I came across a project on GitHub called Anthropic-Cybersecurity-Skills. Despite bearing Anthropic's name, it is not an official project. It is a community-driven project initiated by developer Mahipal, licensed under Apache 2.0. It currently has 29.6k stars and was recently selected for Arsenal Lab at Black Hat USA 2026.


It solves a very specific problem: when AI agents perform cybersecurity tasks, relying solely on the model's inherent knowledge often leads to missed steps or fabricated commands. Security operations rely on strict procedures: for example, memory forensics requires first identifying the OS profile, then listing processes, then detecting injected code. These procedures are familiar to senior analysts, but large models do not know them. So the author structured 817 such procedures into Markdown files, with each file representing one skill, so that agents can follow the steps when handling tasks.

Each SKILL.md starts with YAML frontmatter (a block of structured metadata) containing only the name, description, and tags, totaling around 40 tokens. The agent first reads this section to judge whether it is relevant to the current task, and only loads the full workflow if it is relevant. This progressive disclosure approach saves tokens and avoids interference from irrelevant information.

For example, for a memory forensics skill, the frontmatter clearly states the name, description, and tags (such as forensics, volatility3), while the main body includes when to use the skill, preconditions (Volatility3 installed, memory dump acquired), and the workflow (list processes with windows.pslist, detect injected code with windows.malfind). Similarly, there are skills for AWS S3 permission auditing, Kerberoasting, and many others.

The 817 skills are divided into 36 categories, covering 26 security domains ranging from cloud security, threat hunting, and malware analysis, to OT/ICS, red teaming, compliance, and more. Each skill is mapped to frameworks including MITRE ATT&CK, NIST CSF 2.0, and D3FEND, so agents can align their execution with industry standards.

In terms of compatibility, it supports more than 20 platforms including Claude Code, GitHub Copilot, Cursor, and Gemini CLI. Any agent that can read Markdown can use it. Installation is very simple:

```bash

npx skills add mukul975/Anthropic-Cybersecurity-Skills

```

It requires Node.js 18 or newer. Alternatively, you can manually clone the repository into the ~/.claude/skills/ directory.

On X, one commenter said "Generic LLMs guess at security, this fixes it". Some users also noted that teams can fork the project and keep only the skills they need. Others have observed that "skill packs" are becoming the new dotfiles, with developers starting to install skill libraries for their agents by default.

The core idea of this project is to structure cybersecurity knowledge instead of asking models to memorize it. In an era where agent capabilities are growing increasingly powerful, providing agents with a retrievable, executable skill library may be a more practical approach than chasing ever-larger model parameters. Of course, this is just a tool, and the actual outcome depends on the judgment of the user. If you are assigning cybersecurity tasks to agents, this project is well worth a look.