claude-code-cybersecurity-skill

🛡️ Antivirus Notice: Some AV engines may flag this repository due to security testing payload templates (string constants for authorized pentesting). These are false positives — no executable malware exists. This is standard for all cybersecurity toolkits (SecLists, PayloadsAllTheThings, Metasploit face the same detections). See SECURITY.md for details.

Claude Code CyberSecurity Skill Collection

Engineering quality — 3.2 foundation

Run python -m pip install -r requirements-dev.txt followed by make check. The automated suite covers packaging/frontmatter, all 35 script CLI interfaces, IOC/STIX regressions, purple-team input validation, and file provenance. See quality and migration notes for exact scope, output changes, and the Evidence Engine roadmap. Activation and detection-accuracy targets are not yet measured benchmarks.

22 production-quality Claude Code Skills for cybersecurity professionals — covering offensive security, defensive operations, reverse engineering, threat hunting, threat intelligence, purple team / adversary emulation, CSOC automation, AI/LLM security, mobile, OT/ICS, GRC, software supply chain security, and more. Version 3.1 — expanded coverage, sharper methodology, and stronger automation.

Transform Claude Code into your ultimate cybersecurity co-pilot. Each skill provides Claude with structured methodology, decision frameworks, ready-to-run commands, and output templates that enable precise, expert-level assistance for real-world security operations.

What Are Claude Code Skills?

Claude Code Skills are structured SKILL.md files that you install into your ~/.claude/skills/ directory (global) or .claude/skills/ (project-specific). When Claude reads these files, it gains deep, domain-specific expertise that goes far beyond generic knowledge.

How Skills Work

Skills are instruction documents Claude reads at conversation start. Each SKILL.md contains:

1. YAML frontmatter — name, description, tags for skill identification
2. Activation triggers — Explicit list of prompts that should invoke this skill
3. Methodology — Step-by-step procedures Claude follows natively
4. Output templates — Exact formats for reports, rules, and artifacts Claude produces
5. Script references — When and how to use the included Python automation scripts
6. Authorization gates — Built-in prompts for offensive skills to confirm legal scope

Claude Code-Native Design

These skills are built around what Claude does natively in Claude Code:

• Read configuration files, code, and logs directly — no copy-paste needed
• Bash tool to run scripts, network commands, and system queries
• Analysis of disassembly, PCAP data, log events, and code with full context
• Generation of detection rules, hardening scripts, reports, and payloads
• WebSearch for CVE lookups, threat intelligence, and vulnerability research

Update proof of works

Update testing

Skill Collection

Quick Start

1. Clone the Repository

git clone https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill.git
cd Claude-Code-CyberSecurity-Skill

2. Install Skills into Claude Code

Claude Code loads skills from two locations:

# Install globally (recommended — available everywhere)
mkdir -p ~/.claude/skills
cp -r skills/* ~/.claude/skills/

# Or symlink for development (changes auto-sync)
ln -sf "$(pwd)/skills/"* ~/.claude/skills/

# Or install to a specific project
mkdir -p /path/to/project/.claude/skills
cp -r skills/* /path/to/project/.claude/skills/

3. Use Claude Code

Open Claude Code and talk naturally. Claude activates the relevant skill based on what you ask:

claude

Example interactions:

# Recon (Skill 01 activates)
> Enumerate all subdomains for example.com and fingerprint the web stack

# Vulnerability Assessment (Skill 02 activates)
> Audit the Python dependencies in my project for known CVEs

# Malware Analysis (Skill 05 activates)
> Generate YARA rules from this suspicious PE file and extract all IOCs

# Threat Hunting (Skill 06 activates)
> Map these TTPs to MITRE ATT&CK and write Splunk SPL queries to hunt for them

# Blue Team (Skill 15 activates)
> Give me hardening commands to secure this Ubuntu 24.04 server following CIS Level 1

# Incident Response (Skill 07 activates)  
> Create a ransomware incident response playbook for our SOC team

# AI/LLM Security (Skill 16 activates)
> Threat-model this RAG chatbot against the OWASP LLM Top 10 and test it for prompt injection

# Mobile Security (Skill 17 activates)
> Analyze this APK for exported components and hardcoded secrets against OWASP MASVS

# OT/ICS Security (Skill 18 activates)
> From this capture, which hosts are sending Modbus write commands to the PLCs?

# GRC & Compliance (Skill 19 activates)
> Run a SOC 2 gap analysis and map our controls to NIST CSF 2.0

# Supply Chain Security (Skill 20 activates)
> Audit this repo for typosquatted dependencies and unpinned GitHub Actions

# Threat Intelligence & CTI (Skill 21 activates)
> Pull every IOC out of this report, defang them, and give me a STIX bundle marked TLP:AMBER

# Purple Team & Adversary Emulation (Skill 22 activates)
> We ran these atomic tests — score our detection coverage and rank the gaps as a Navigator layer

You can also explicitly name a skill:

> Use the reverse-engineering skill to interpret this ARM assembly
> Use the log-analysis skill to build a Sentinel KQL query for DCSync detection
> Use the blue-team-defense skill to audit this Dockerfile

What's New in v3.3

A correctness, robustness, and self-verification pass across every skill — the collection is now harder to break and easier to trust:

• Every script self-tests. All ~35 automation scripts ship an offline --demo that asserts real detection logic (not just that the CLI launches) — run any of them with --demo to prove the tool works before you point it at a target.
• Real bugs fixed, verified by those demos — a few highlights: the ML model scanner now catches dangerous imports in modern (STACK_GLOBAL) pickles; the APK analyzer reports only genuinely exported components; the IaC scanner no longer false-flags pinned Docker images and now scans single files; the binary analyzer's Full-RELRO check actually works (BIND_NOW); the hardening checker no longer counts commented-out SSH directives as a PASS; subdomain brute-force suppresses wildcard-DNS false positives.