Anthropic Cybersecurity Skills - Setup Guide¶

750+ MITRE-mapped cybersecurity skills for AI agents by mukul975. The largest domain-specific skill pack discovered - production-grade threat detection, incident response, vulnerability assessment, and security operations workflows. All skills mapped to the MITRE ATT&CK framework.

What It Provides¶

Threat Detection - 200+ skills for identifying active threats across network, endpoint, and cloud
Incident Response - 150+ skills for triage, containment, eradication, and recovery
Vulnerability Assessment - 120+ skills for scanning, prioritizing, and validating vulnerabilities
Security Operations - 100+ skills for SIEM, SOAR, log analysis, and alert triage
Compliance & Audit - 80+ skills for SOC 2, ISO 27001, HIPAA, PCI-DSS
Cloud Security - 50+ skills for AWS, GCP, Azure security posture
MITRE ATT&CK Mapping - every skill tagged with MITRE technique ID

Installation¶

# Install via skills.sh
npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills

# Or manually - clone the full repo (large: 750+ skills)
git clone https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git ~/.hermes/skills/cybersecurity

# Install specific skill categories only (recommended for smaller footprint)
npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills --skill threat-detection
npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills --skill incident-response

Skill Categories¶

Category	Count	MITRE Coverage
Threat Detection	200+	TA0001-TA0011
Incident Response	150+	IR phases 1-4
Vulnerability Assessment	120+	CVE/CWE mapped
Security Operations	100+	SOC workflows
Compliance & Audit	80+	Framework-specific
Cloud Security	50+	CSPM/CWPP

Configuration¶

cybersecurity:
  enabled_categories:
    - threat-detection
    - incident-response
    - vulnerability-assessment
  mitre_framework_version: "v15"
  severity_threshold: "medium"     # only load skills for medium+ severity
  scan_frequency: "daily"
  alert_destination: "siem"        # or "slack", "email", "pagerduty"

Key Workflows¶

Run a threat scan¶

Run a threat detection scan on our AWS environment. Check for:
- Exposed S3 buckets
- Unused IAM access keys
- Security groups with 0.0.0.0/0

Incident triage¶

A suspicious login was detected from an unusual location.
Run the incident-response/triage skill to analyze the event
and recommend containment actions.

Vulnerability prioritization¶

Scan our dependency tree for known CVEs.
Prioritize by CVSS score and exploitability.

Verification¶

# List installed cybersecurity skills
hermes skills list | grep -i "threat\|incident\|vulnerability"

# Test a basic scan
hermes chat -q "Run a quick security posture check on this environment"

Pitfalls¶

⚠️ Production systems: These skills can run destructive actions (blocking IPs, revoking keys, terminating instances). Always run in --dry-run mode first on production environments.
⚠️ API scope: Cloud security skills need broad read permissions. Use read-only IAM roles where possible. Never use admin credentials for automated scanning.
Large install size: The full pack is 750+ skills. Install only the categories you need. Use the --skill flag for selective install.
False positives: Automated threat detection can generate noise. Tune the severity_threshold and always review findings before automated remediation.
MITRE version: Skills are mapped to MITRE ATT&CK v15. If your org uses a different version, verify mapping accuracy.

Roster Snapshot (Oct 10, 2026)¶

skills.sh serves this family under the lowercase source string mukul975/anthropic-cybersecurity-skills: 94 indexed listings (API page cap), 38,503 combined installs at snapshot time (top: analyzing-api-gateway-access-logs 735; testing-api-security-with-owasp-top-10 711; acquiring-disk-image-with-dd-and-dcfldd 656).
The case difference matters for coverage checks: this guide links the repo's own capitalization (mukul975/Anthropic-Cybersecurity-Skills), while skills.sh indexes the lowercase form.

Integration with CorpusIQ¶

CorpusIQ is the connector layer that lets AI assistants read the systems a business already runs on - accounting, payments, CRM, email, files and analytics - and answer with the source named. It is read-only by design: it retrieves data and never writes to, or acts in, a connected system, which is what makes it safe to point at live accounts.

This page is part of the CorpusIQ directory, the reference we maintain for the MCP server and agent-skill ecosystem. Run alongside CorpusIQ, a third-party server like this one can be combined with a company's own business data in a single answer.

See what CorpusIQ connects