Best network security skills for Claude Code, Codex and other agents.

Hunts for compromised workloads and malicious traffic in a Kubernetes cluster by sweeping network data through Kubeshark MCP, mapped to MITRE ATT&CK.

kubeshark/kubeshark

Manage Oh Dear website monitoring using the ohdear CLI. An agent skill from ohdearapp/ohdear-cli.

ohdearapp/ohdear-cli

Review browser userscript changes in JavaScript userscript files, focusing on scripting content and its HTML/CSS behavior, with metadata as a binding gate plus DOM/CSS, userscript-manager APIs…

cyfung1031/userscript-supports

This skill should be used when the user asks to "analyze network traffic with Wireshark", "capture packets for troubleshooting", "filter PCAP files", "follow TCP/UDP streams", "detect network…

zebbern/claude-code-guide

Guides authorized packet capture and analysis with TShark, Wireshark's command-line tool, for security investigations, malware detection and forensic examination of network traffic.

AgentSecOps/SecOpsAgentKit

Walks through mutual TLS between services in a zero-trust setup: certificate hierarchy, rotation, a gradual PERMISSIVE-to-STRICT rollout and handshake debugging.

wshobson/agents

IoT network traffic analyzer for detecting IoT protocols and identifying security vulnerabilities in network communications.

BrownFineSecurity/iothackbot

Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.

mukul975/Anthropic-Cybersecurity-Skills

Master network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation.

wshobson/agents

Configure iptables, nftables, and cloud firewalls. An agent skill from sickn33/agentic-awesome-skills.

sickn33/agentic-awesome-skills

Security hardening and best practices for robotic systems, covering SROS2 DDS security, network segmentation, secrets management, secure boot, and the physical-cyber safety intersection.

arpitg1304/robotics-agent-skills

Configures host-based intrusion detection systems (HIDS) to monitor endpoint file integrity, system calls, and configuration changes for security violations.

mukul975/Anthropic-Cybersecurity-Skills

Perform forensic analysis of network packet captures (PCAP/PCAPNG) using Wireshark, tshark, and tcpdump to reconstruct network communications, extract transferred files, identify malicious traffic…

mukul975/Anthropic-Cybersecurity-Skills

Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 channels using entropy analysis, query volume anomalies, and subdomain length detection…

mukul975/Anthropic-Cybersecurity-Skills

Installs, configures, and tunes Snort 3 to monitor network traffic for malicious activity using custom and community rulesets, preprocessors, and alert output plugins.

mukul975/Anthropic-Cybersecurity-Skills

Detect Layer 2 ARP poisoning/spoofing by deploying ARPWatch, Dynamic ARP Inspection (DAI), Wireshark packet analysis, and custom Python monitoring scripts that flag gratuitous ARP floods, IP-to-MAC…

mukul975/Anthropic-Cybersecurity-Skills

Capture and analyze network traffic using Wireshark and tshark to reconstruct network events from PCAP/PCAPNG files, extract transferred files and credentials, and identify command-and-control…

mukul975/Anthropic-Cybersecurity-Skills

Deploy Zeek (formerly Bro) as a passive network security monitor to generate structured logs of protocol metadata (HTTP, DNS, TLS, SSH, SMTP, FTP, and more), write custom detection scripts, and…

mukul975/Anthropic-Cybersecurity-Skills

Conduct cybersecurity assessments of power grid infrastructure spanning generation, transmission substations, distribution, and EMS control centers, covering NERC CIP compliance verification, IEC…

mukul975/Anthropic-Cybersecurity-Skills

Configure SSL/TLS break-and-inspect on next-generation firewalls and forward proxies to decrypt, inspect, and re-encrypt HTTPS traffic for malware and exfiltration detection, including deploying…

mukul975/Anthropic-Cybersecurity-Skills

Guidance for Azure Firewall — managed cloud-native L3-L7 stateful network firewall for centralised egress, east-west, and ingress control.

vinayaklatthe/microsoft-security-skills

Generates security-focused guidance for Google Cloud workloads based on the design principles and recommendations in the Google Cloud Well-Architected Framework (WAF).

google/skills

Execute a wireless network penetration test to assess WiFi security by capturing handshakes, cracking WPA2/WPA3 keys, detecting rogue access points, and testing wireless segmentation using…

mukul975/Anthropic-Cybersecurity-Skills

Provision and operate Elastic Cloud infrastructure: create, connect to, update, and delete Serverless projects (Elasticsearch, Observability, Security); manage traffic filters (IP and AWS…

elastic/agent-skills

Uses the Linux Audit framework (auditd) with ausearch and aureport utilities to detect intrusion attempts, unauthorized access, privilege escalation, and suspicious system activity.

mukul975/Anthropic-Cybersecurity-Skills

Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including command-and-control communications, lateral movement, data exfiltration, and…

mukul975/Anthropic-Cybersecurity-Skills

Captures and analyzes network packet data using Wireshark and tshark to identify malicious traffic patterns, diagnose protocol issues, extract artifacts, and support incident response investigations…

mukul975/Anthropic-Cybersecurity-Skills

Conducts authorized wireless network penetration tests to assess the security of WiFi infrastructure by testing for weak encryption protocols, captive portal bypasses, evil twin attacks, WPA2/WPA3…

mukul975/Anthropic-Cybersecurity-Skills

Detect network reconnaissance and port scanning using Suricata and Snort IDS signatures, threshold-based detection rules, and traffic anomaly analysis to identify Nmap, Masscan, and custom scanning…

mukul975/Anthropic-Cybersecurity-Skills

Configures AIDE (Advanced Intrusion Detection Environment) for file integrity monitoring on Linux, covering baseline database creation, scheduled integrity checks via cron, change detection, and…

mukul975/Anthropic-Cybersecurity-Skills

Automate network traffic analysis using tshark (Wireshark CLI) and pyshark to compute protocol distribution statistics, detect suspicious flows such as port scans and beaconing, extract IOCs (IPs…

mukul975/Anthropic-Cybersecurity-Skills

Conduct wireless network security assessments using Kismet to detect rogue access points, hidden SSIDs, weak encryption, and unauthorized clients through passive RF monitoring.

mukul975/Anthropic-Cybersecurity-Skills

Guidance for designing secure Azure network architecture — hub-spoke topology (or Virtual WAN), segmentation with NSGs/ASGs, private endpoints / Private Link for PaaS, egress through Azure Firewall…

vinayaklatthe/microsoft-security-skills

This skill covers conducting comprehensive security assessments of Operational Technology (OT) networks including SCADA systems, DCS architectures, and industrial control system communication paths.

mukul975/Anthropic-Cybersecurity-Skills

Perform structured reconnaissance and attack surface enumeration for authorized penetration tests, CTF challenges, and bug bounty programs.

briiirussell/cybersecurity-skills

This skill covers detecting cyber attacks targeting Supervisory Control and Data Acquisition (SCADA) systems including man-in-the-middle attacks on industrial protocols, unauthorized command…

mukul975/Anthropic-Cybersecurity-Skills

Windows net diag: ping, traceroute, DNS, port scan (PowerShell)

taracodlabs/aiden

Deploys canary tokens and honeytokens (fake AWS credentials, DNS canaries, document beacons, database records) that trigger alerts when accessed by attackers.

mukul975/Anthropic-Cybersecurity-Skills

A skill your agent uses whenever the user is learning computer networking, computer networks, TCP/IP, OSI, subnetting, routing, switching, DNS, HTTP, TCP, UDP, DHCP, TLS, NAT, congestion control…

mingchen666/Reviva

A skill your agent uses whenever the user asks about Wireshark, tcpdump, packet capture, pcap analysis, HTTP/DNS/TCP/DHCP/TLS capture interpretation, network lab reports, protocol fields observed in…

mingchen666/Reviva

Traffic analysis and PCAP forensics playbook. An agent skill from yaklang/hack-skills.

yaklang/hack-skills

Guidance for Azure Key Vault — securely storing and managing secrets, keys, and certificates with RBAC, network isolation, managed identity access, soft delete / purge protection, and rotation.

Kilo-Org/kilo-marketplace

Diagnose and defeat TLS interception failures in mobile apps — certificate pinning, Android Network Security Config, user-CA distrust, native BoringSSL pinning, and mutual TLS — using objection…

trilwu/secskills

Configure Claude Code sandbox network isolation with trusted domains, custom access policies, and environment variables

Microck/ordinary-claude-skills

Network architecture, troubleshooting, and infrastructure patterns.

aiskillstore/marketplace

Plan, deploy, operate, and troubleshoot Azure Local (formerly Azure Stack HCI): sizing and prerequisites, Arc registration, lifecycle updates, workloads (Azure Local VMs, AKS on Azure Local, images…

microsoft/GitHub-Copilot-for-Azure

Analyze packet captures and network telemetry for intrusion evidence — capture and handling, the Wireshark/tshark triage funnel, Zeek log mining, Suricata rule runs, beacon and DNS-tunnel detection…

trilwu/secskills

RBAC configuration, row policies, quotas, network security, audit logging, and access control best practices.

chmonitor/chmonitor