🛡️ Antivirus Notice: Some AV engines may flag this repository due to security testing payload templates (string constants for authorized pentesting). These are false positives — no executable malware exists. This is standard for all cybersecurity toolkits (SecLists, PayloadsAllTheThings, Metasploit face the same detections). See SECURITY.md for details.

Claude Code CyberSecurity Skill Collection

20 production-quality Claude Code Skills for cybersecurity professionals — covering offensive security, defensive operations, reverse engineering, threat hunting, CSOC automation, AI/LLM security, mobile, OT/ICS, GRC, software supply chain security, and more. Version 3.0 — expanded coverage, sharper methodology, and stronger automation.

Transform Claude Code into your ultimate cybersecurity co-pilot. Each skill provides Claude with structured methodology, decision frameworks, ready-to-run commands, and output templates that enable precise, expert-level assistance for real-world security operations.

---

What Are Claude Code Skills?

Claude Code Skills are structured SKILL.md files that you install into your ~/.claude/skills/ directory (global) or .claude/skills/ (project-specific). When Claude reads these files, it gains deep, domain-specific expertise that goes far beyond generic knowledge.

How Skills Work

Skills are instruction documents Claude reads at conversation start. Each SKILL.md contains:

1. YAML frontmatter — name, description, tags for skill identification
2. Activation triggers — Explicit list of prompts that should invoke this skill
3. Methodology — Step-by-step procedures Claude follows natively
4. Output templates — Exact formats for reports, rules, and artifacts Claude produces
5. Script references — When and how to use the included Python automation scripts
6. Authorization gates — Built-in prompts for offensive skills to confirm legal scope

Claude Code-Native Design

These skills are built around what Claude does natively in Claude Code:

• Read configuration files, code, and logs directly — no copy-paste needed
• Bash tool to run scripts, network commands, and system queries
• Analysis of disassembly, PCAP data, log events, and code with full context
• Generation of detection rules, hardening scripts, reports, and payloads
• WebSearch for CVE lookups, threat intelligence, and vulnerability research

---

Update proof of works

Update testing

Skill Collection

#	Skill	Domain	Key Capabilities
01	Recon & OSINT	Reconnaissance	Subdomain enum, DNS analysis, technology fingerprinting, Google dorking, WHOIS
02	Vulnerability Scanner	Assessment	Dependency auditing, config review, CVSS scoring, structured vulnerability reports
03	Exploit Development	Offensive	PoC templates, payload generation, buffer overflow, web exploit payloads
04	Reverse Engineering	Analysis	Binary triage, assembly interpretation, firmware RE, protocol reversing, CTF
05	Malware Analysis	Threat Analysis	Static analysis, YARA generation, sandbox setup, behavioral analysis, IOC extraction
06	Threat Hunting	Hunting	IOC extraction, ATT&CK mapping, hunt hypotheses, Sigma + SIEM query library
07	Incident Response	IR & Forensics	PICERL playbooks, evidence collection, timeline analysis, memory forensics, IR reports
08	Network Security	Network	PCAP analysis, Suricata/Snort rules, firewall auditing, beaconing detection
09	Web Security	Web	OWASP Top 10, injection testing, API security, JWT analysis, security headers
10	Cloud Security	Cloud	AWS/Azure/GCP audit, Dockerfile review, K8s hardening, IaC scanning
11	CSOC Automation	SOC Operations	Alert triage, playbook YAML, escalation workflows, shift reports, KPI tracking
12	Log Analysis & SIEM	Log Analysis	SIEM query library (Splunk/KQL/EQL), Sigma rules, anomaly detection, correlation
13	Cryptographic Analysis	Cryptography	TLS auditing, cipher analysis, hash identification, crypto code review, PQC guidance
14	Red Team Operations	Red Team	Engagement planning, C2 design, AD attacks, OPSEC, social engineering, reporting
15	Blue Team Defense	Blue Team	Linux/Windows hardening, detection engineering, baselines, patch management
16	AI & LLM Security	AI Security	Prompt injection, OWASP LLM Top 10, RAG & agent/tool-use security, model supply chain, AI red teaming
17	Mobile Security	Mobile	Android/iOS testing, MASVS/MASTG, APK/IPA static analysis, Frida/objection, mobile malware triage
18	OT / ICS / SCADA Security	Industrial	Purdue model, Modbus/DNP3/S7 analysis, IEC 62443, ATT&CK for ICS, safety-first methodology
19	GRC & Compliance	Governance	Risk scoring, NIST CSF 2.0/ISO 27001/SOC 2 mapping, gap analysis, audit evidence, policy generation
20	Supply Chain Security	Supply Chain	SBOM generation/analysis, dependency confusion & typosquatting detection, CI/CD pipeline hardening, SLSA/Sigstore provenance

---

Quick Start

1. Clone the Repository

git clone https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill.git
cd Claude-Code-CyberSecurity-Skill

2. Install Skills into Claude Code

Claude Code loads skills from two locations:

Location	Scope	Path
Global	All projects	~/.claude/skills/
Project	This project only	./.claude/skills/

# Install globally (recommended — available everywhere)
mkdir -p ~/.claude/skills
cp -r skills/* ~/.claude/skills/

# Or symlink for development (changes auto-sync)
ln -sf "$(pwd)/skills/"* ~/.claude/skills/

# Or install to a specific project
mkdir -p /path/to/project/.claude/skills
cp -r skills/* /path/to/project/.claude/skills/

3. Use Claude Code

Open Claude Code and talk naturally. Claude activates the relevant skill based on what you ask:

claude

Example interactions:

# Recon (Skill 01 activates)
> Enumerate all subdomains for example.com and fingerprint the web stack

# Vulnerability Assessment (Skill 02 activates)
> Audit the Python dependencies in my project for known CVEs

# Malware Analysis (Skill 05 activates)
> Generate YARA rules from this suspicious PE file and extract all IOCs

# Threat Hunting (Skill 06 activates)
> Map these TTPs to MITRE ATT&CK and write Splunk SPL queries to hunt for them

# Blue Team (Skill 15 activates)
> Give me hardening commands to secure this Ubuntu 24.04 server following CIS Level 1

# Incident Response (Skill 07 activates)  
> Create a ransomware incident response playbook for our SOC team

# AI/LLM Security (Skill 16 activates)
> Threat-model this RAG chatbot against the OWASP LLM Top 10 and test it for prompt injection

# Mobile Security (Skill 17 activates)
> Analyze this APK for exported components and hardcoded secrets against OWASP MASVS

# OT/ICS Security (Skill 18 activates)
> From this capture, which hosts are sending Modbus write commands to the PLCs?

# GRC & Compliance (Skill 19 activates)
> Run a SOC 2 gap analysis and map our controls to NIST CSF 2.0

# Supply Chain Security (Skill 20 activates)
> Audit this repo for typosquatted dependencies and unpinned GitHub Actions

You can also explicitly name a skill:

> Use the reverse-engineering skill to interpret this ARM assembly
> Use the log-analysis skill to build a Sentinel KQL query for DCSync detection
> Use the blue-team-defense skill to audit this Dockerfile

---

What's New in v3.0

Bigger, sharper, more powerful — four new domains and a full refresh of the original 15:

• 4 new skills (16–19) — AI & LLM Security, Mobile Security, OT/ICS/SCADA Security, and GRC & Compliance, each with full methodology, output templates, and runnable scripts
• AI/LLM Security — OWASP LLM Top 10 (2025) + MITRE ATLAS, prompt-injection test harness, RAG/agent/tool-use review, and a model supply-chain (pickle) scanner
• Mobile Security — OWASP MASVS/MASTG, automated APK static triage (manifest, exported components, secret scanning), Frida/objection workflows
• OT/ICS/SCADA — Purdue-model review, passive industrial-protocol analysis (Modbus/DNP3/S7), ATT&CK for ICS, and IEC 62443 alignment with a safety-first gate
• GRC & Compliance — risk register scoring (qualitative + ALE), cross-framework control crosswalk (NIST CSF 2.0 ↔ ISO 27001 ↔ SOC 2 ↔ 800-53 ↔ CIS v8), gap analysis, and policy generation
• "v3.0 Enhancements (2026 Update)" section added to every original skill — current tradecraft (JA4+, CVSS 4.0 + EPSS + CISA KEV, finalized FIPS 203/204/205 PQC, AD CS ESC1–ESC14, OCSF detection-as-code, cloud attack-path thinking, and more)
• Stronger scripts — the red-team engagement planner is now ATT&CK-aligned with Markdown export; the hardening checker doubled its checks (sysctl, SSH crypto, kernel modules) and adds remediation hints; a latent permission-handling bug was fixed
• Built-in authorization & safety gates — offensive (03, 14) and high-risk (16, 18) skills require explicit authorization/safety confirmation before proceeding

---

Project Structure

Claude-Code-CyberSecurity-Skill/
├── README.md
├── INSTALL.md
├── USAGE.md
├── CONTRIBUTING.md
├── CHANGELOG.md
├── SECURITY.md
├── LICENSE
├── .gitignore
│
└── skills/
    ├── 01-recon-osint/          SKILL.md + scripts/ + examples/ + resources/
    ├── 02-vulnerability-scanner/ SKILL.md + scripts/ + examples/
    ├── 03-exploit-development/   SKILL.md + scripts/ + examples/
    ├── 04-reverse-engineering/   SKILL.md + scripts/ + examples/
    ├── 05-malware-analysis/      SKILL.md + scripts/ + examples/
    ├── 06-threat-hunting/        SKILL.md + scripts/ + examples/
    ├── 07-incident-response/     SKILL.md + scripts/ + examples/
    ├── 08-network-security/      SKILL.md + scripts/ + examples/
    ├── 09-web-security/          SKILL.md + scripts/ + examples/
    ├── 10-cloud-security/        SKILL.md + scripts/ + examples/
    ├── 11-csoc-automation/       SKILL.md + scripts/ + examples/
    ├── 12-log-analysis/          SKILL.md + scripts/ + examples/
    ├── 13-crypto-analysis/       SKILL.md + scripts/ + examples/
    ├── 14-red-team-ops/          SKILL.md + scripts/ + examples/
    ├── 15-blue-team-defense/     SKILL.md + scripts/ + examples/
    ├── 16-ai-llm-security/       SKILL.md + scripts/ + examples/
    ├── 17-mobile-security/       SKILL.md + scripts/ + examples/
    ├── 18-ot-ics-security/       SKILL.md + scripts/ + examples/
    ├── 19-grc-compliance/        SKILL.md + scripts/ + examples/
    └── 20-supply-chain-security/ SKILL.md + scripts/ + examples/

---

Prerequisites

Requirement	Version	Purpose
Claude Code	Latest	AI coding assistant — install guide
Python	3.10+	Automation scripts
Git	2.x+	Repository management

Optional Tools (Enhanced by Specific Skills)

• nmap — Port scanning and service detection (Skills 01, 08)
• Burp Suite — Web security testing (Skill 09)
• Ghidra / IDA Free — Reverse engineering (Skill 04)
• Wireshark / tshark — Network traffic analysis (Skill 08)
• Volatility 3 — Memory forensics (Skill 07)
• YARA — Malware pattern matching (Skills 05, 06)
• Trivy — Container and IaC scanning (Skill 10)
• Checkov / tfsec — Terraform security (Skill 10)
• Sigma CLI — Rule conversion between SIEM platforms (Skills 06, 12, 15)
• garak / promptfoo — LLM vulnerability scanning and red-team evaluation (Skill 16)
• apktool / jadx / Frida / objection — Mobile app reversing and instrumentation (Skill 17)
• tshark with ICS dissectors — Modbus/DNP3/S7 protocol analysis (Skill 18)

---

Contributing

Contributions are welcome. See CONTRIBUTING.md for:

• Adding new skills
• Improving existing skill methodology
• Submitting detection rules or hardening checklists
• Bug reports

---

License

MIT License — see LICENSE for details.

---

Disclaimer

This skill collection is intended for authorized security testing, research, CTF competitions, and educational purposes only. Users are solely responsible for compliance with all applicable laws. Offensive skills (Exploit Development, Red Team Operations) require explicit authorization confirmation before Claude will assist. The authors assume no liability for misuse.

---

Built for the CyberSecurity Community
GitHub • Issues • Discussions