claude-code-cybersecurity-skill

🛡️ Antivirus Notice: Some AV engines may flag this repository due to security testing payload templates (string constants for authorized pentesting). These are false positives — no executable malware exists. This is standard for all cybersecurity toolkits (SecLists, PayloadsAllTheThings, Metasploit face the same detections). See SECURITY.md for details.

Claude Code CyberSecurity Skill Collection

22 production-quality Claude Code Skills for cybersecurity professionals — covering offensive security, defensive operations, reverse engineering, threat hunting, threat intelligence, purple team / adversary emulation, CSOC automation, AI/LLM security, mobile, OT/ICS, GRC, software supply chain security, and more. Version 3.1 — expanded coverage, sharper methodology, and stronger automation.

Transform Claude Code into your ultimate cybersecurity co-pilot. Each skill provides Claude with structured methodology, decision frameworks, ready-to-run commands, and output templates that enable precise, expert-level assistance for real-world security operations.

---

What Are Claude Code Skills?

Claude Code Skills are structured SKILL.md files that you install into your ~/.claude/skills/ directory (global) or .claude/skills/ (project-specific). When Claude reads these files, it gains deep, domain-specific expertise that goes far beyond generic knowledge.

How Skills Work

Skills are instruction documents Claude reads at conversation start. Each SKILL.md contains:

1. YAML frontmatter — name, description, tags for skill identification
2. Activation triggers — Explicit list of prompts that should invoke this skill
3. Methodology — Step-by-step procedures Claude follows natively
4. Output templates — Exact formats for reports, rules, and artifacts Claude produces
5. Script references — When and how to use the included Python automation scripts
6. Authorization gates — Built-in prompts for offensive skills to confirm legal scope

Claude Code-Native Design

These skills are built around what Claude does natively in Claude Code:

• Read configuration files, code, and logs directly — no copy-paste needed
• Bash tool to run scripts, network commands, and system queries
• Analysis of disassembly, PCAP data, log events, and code with full context
• Generation of detection rules, hardening scripts, reports, and payloads
• WebSearch for CVE lookups, threat intelligence, and vulnerability research

---

Update proof of works

Update testing

Skill Collection

#	Skill	Domain	Key Capabilities
01	Recon & OSINT	Reconnaissance	Subdomain enum, DNS analysis, technology fingerprinting, Google dorking, WHOIS
02	Vulnerability Scanner	Assessment	Dependency auditing, config review, CVSS scoring, structured vulnerability reports
03	Exploit Development	Offensive	PoC templates, payload generation, buffer overflow, web exploit payloads
04	Reverse Engineering	Analysis	Binary triage, assembly interpretation, firmware RE, protocol reversing, CTF
05	Malware Analysis	Threat Analysis	Static analysis, YARA generation, sandbox setup, behavioral analysis, IOC extraction
06	Threat Hunting	Hunting	IOC extraction, ATT&CK mapping, hunt hypotheses, Sigma + SIEM query library
07	Incident Response	IR & Forensics	PICERL playbooks, evidence collection, timeline analysis, memory forensics, IR reports
08	Network Security	Network	PCAP analysis, Suricata/Snort rules, firewall auditing, beaconing detection
09	Web Security	Web	OWASP Top 10, injection testing, API security, JWT analysis, security headers
10	Cloud Security	Cloud	AWS/Azure/GCP audit, Dockerfile review, K8s hardening, IaC scanning
11	CSOC Automation	SOC Operations	Alert triage, playbook YAML, escalation workflows, shift reports, KPI tracking
12	Log Analysis & SIEM	Log Analysis	SIEM query library (Splunk/KQL/EQL), Sigma rules, anomaly detection, correlation
13	Cryptographic Analysis	Cryptography	TLS auditing, cipher analysis, hash identification, crypto code review, PQC guidance
14	Red Team Operations	Red Team	Engagement planning, C2 design, AD attacks, OPSEC, social engineering, reporting
15	Blue Team Defense	Blue Team	Linux/Windows hardening, detection engineering, baselines, patch management
16	AI & LLM Security	AI Security	Prompt injection, OWASP LLM Top 10, RAG & agent/tool-use security, model supply chain, AI red teaming
17	Mobile Security	Mobile	Android/iOS testing, MASVS/MASTG, APK/IPA static analysis, Frida/objection, mobile malware triage
18	OT / ICS / SCADA Security	Industrial	Purdue model, Modbus/DNP3/S7 analysis, IEC 62443, ATT&CK for ICS, safety-first methodology
19	GRC & Compliance	Governance	Risk scoring, NIST CSF 2.0/ISO 27001/SOC 2 mapping, gap analysis, audit evidence, policy generation
20	Supply Chain Security	Supply Chain	SBOM generation/analysis, dependency confusion & typosquatting detection, CI/CD pipeline hardening, SLSA/Sigstore provenance
21	Threat Intelligence & CTI	Threat Intel	Intelligence cycle, IOC extraction/defang/normalize, STIX/TAXII & MISP, Diamond/Kill Chain, source & confidence scoring, attribution, finished reporting
22	Purple Team & Adversary Emulation	Purple Team	Threat-informed emulation planning (ATT&CK, Atomic Red Team, CALDERA), detect–tune–validate loop, coverage measurement (Navigator/DeTT&CT), MTTD/coverage reporting

---

Quick Start

1. Clone the Repository

git clone https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill.git
cd Claude-Code-CyberSecurity-Skill

2. Install Skills into Claude Code

Claude Code loads skills from two locations:

Location	Scope	Path
Global	All projects	~/.claude/skills/
Project	This project only	./.claude/skills/

# Install globally (recommended — available everywhere)
mkdir -p ~/.claude/skills
cp -r skills/* ~/.claude/skills/

# Or symlink for development (changes auto-sync)
ln -sf "$(pwd)/skills/"* ~/.claude/skills/

# Or install to a specific project
mkdir -p /path/to/project/.claude/skills
cp -r skills/* /path/to/project/.claude/skills/

3. Use Claude Code

Open Claude Code and talk naturally. Claude activates the relevant skill based on what you ask:

claude

Example interactions:

# Recon (Skill 01 activates)
> Enumerate all subdomains for example.com and fingerprint the web stack

# Vulnerability Assessment (Skill 02 activates)
> Audit the Python dependencies in my project for known CVEs

# Malware Analysis (Skill 05 activates)
> Generate YARA rules from this suspicious PE file and extract all IOCs

# Threat Hunting (Skill 06 activates)
> Map these TTPs to MITRE ATT&CK and write Splunk SPL queries to hunt for them

# Blue Team (Skill 15 activates)
> Give me hardening commands to secure this Ubuntu 24.04 server following CIS Level 1

# Incident Response (Skill 07 activates)  
> Create a ransomware incident response playbook for our SOC team

# AI/LLM Security (Skill 16 activates)
> Threat-model this RAG chatbot against the OWASP LLM Top 10 and test it for prompt injection

# Mobile Security (Skill 17 activates)
> Analyze this APK for exported components and hardcoded secrets against OWASP MASVS

# OT/ICS Security (Skill 18 activates)
> From this capture, which hosts are sending Modbus write commands to the PLCs?

# GRC & Compliance (Skill 19 activates)
> Run a SOC 2 gap analysis and map our controls to NIST CSF 2.0

# Supply Chain Security (Skill 20 activates)
> Audit this repo for typosquatted dependencies and unpinned GitHub Actions

# Threat Intelligence & CTI (Skill 21 activates)
> Pull every IOC out of this report, defang them, and give me a STIX bundle marked TLP:AMBER

# Purple Team & Adversary Emulation (Skill 22 activates)
> We ran these atomic tests — score our detection coverage and rank the gaps as a Navigator layer

You can also explicitly name a skill:

> Use the reverse-engineering skill to interpret this ARM assembly
> Use the log-analysis skill to build a Sentinel KQL query for DCSync detection
> Use the blue-team-defense skill to audit this Dockerfile

---

What's New in v3.1

Two new domains and a reliability pass across the collection:

• Skill 21 — Threat Intelligence & CTI — the full intelligence cycle (PIRs → collection → analysis → dissemination), IOC extraction/defang/normalize/dedup with STIX 2.1 and MISP export, structured analytic models (Diamond, Kill Chain, ATT&CK, ACH), Admiralty source scoring and estimative-language confidence, attribution discipline, TLP marking, and finished intelligence reporting — with cti_processor.py.
• Skill 22 — Purple Team & Adversary Emulation — threat-informed emulation planning (ATT&CK, Atomic Red Team, CALDERA, CTID library), the detect–tune–validate loop, detection-coverage measurement on the none/telemetry/detection/prevention ladder with an ATT&CK Navigator layer and MTTD/coverage-delta metrics, and a safety/authorization gate — with detection_validator.py.
• Fixes — report_generator.py --demo now runs standalone (was rejected by required --shift/--date); CVSS ceiling-rounding, GHSA MODERATE→MEDIUM mapping, auth-log field extraction for anomaly chaining, and TLS expired-cert detection corrected (see CHANGELOG).
• Consistency — every skill's SKILL.md version is now aligned at 3.1.0, and the marketplace manifest lists all 22 skills.

---

What's New in v3.0

Bigger, sharper, more powerful — four new domains and a full refresh of the original 15:

• 4 new skills (16–19) — AI & LLM Security, Mobile Security, OT/ICS/SCADA Security, and GRC & Compliance, each with full methodology, output templates, and runnable scripts