Star History
Claude Code CyberSecurity Skill Collection
19 production-quality Claude Code Skills for cybersecurity professionals — covering offensive security, defensive operations, reverse engineering, threat hunting, CSOC automation, AI/LLM security, mobile, OT/ICS, GRC, and more. Version 3.0 — expanded coverage, sharper methodology, and stronger automation.
Transform Claude Code into your ultimate cybersecurity co-pilot. Each skill provides Claude with structured methodology, decision frameworks, ready-to-run commands, and output templates that enable precise, expert-level assistance for real-world security operations.
What Are Claude Code Skills?
Claude Code Skills are structured SKILL.md files that you install into your ~/.claude/skills/ directory (global) or .claude/skills/ (project-specific). When Claude reads these files, it gains deep, domain-specific expertise that goes far beyond generic knowledge.
How Skills Work
Skills are instruction documents Claude reads at conversation start. Each SKILL.md contains:
- YAML frontmatter —
name, description, tags for skill identification
- Activation triggers — Explicit list of prompts that should invoke this skill
- Methodology — Step-by-step procedures Claude follows natively
- Output templates — Exact formats for reports, rules, and artifacts Claude produces
- Script references — When and how to use the included Python automation scripts
- Authorization gates — Built-in prompts for offensive skills to confirm legal scope
Claude Code-Native Design
These skills are built around what Claude does natively in Claude Code:
- Read configuration files, code, and logs directly — no copy-paste needed
- Bash tool to run scripts, network commands, and system queries
- Analysis of disassembly, PCAP data, log events, and code with full context
- Generation of detection rules, hardening scripts, reports, and payloads
- WebSearch for CVE lookups, threat intelligence, and vulnerability research
Update proof of works
Update testing
Skill Collection
| # | Skill | Domain | Key Capabilities |
|---|
| 01 | Recon & OSINT | Reconnaissance | Subdomain enum, DNS analysis, technology fingerprinting, Google dorking, WHOIS |
| 02 | Vulnerability Scanner | Assessment | Dependency auditing, config review, CVSS scoring, structured vulnerability reports |
| 03 | Exploit Development | Offensive | PoC templates, payload generation, buffer overflow, web exploit payloads |
| 04 | Reverse Engineering | Analysis | Binary triage, assembly interpretation, firmware RE, protocol reversing, CTF |
| 05 | Malware Analysis | Threat Analysis | Static analysis, YARA generation, sandbox setup, behavioral analysis, IOC extraction |
| 06 | Threat Hunting | Hunting | IOC extraction, ATT&CK mapping, hunt hypotheses, Sigma + SIEM query library |
| 07 | Incident Response | IR & Forensics | PICERL playbooks, evidence collection, timeline analysis, memory forensics, IR reports |
| 08 | Network Security | Network | PCAP analysis, Suricata/Snort rules, firewall auditing, beaconing detection |
Quick Start
1. Clone the Repository
git clone https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill.git
cd Claude-Code-CyberSecurity-Skill
2. Install Skills into Claude Code
Claude Code loads skills from two locations:
| Location | Scope | Path |
|---|
| Global | All projects | ~/.claude/skills/ |
| Project | This project only | ./.claude/skills/ |
# Install globally (recommended — available everywhere)
mkdir -p ~/.claude/skills
cp -r skills/* ~/.claude/skills/
# Or symlink for development (changes auto-sync)
ln -sf "$(pwd)/skills/"* ~/.claude/skills/
# Or install to a specific project
mkdir -p /path/to/project/.claude/skills
cp -r skills/* /path/to/project/.claude/skills/
3. Use Claude Code
Open Claude Code and talk naturally. Claude activates the relevant skill based on what you ask:
claude
Example interactions:
# Recon (Skill 01 activates)
> Enumerate all subdomains for example.com and fingerprint the web stack
# Vulnerability Assessment (Skill 02 activates)
> Audit the Python dependencies in my project for known CVEs
# Malware Analysis (Skill 05 activates)
> Generate YARA rules from this suspicious PE file and extract all IOCs
# Threat Hunting (Skill 06 activates)
> Map these TTPs to MITRE ATT&CK and write Splunk SPL queries to hunt for them
# Blue Team (Skill 15 activates)
> Give me hardening commands to secure this Ubuntu 24.04 server following CIS Level 1
# Incident Response (Skill 07 activates)
> Create a ransomware incident response playbook for our SOC team
# AI/LLM Security (Skill 16 activates)
> Threat-model this RAG chatbot against the OWASP LLM Top 10 and test it for prompt injection
# Mobile Security (Skill 17 activates)
> Analyze this APK for exported components and hardcoded secrets against OWASP MASVS
# OT/ICS Security (Skill 18 activates)
> From this capture, which hosts are sending Modbus write commands to the PLCs?
# GRC & Compliance (Skill 19 activates)
> Run a SOC 2 gap analysis and map our controls to NIST CSF 2.0
You can also explicitly name a skill:
> Use the reverse-engineering skill to interpret this ARM assembly
> Use the log-analysis skill to build a Sentinel KQL query for DCSync detection
> Use the blue-team-defense skill to audit this Dockerfile
What's New in v3.0
Bigger, sharper, more powerful — four new domains and a full refresh of the original 15:
- 4 new skills (16–19) — AI & LLM Security, Mobile Security, OT/ICS/SCADA Security, and GRC & Compliance, each with full methodology, output templates, and runnable scripts
- AI/LLM Security — OWASP LLM Top 10 (2025) + MITRE ATLAS, prompt-injection test harness, RAG/agent/tool-use review, and a model supply-chain (
pickle) scanner
- Mobile Security — OWASP MASVS/MASTG, automated APK static triage (manifest, exported components, secret scanning), Frida/objection workflows
- OT/ICS/SCADA — Purdue-model review, passive industrial-protocol analysis (Modbus/DNP3/S7), ATT&CK for ICS, and IEC 62443 alignment with a safety-first gate
- GRC & Compliance — risk register scoring (qualitative + ALE), cross-framework control crosswalk (NIST CSF 2.0 ↔ ISO 27001 ↔ SOC 2 ↔ 800-53 ↔ CIS v8), gap analysis, and policy generation
- "v3.0 Enhancements (2026 Update)" section added to every original skill — current tradecraft (JA4+, CVSS 4.0 + EPSS + CISA KEV, finalized FIPS 203/204/205 PQC, AD CS ESC1–ESC14, OCSF detection-as-code, cloud attack-path thinking, and more)
- Stronger scripts — the red-team engagement planner is now ATT&CK-aligned with Markdown export; the hardening checker doubled its checks (sysctl, SSH crypto, kernel modules) and adds remediation hints; a latent permission-handling bug was fixed
- Built-in authorization & safety gates — offensive (03, 14) and high-risk (16, 18) skills require explicit authorization/safety confirmation before proceeding
Project Structure
Claude-Code-CyberSecurity-Skill/
├── README.md
├── INSTALL.md
├── USAGE.md
├── CONTRIBUTING.md
├── CHANGELOG.md
├── SECURITY.md
├── LICENSE
├── .gitignore
│
└── skills/
├── 01-recon-osint/ SKILL.md + scripts/ + examples/ + resources/
├── 02-vulnerability-scanner/ SKILL.md + scripts/ + examples/
├── 03-exploit-development/ SKILL.md + scripts/ + examples/
├── 04-reverse-engineering/ SKILL.md + scripts/ + examples/
├── 05-malware-analysis/ SKILL.md + scripts/ + examples/
├── 06-threat-hunting/ SKILL.md + scripts/ + examples/
├── 07-incident-response/ SKILL.md + scripts/ + examples/
├── 08-network-security/ SKILL.md + scripts/ + examples/
├── 09-web-security/ SKILL.md + scripts/ + examples/
├── 10-cloud-security/ SKILL.md + scripts/ + examples/
├── 11-csoc-automation/ SKILL.md + scripts/ + examples/
├── 12-log-analysis/ SKILL.md + scripts/ + examples/
├── 13-crypto-analysis/ SKILL.md + scripts/ + examples/
├── 14-red-team-ops/ SKILL.md + scripts/ + examples/
├── 15-blue-team-defense/ SKILL.md + scripts/ + examples/
├── 16-ai-llm-security/ SKILL.md + scripts/ + examples/
├── 17-mobile-security/ SKILL.md + scripts/ + examples/
├── 18-ot-ics-security/ SKILL.md + scripts/ + examples/
└── 19-grc-compliance/ SKILL.md + scripts/ + examples/
Prerequisites
| Requirement | Version | Purpose |
|---|
| Claude Code | Latest | AI coding assistant — install guide |
| Python | 3.10+ | Automation scripts |
| Git | 2.x+ | Repository management |
Optional Tools (Enhanced by Specific Skills)
- nmap — Port scanning and service detection (Skills 01, 08)
- Burp Suite — Web security testing (Skill 09)
- Ghidra / IDA Free — Reverse engineering (Skill 04)
- Wireshark / tshark — Network traffic analysis (Skill 08)
- Volatility 3 — Memory forensics (Skill 07)
- YARA — Malware pattern matching (Skills 05, 06)
- Trivy — Container and IaC scanning (Skill 10)
- Checkov / tfsec — Terraform security (Skill 10)
- Sigma CLI — Rule conversion between SIEM platforms (Skills 06, 12, 15)
- garak / promptfoo — LLM vulnerability scanning and red-team evaluation (Skill 16)
- apktool / jadx / Frida / objection — Mobile app reversing and instrumentation (Skill 17)
- tshark with ICS dissectors — Modbus/DNP3/S7 protocol analysis (Skill 18)
Contributing
Contributions are welcome. See CONTRIBUTING.md for:
- Adding new skills
- Improving existing skill methodology
- Submitting detection rules or hardening checklists
- Bug reports
License
MIT License — see LICENSE for details.
Disclaimer
This skill collection is intended for authorized security testing, research, CTF competitions, and educational purposes only. Users are solely responsible for compliance with all applicable laws. Offensive skills (Exploit Development, Red Team Operations) require explicit authorization confirmation before Claude will assist. The authors assume no liability for misuse.
