mukul975/Anthropic-Cybersecurity-Skills

Integrates Aqua Security's Trivy scanner into CI/CD pipelines to detect OS package and application dependency CVEs, Dockerfile misconfigurations, and issues in filesystems or git repositories, and…

mukul975/Anthropic-Cybersecurity-Skills

Classifies and prioritizes security incidents using structured IR playbooks and SIEM/case-management queries (Splunk, TheHive) to determine severity, assign response teams, and initiate the…

mukul975/Anthropic-Cybersecurity-Skills

Manage Ethereum keys, accounts, and keystores with Nethereum.

Nethereum/Nethereum

A skill your agent uses when preparing a codebase for security audit.

ccashwell/evm-cortex

A skill your agent uses when a B200/Blackwell kernel shows wrong results, uncoalesced global memory access, SMEM bank conflicts, a TMA swizzle that mismatches the Tensor Core read, or confused…

mirage-project/mirage

Threat-model and find vulnerabilities, with practical remediation.

antonbabenko/deliberation

Produces a dynamic CycloneDX BOM by executing a command under the cdxgen safer-exec sandbox with tracebom, tracing dlopen shared-library loads, eBPF HTTP URL access, cryptographic library and…

cdxgen/cdxgen

Runs the cdxgen SBOM fidelity loop: scan with --introspect or --profile introspect, read the cdxgen fidelity report, execute its ranked remediations (the catalog spans the mainstream build…

cdxgen/cdxgen

Security hardening guidance for AI agent frameworks that process untrusted content, invoke tools, write workspace files, manage runtime identifiers, or handle credentials.

affaan-m/ECC

Load a Spec Kitty agent profile on demand for interactive sessions, including identity, governance scope, boundaries, and initialization.

spec-kitty/spec-kitty

What to do if a mantiscanary decoy tool ever shows up as tempting or gets called -- treat it as a security incident, not a normal tool result

deonmenezes/mantishack

Write a new skill for the Apache Magpie framework, or bring an existing one up to current conventions.

apache/magpie

Activate when reviewing or modifying dependency resolution, lockfile schema, package downloaders, signature/integrity checks, file integration cleanup, or anything that could expose APM to…

microsoft/apm

How to handle GRIDA-SEC-<id security boundaries in the Grida repo.

gridaco/grida

A skill your agent uses when evaluating US stocks through Serenity / @aleabitoreddit's AI and semiconductor supply-chain lens: upstream chokepoints, photonics/CPO bottlenecks, hyperscaler capex…

questflowai/investorskills

Audit a pull request diff for common security concerns (input validation, sanitization, authentication and authorization, secrets management, unsafe dependencies, and related risks) and fold…

warpdotdev/oz-for-oss

Assess a reported security vulnerability in GAIA and fill a PSIRT / JIRA triage: decide if it is valid & exploitable, whether it needs a CVE + bulletin, and produce the CVSS 4.0 score, CWE, and CVE…

amd/gaia

Atmos CI: Native CI with GitHub Actions containers, native outputs, SBOM workflow-artifact publication, collapsible log groups, affected/all matrix workflows, OIDC profiles, toolchain-aware jobs…

cloudposse/atmos

Security review of Infrastructure-as-Code (Terraform, Kubernetes, CloudFormation).

OWASP/secure-agent-playbook

Pre-production audit, hardening, and go-live checklists for FrontMCP servers.

agentfront/frontmcp

Secure AI agents against prompt injection, tool abuse, and data exfiltration with defense-in-depth controls.

sickn33/agentic-awesome-skills

Audit authorized codebases for exploitable vulnerabilities using scoped reconnaissance, adversarial review, validation, and structured reporting.

sickn33/agentic-awesome-skills

Harden Docker/container images and runtime deployments with secure base images, non-root users, CVE scanning, SBOM/signing, seccomp/AppArmor, and Kubernetes pod security controls.

sickn33/agentic-awesome-skills

Authorized email security review: phishing analysis, SPF/DKIM/DMARC header authentication, BEC pattern investigation, and mailbox token abuse research.

sickn33/agentic-awesome-skills

Reverse engineer binaries with IDA Pro: decompilation, disassembly, data-flow tracking, cross-references, and IDA MCP automation for deep static analysis of PE/ELF/Mach-O targets.

sickn33/agentic-awesome-skills

Authorized wireless security assessment: Wi-Fi capture, WPA handshake analysis, rogue AP detection research, and lab-only deauthentication testing.

sickn33/agentic-awesome-skills

Infrastructure alert triage — dedup via YT search, deep PVE/K8s investigation, auto-escalation for recurring/flapping alerts, control plane deep dive for K8s controller nodes.

papadopouloskyriakos/agentic-chatops

Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition.

mukul975/Anthropic-Cybersecurity-Skills

Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more APT groups' TTPs for detection-gap…

mukul975/Anthropic-Cybersecurity-Skills

Analyzes bootkit and advanced rootkit malware infecting the Master Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware for below-OS persistence, covering boot sector analysis, UEFI module…

mukul975/Anthropic-Cybersecurity-Skills

Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases an adversary has completed, where defenses succeeded or failed, and what controls would…

mukul975/Anthropic-Cybersecurity-Skills

Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 channels using entropy analysis, query volume anomalies, and subdomain length detection…

mukul975/Anthropic-Cybersecurity-Skills

Parse and analyze email headers (Received chain, Return-Path, Message-ID) to trace the true origin of a phishing email and validate SPF, DKIM, and DMARC results to confirm or rule out sender spoofing.

mukul975/Anthropic-Cybersecurity-Skills

Analyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to determine maliciousness confidence, campaign attribution, and blocking priority.

mukul975/Anthropic-Cybersecurity-Skills

Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access, and builds SIEM detection rules…

mukul975/Anthropic-Cybersecurity-Skills

Query the Malpedia API to look up malware family aliases and naming (platform.familyname), pull community/vendor YARA rules, link families to threat actors, and map family relationships such as…

mukul975/Anthropic-Cybersecurity-Skills

Parse Windows Prefetch files (versions 17, 23, 26, 30) with tools like PECmd, WinPrefetchView, or python-prefetch to determine program execution history, including run counts, execution timestamps…

mukul975/Anthropic-Cybersecurity-Skills

Map advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework using the attackcti Python library to query STIX/TAXII data for group-technique associations, then generate ATT&CK…

mukul975/Anthropic-Cybersecurity-Skills

Queries Certificate Transparency logs via crt.sh and pycrtsh to detect phishing domains, unauthorized certificate issuance, and shadow IT.

mukul975/Anthropic-Cybersecurity-Skills

Generate domain permutations with dnstwist and check DNS resolution to detect typosquatting, homograph phishing, and brand impersonation domains registered against your organization.

mukul975/Anthropic-Cybersecurity-Skills

Correlate Windows registry keys (USBSTOR, MountedDevices), Event Logs, and setupapi.dev.log to reconstruct USB device connection history, first/last-plugged timestamps, and drive letter mappings.

mukul975/Anthropic-Cybersecurity-Skills

Parse Windows Prefetch (.pf) files with the windowsprefetch Python library to reconstruct application execution history, run counts, and accessed file/volume lists.

mukul975/Anthropic-Cybersecurity-Skills

Audit AWS, Azure, and GCP environments against the CIS Foundations Benchmarks by running automated scans with tools like Prowler and ScoutSuite, interpreting failed controls, and tracking…

mukul975/Anthropic-Cybersecurity-Skills

Build an automated pipeline that ingests raw IOCs (URLs, IPs, domains, emails), normalizes and deduplicates them, then produces defanged renderings for safe human reading alongside canonical STIX…

mukul975/Anthropic-Cybersecurity-Skills

Builds SOC performance metrics and KPI tracking dashboards measuring Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), alert quality ratios, analyst productivity, and detection coverage using…

mukul975/Anthropic-Cybersecurity-Skills