Anthropic-Cybersecurity-Skills Documentation

File: README.md Copy Chapter

⚠️ Community Project — This is an independent, community-created project. Not affiliated with Anthropic PBC.

🔐 Authorized & lawful use only. This library includes offensive and dual-use techniques (e.g. red-team C2, phishing simulation, exploitation) intended for authorized penetration testing, security research, defense, and education. Only use them against systems you own or have explicit written permission to test, and comply with all applicable laws and rules of engagement. You are solely responsible for how you use these skills. See SECURITY.md and CODE_OF_CONDUCT.md.

Give any AI agent the security skills of a senior analyst Copy Chapter

A junior analyst knows which Volatility3 plugin to run on a suspicious memory dump, which Sigma rules catch Kerberoasting, and how to scope a cloud breach across three providers. Your AI agent doesn't — unless you give it these skills.

This repo contains 817 structured cybersecurity skills spanning 29 security domains, each following the agentskills.io open standard. The library maps across six industry frameworks — MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, MITRE D3FEND, NIST AI RMF, and the MITRE Fight Fraud Framework (F3) — with each skill mapped to the frameworks relevant to its type (a forensics skill carries ATT&CK + CSF; an AI-security skill adds ATLAS and AI RMF). Clone it, point your agent at it, and your next security investigation gets expert-level guidance in seconds.

Six frameworks, one skill library Copy Chapter

Each skill maps to the frameworks that fit its subject — ATT&CK and NIST CSF are near-universal, while ATLAS, AI RMF, D3FEND, and F3 apply where they're relevant. Framework coverage across the 817 skills: MITRE ATT&CK 805 · NIST CSF 2.0 804 · MITRE D3FEND 139 · NIST AI RMF 97 · MITRE F3 94 · MITRE ATLAS 93.

Example — each skill maps only to the frameworks relevant to it (one may hit all six, another just a couple):

🆕 MITRE Fight Fraud Framework (F3) — 94 fraud-relevant skills Copy Section

The MITRE Fight Fraud Framework (F3) was released April 9, 2026 by MITRE's Center for Threat-Informed Defense (CTID), co-developed with JPMorganChase, Citigroup, Lloyds Banking Group, Standard Chartered, CrowdStrike, Verizon Business, FS-ISAC, and others. It is an ATT&CK-compatible TTP catalog for cyber-enabled financial fraud — filling the gap ATT&CK leaves after initial compromise.

F3 v1.1 adds two fraud-specific tactics that ATT&CK does not enumerate:

• Positioning (FA0001) — actions taken after access to collect/manipulate data and prepare the fraud (synthetic-identity seeding, account warming, beneficiary setup, SIM-swap pre-positioning, banking-session hijack).
• Monetization (FA0002) — converting stolen assets into usable funds (money-mule layering, APP fraud, crypto off-ramping, card cash-out, refund/chargeback abuse).

Fraud-specific techniques use F1XXX IDs (e.g. F1005.003 Add Beneficiary, F1025.003 Wire Transfer, F1007 Adversary-in-the-Browser); reused ATT&CK techniques keep their T1XXX IDs. Mappings live in each skill's mitre_f3: frontmatter block — all 123 F3 v1.1 technique IDs were verified against the upstream STIX bundle. See docs/mitre-f3-mapping.md for the schema.

MITRE ATT&CK v19.1 — 805/817 skills mapped Copy Section

Every skill carries a mitre_attack frontmatter list validated against MITRE ATT&CK v19.1 (the latest release) using the official mitreattack-python library — 290 distinct techniques and sub-techniques (146 base + 144 sub) across Enterprise, ICS, and Mobile. Zero revoked or deprecated IDs. v19.1's restructured Defense Evasion (now split into Stealth and Defense Impairment) is reflected below.

Quick start Copy Chapter

# Option 1: npx (recommended)
npx skills add mukul975/Anthropic-Cybersecurity-Skills

# Option 2: Git clone
git clone https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
cd Anthropic-Cybersecurity-Skills

Works immediately with Claude Code, GitHub Copilot, OpenAI Codex CLI, Cursor, Gemini CLI, and any agentskills.io-compatible platform.

🌍 GARS-2026 — Global Agentic AI Readiness Survey Copy Chapter

I'm running a global academic study measuring how ready security professionals,
developers, and enterprise teams actually are for agentic AI — MCP servers,
tool calling, governance, and human-in-the-loop workflows.

If you use this repo, your response would be a genuinely valuable data point.

📋 Take the survey (10 min):
Survey Link

• 60 questions · Anonymous · Supervised by SRH Berlin
• You get 50 Casky Tokens for early access to casky.ai
• Results published open access under CC-BY 4.0

🚀 Try it on the Playground Copy Chapter

Experience Casky.ai hands-on — no setup required.

→ Launch Playground on Casky.ai

The playground lets you:

• Run live cybersecurity skill exercises against real targets
• See AI agents execute structured skills in real time
• Explore MITRE ATT&CK mapped workflows interactively
• Test threat hunting, DFIR, and penetration testing scenarios

No installation. No configuration. Just open and start.

Why this exists Copy Chapter

The cybersecurity workforce gap hit 4.8 million unfilled roles globally in 2024 (ISC2). AI agents can help close that gap — but only if they have structured domain knowledge to work from. Today's agents can write code and search the web, but they lack the practitioner playbooks that turn a generic LLM into a capable security analyst.

Existing security tool repos give you wordlists, payloads, or exploit code. None of them give an AI agent the structured decision-making workflow a senior analyst follows: when to use each technique, what prerequisites to check, how to execute step-by-step, and how to verify results. That is the gap this project fills.

Anthropic Cybersecurity Skills is not a collection of scripts or checklists. It is an AI-native knowledge base built from the ground up for the agentskills.io standard — YAML frontmatter for sub-second discovery, structured Markdown for step-by-step execution, and reference files for deep technical context. Every skill encodes real practitioner workflows, not generated summaries.

What's inside — 29 security domains Copy Chapter

How AI agents use these skills Copy Chapter

Each skill costs ~30 tokens to scan (frontmatter only) and 500–2,000 tokens to fully load (complete workflow). This progressive disclosure architecture lets agents search all 817 skills in a single pass without blowing context windows.

User prompt: "Analyze this memory dump for signs of credential theft"

Agent's internal process:

  1. Scans 817 skill frontmatters (~30 tokens each)
     → identifies 12 relevant skills by matching tags, description, domain

  2. Loads top 3 matches:
     • performing-memory-forensics-with-volatility3
     • hunting-for-credential-dumping-lsass
     • analyzing-windows-event-logs-for-credential-access

  3. Executes the structured Workflow section step-by-step
     → runs Volatility3 plugins, checks LSASS access patterns,
        correlates with event log evidence

  4. Validates results using the Verification section
     → confirms IOCs, maps findings to ATT&CK T1003 (Credential Dumping)

Without these skills, the agent guesses at tool commands and misses critical steps. With them, it follows the same playbook a senior DFIR analyst would use.

Skill anatomy Copy Chapter

Every skill follows a consistent directory structure:

skills/performing-memory-forensics-with-volatility3/
├── SKILL.md              ← Skill definition (YAML frontmatter + Markdown body)
├── references/
│   ├── standards.md      ← MITRE ATT&CK, ATLAS, D3FEND, NIST mappings
│   └── workflows.md      ← Deep technical procedure reference
├── scripts/
│   └── process.py        ← Working helper scripts
└── assets/
    └── template.md       ← Filled-in checklists and report templates

YAML frontmatter (real example) Copy Section

---
name: performing-memory-forensics-with-volatility3
  Analyze memory dumps to extract running processes, network connections,
  injected code, and malware artifacts using the Volatility3 framework.
domain: cybersecurity
subdomain: digital-forensics
tags: [forensics, memory-analysis, volatility3, incident-response, dfir]
atlas_techniques: [AML.T0047]
d3fend_techniques: [D3-MA, D3-PSMD]
nist_ai_rmf: [MEASURE-2.6]
nist_csf: [DE.CM-01, RS.AN-03]
version: "1.2"
author: mukul975
license: Apache-2.0
---

Markdown body sections Copy Section

## When to Use
Trigger conditions — when should an AI agent activate this skill?

## Prerequisites
Required tools, access levels, and environment setup.

## Workflow
Step-by-step execution guide with specific commands and decision points.

## Verification
How to confirm the skill was executed successfully.

Frontmatter fields: name (kebab-case, 1–64 chars), description (keyword-rich for agent discovery), domain, subdomain, tags, atlas_techniques (MITRE ATLAS IDs), d3fend_techniques (MITRE D3FEND IDs), nist_ai_rmf (NIST AI RMF references), nist_csf (NIST CSF 2.0 categories). MITRE ATT&CK technique mappings are documented in each skill's references/standards.md file and in the ATT&CK Navigator layer included with releases.

📊 MITRE ATT&CK Enterprise coverage — all 15 tactics

An ATT&CK Navigator layer file is included in the v1.0.0 release assets for visual coverage mapping.

Note: ATT&CK v19 lands April 28, 2026 — splitting Defense Evasion (TA0005) into two new tactics: Stealth and Impair Defenses. Skill mappings will be updated in a forthcoming release.

📊 NIST CSF 2.0 alignment — all 6 functions

NIST CSF 2.0 (February 2024) added the Govern function and expanded scope from critical infrastructure to all organizations. Skill mappings align to all 22 categories and reference 106 subcategories.

📊 Framework deep dive — ATLAS, D3FEND, AI RMF

MITRE ATLAS 2026.07 — AI/ML adversarial threats Copy Section

ATLAS maps adversarial tactics, techniques, and case studies specific to AI and machine learning systems. Release 2026.07 covers 101 techniques and 77 sub-techniques including agentic AI attack vectors added in late 2025: AI agent context poisoning, tool invocation abuse, MCP server compromises, and malicious agent deployment. Skills mapped to ATLAS help agents identify and defend against threats to ML pipelines, model weights, inference APIs, and autonomous workflows.

MITRE D3FEND v1.4.0 — Defensive countermeasures Copy Section

D3FEND is an NSA-funded knowledge graph of 270 defensive techniques organized across 7 tactical categories: Model, Harden, Detect, Isolate, Deceive, Evict, and Restore. Built on OWL 2 ontology, it uses a shared Digital Artifact layer to bidirectionally map defensive countermeasures to ATT&CK offensive techniques. Skills tagged with D3FEND identifiers let agents recommend specific countermeasures for detected threats.

NIST AI RMF 1.0 + GenAI Profile (AI 600-1) Copy Section

The AI Risk Management Framework defines 4 core functions — Govern, Map, Measure, Manage — with 72 subcategories for trustworthy AI development. The GenAI Profile (AI 600-1, July 2024) adds 12 risk categories specific to generative AI, from confabulation and data privacy to prompt injection and supply chain risks. Colorado's AI Act (effective February 2026) provides a legal safe harbor for organizations complying with NIST AI RMF, making these mappings directly relevant to regulatory compliance.

Compatible platforms Copy Chapter

AI code assistants
Claude Code (Anthropic) · GitHub Copilot (Microsoft) · Cursor · Windsurf · Cline · Aider · Continue · Roo Code · Amazon Q Developer · Tabnine · Sourcegraph Cody · JetBrains AI

CLI agents
OpenAI Codex CLI · Gemini CLI (Google)

Autonomous agents
Devin · Replit Agent · SWE-agent · OpenHands

Agent frameworks & SDKs
LangChain · CrewAI · AutoGen · Semantic Kernel · Haystack · Vercel AI SDK · Any MCP-compatible agent

All platforms that support the agentskills.io standard can load these skills with zero configuration.

What people are saying Copy Chapter

"A database of real, organized security skills that any AI agent can plug into and use. Not tutorials. Not blog posts."
— Hasan Toor (@hasantoxr), AI/tech creator

"This is not a random collection of security scripts. It's a structured operational knowledge base designed for AI-driven security workflows."
— fazal-sec, Medium

Featured in Copy Chapter

Star history Copy Chapter

Releases Copy Chapter

Skills have continued to grow on main since v1.0.0 — the library now contains 817 skills with 6-framework mapping (MITRE ATLAS, D3FEND, NIST AI RMF, and the MITRE Fight Fraud Framework added post-release). Check Releases for the latest tagged version.

Contributing Copy Chapter

This project grows through community contributions. Here is how to get involved:

Add a new skill — Domains like Deception Technology (2 skills) and Compliance & Governance (5 skills) need the most help. Follow the template in CONTRIBUTING.md and submit a PR with the title Add skill: your-skill-name.

Improve existing skills — Add framework mappings, fix workflows, update tool references, or contribute scripts and templates.

Report issues — Found an inaccurate procedure or broken script? Open an issue.

Every PR is reviewed for technical accuracy and agentskills.io standard compliance within 48 hours. Check good first issues for a starting point.

This project follows the Contributor Covenant. By participating, you agree to uphold this code.

🙏 Thanks to our contributors Copy Chapter

This library is built by the community. Thank you to everyone who has contributed:

Community Copy Chapter

💬 Discussions — Questions, ideas, and roadmap conversations
🐛 Issues — Bug reports and feature requests
🔒 Security Policy — Responsible disclosure process (48-hour acknowledgment)

Citation Copy Chapter

If you use this project in research or publications:

@software{anthropic_cybersecurity_skills,
  author       = {Jangra, Mahipal},
  title        = {Anthropic Cybersecurity Skills},
  year         = {2026},
  url          = {https://github.com/mukul975/Anthropic-Cybersecurity-Skills},
  license      = {Apache-2.0},
  note         = {817 structured cybersecurity skills for AI agents,
                  mapped to MITRE ATT\&CK, NIST CSF 2.0, MITRE ATLAS,
                  MITRE D3FEND, and NIST AI RMF}
}

License Copy Chapter

This project is licensed under the Apache License 2.0. You are free to use, modify, and distribute these skills in both personal and commercial projects.

File: mappings/mitre-attack/README.md Copy Chapter

MITRE ATT&CK Mapping

This directory maps the cybersecurity skills in this repository to the MITRE ATT&CK framework (Enterprise v15).

Overview Copy Chapter

MITRE ATT&CK is a curated knowledge base and model for cyber adversary behavior, reflecting the various phases of an adversary's lifecycle and the platforms they target. This mapping connects our hands-on skills to ATT&CK tactics and techniques, enabling:

• Threat-informed defense -- prioritize skill development based on real adversary behavior
• Gap analysis -- identify ATT&CK techniques not yet covered by available skills
• Purple team exercises -- pair offensive (red team) and defensive (blue team) skills for each technique
• Agent-driven discovery -- AI agents can query skills by ATT&CK ID for automated security workflows

Mapping Methodology Copy Chapter

Tactic Mapping (TA00xx) Copy Section

Each of the 14 ATT&CK Enterprise tactics represents a distinct adversary objective. Skills are mapped to tactics based on which adversary goal they help achieve (offensive) or defend against (defensive):

Technique Mapping (T1xxx) Copy Section

Skills are mapped to specific techniques based on their content. Examples:

Sub-technique Mapping (T1xxx.xxx) Copy Section

Where applicable, skills are mapped to sub-techniques for precision. For example:

• T1566.001 (Spearphishing Attachment) -- analyzing-email-headers-for-phishing-investigation
• T1566.002 (Spearphishing Link) -- analyzing-certificate-transparency-for-phishing
• T1003.001 (LSASS Memory) -- analyzing-memory-dumps-with-volatility

ATT&CK Navigator Integration Copy Chapter

You can visualize our skill coverage using the ATT&CK Navigator. To generate a Navigator layer:

1. Use the coverage summary in coverage-summary.md to identify covered tactics
2. Import the tactic/technique IDs into a Navigator layer JSON
3. Color-code by coverage depth (number of skills per technique)

Suggested Color Scale Copy Section

Skill Tag Convention Copy Chapter

Skills relevant to ATT&CK carry these tags in their YAML frontmatter:

• mitre-attack -- general ATT&CK relevance (56 skills currently tagged)
• Technique-specific tags like privilege-escalation, lateral-movement, persistence
• Tool-specific tags that map to ATT&CK software entries (e.g., cobalt-strike, mimikatz)

How to Contribute Mappings Copy Chapter

1. Identify the skill -- Read the skill's SKILL.md to understand what it teaches
2. Find the ATT&CK technique -- Search attack.mitre.org for the matching technique
3. Determine offensive vs. defensive -- Is the skill about performing or detecting/preventing the technique?
4. Update the mapping -- Add the technique ID to the appropriate table in this directory
5. Update skill tags -- Add mitre-attack and technique-specific tags to the skill's frontmatter
6. Submit a PR -- Include the ATT&CK technique URL as justification

References Copy Chapter

• MITRE ATT&CK Enterprise Matrix
• MITRE ATT&CK Navigator
• ATT&CK v15 Release Notes
• MITRE ATT&CK for ICS -- relevant for ot-ics-security skills
• MITRE ATT&CK for Mobile -- relevant for mobile-security skills

File: mappings/nist-csf/README.md Copy Chapter

NIST Cybersecurity Framework 2.0 Mapping

This directory maps the cybersecurity skills in this repository to the NIST Cybersecurity Framework (CSF) 2.0, published February 2024.

Overview Copy Chapter

NIST CSF 2.0 organizes cybersecurity activities into 6 core functions that represent the full lifecycle of managing cybersecurity risk. This mapping enables organizations to:

• Align skill development to their CSF implementation tier
• Identify training gaps across the CSF functions
• Build role-based learning paths using CSF categories
• Automate compliance mapping through AI agent queries

CSF 2.0 Functions and Skill Alignment Copy Chapter

Govern (GV) -- Cybersecurity Risk Management Strategy Copy Section

Establishing and monitoring the organization's cybersecurity risk management strategy, expectations, and policy.

Primary subdomains: compliance-governance (5), identity-access-management (33), devsecops (16)

Identify (ID) -- Understanding Organizational Cybersecurity Risk Copy Section

Understanding the organization's current cybersecurity risks.

Primary subdomains: vulnerability-management (24), threat-intelligence (43), cloud-security (48)

Protect (PR) -- Safeguarding Assets Copy Section

Using safeguards to prevent or reduce cybersecurity risk.

Primary subdomains: zero-trust-architecture (13), devsecops (16), identity-access-management (33), cryptography (13)

Detect (DE) -- Finding and Analyzing Cybersecurity Events Copy Section

Finding and analyzing possible cybersecurity compromises and anomalies.

Primary subdomains: threat-hunting (35), soc-operations (33), malware-analysis (34)

Respond (RS) -- Taking Action Regarding Detected Incidents Copy Section

Managing and responding to detected cybersecurity incidents.

Primary subdomains: incident-response (24), digital-forensics (34), malware-analysis (34)

Recover (RC) -- Restoring Capabilities After an Incident Copy Section

Restoring assets and operations affected by a cybersecurity incident.

Primary subdomains: incident-response (24), ransomware-defense (5)

Function Coverage Distribution Copy Chapter

Govern   (GV): ████████████░░░░░░░░  ~54 skills (compliance, IAM, devsecops)
Identify (ID): ██████████████████░░  ~115 skills (vuln-mgmt, threat-intel, cloud)
Protect  (PR): ████████████████████  ~160 skills (IAM, ZTA, devsecops, crypto)
Detect   (DE): ████████████████░░░░  ~102 skills (threat-hunting, SOC, malware)
Respond  (RS): ██████████████████░░  ~111 skills (IR, forensics, malware)
Recover  (RC): ████░░░░░░░░░░░░░░░░  ~29 skills (IR recovery, ransomware)

How to Use This Mapping Copy Chapter

For Organizations Copy Section

1. Determine your target CSF implementation tier (Partial, Risk Informed, Repeatable, Adaptive)
2. Identify your CSF function priorities
3. Use the category tables above to find relevant skill subdomains
4. Deploy skills from those subdomains to your team's training plan

For AI Agents Copy Section

Query skills by CSF function using subdomain filters:

# Find all Detect (DE) function skills
Filter: subdomain IN (threat-hunting, soc-operations, malware-analysis)

# Find all Protect (PR) function skills
Filter: subdomain IN (identity-access-management, zero-trust-architecture, devsecops, cryptography)

For Security Teams Copy Section

Use the alignment table in csf-alignment.md for a complete subdomain-to-category cross-reference.

References Copy Chapter

• NIST CSF 2.0 (February 2024)
• NIST SP 800-53 Rev. 5 Control Mapping
• CSF 2.0 Quick Start Guides
• CSF 2.0 Reference Tool

File: mappings/owasp/README.md Copy Chapter

OWASP Top 10 (2025) Mapping

This directory maps the cybersecurity skills in this repository to the OWASP Top 10 categories for web application security risks.

Overview Copy Chapter

The OWASP Top 10 represents the most critical security risks to web applications. This mapping connects hands-on skills to each risk category, enabling teams to build targeted training programs for secure development and application security testing.

OWASP Top 10 2025 Skill Mapping Copy Chapter

A01:2025 -- Broken Access Control Copy Section

Restrictions on what authenticated users are allowed to do are not properly enforced.

Example skills: Implementing RBAC, testing for IDOR vulnerabilities, configuring OAuth 2.0 securely, enforcing API authorization policies.

A02:2025 -- Cryptographic Failures Copy Section

Failures related to cryptography that lead to exposure of sensitive data.

Example skills: Configuring TLS 1.3, implementing envelope encryption with KMS, securing JWT tokens, certificate pinning.

A03:2025 -- Injection Copy Section

User-supplied data is sent to an interpreter as part of a command or query without proper validation.

Example skills: Exploiting and remediating SQL injection, testing for stored/reflected XSS, configuring parameterized queries, SAST pipeline integration.

A04:2025 -- Insecure Design Copy Section

Risks related to design and architectural flaws, calling for more use of threat modeling and secure design patterns.

Example skills: Conducting threat modeling with STRIDE, implementing secure design patterns, defining trust boundaries, security architecture review.

A05:2025 -- Security Misconfiguration Copy Section

Missing or incorrect security hardening across the application stack.

Example skills: Auditing AWS S3 bucket permissions, hardening Kubernetes clusters, configuring security headers, CIS benchmark compliance.

A06:2025 -- Vulnerable and Outdated Components Copy Section

Using components with known vulnerabilities or that are no longer maintained.

Example skills: Running Trivy container scans, implementing SCA in CI/CD, generating and analyzing SBOMs, CVE prioritization with CVSS/EPSS.

A07:2025 -- Identification and Authentication Failures Copy Section

Weaknesses in authentication and session management.

Example skills: Implementing FIDO2/WebAuthn, configuring adaptive MFA, securing API authentication, detecting credential stuffing attacks.

A08:2025 -- Software and Data Integrity Failures Copy Section

Failures related to code and infrastructure that do not protect against integrity violations.

Example skills: Implementing Sigstore for container signing, securing CI/CD pipelines, verifying software supply chain integrity, content trust enforcement.

A09:2025 -- Security Logging and Monitoring Failures Copy Section

Insufficient logging, detection, monitoring, and active response.

Example skills: Analyzing security logs with Splunk, writing Sigma detection rules, configuring SIEM correlation rules, implementing centralized logging.

A10:2025 -- Server-Side Request Forgery (SSRF) Copy Section

Fetching a remote resource without validating the user-supplied URL.

Example skills: Testing for SSRF vulnerabilities, securing cloud metadata endpoints (IMDSv2), implementing URL validation and allowlisting, detecting SSRF in API integrations.

Cross-Reference: OWASP to ATT&CK Copy Chapter

Cross-Reference: OWASP to NIST CSF 2.0 Copy Chapter

References Copy Chapter

• OWASP Top 10 Project
• OWASP API Security Top 10 -- relevant for api-security subdomain
• OWASP Mobile Top 10 -- relevant for mobile-security subdomain
• OWASP Testing Guide
• OWASP ASVS -- Application Security Verification Standard

File: mappings/README.md Copy Chapter

MITRE ATT&CK Navigator Layer - Anthropic Cybersecurity Skills

This directory contains a MITRE ATT&CK Navigator layer file that maps the coverage of the Anthropic Cybersecurity Skills repository against the ATT&CK Enterprise matrix.

Files Copy Chapter

How to View Copy Chapter

1. Open the MITRE ATT&CK Navigator
2. Click Open Existing Layer
3. Select Upload from local and choose attack-navigator-layer.json
4. The matrix will display with blue-shaded techniques indicating coverage

Alternatively, paste the raw JSON URL into the Navigator's "Load from URL" option if this file is hosted publicly.

Coverage Statistics Copy Chapter

Coverage by Tactic Copy Chapter

Color Scale Copy Chapter

The layer uses a blue gradient to indicate coverage depth:

• Light blue (#cfe2f3): 1-2 skills reference this technique
• Medium blue (#6fa8dc): 3-5 skills reference this technique
• Dark blue (#3d85c6): 6-10 skills reference this technique
• Deep blue (#1155cc): 11+ skills reference this technique

Top 10 Most Covered Techniques Copy Chapter

Methodology Copy Chapter

Techniques were extracted by scanning all SKILL.md files in the repository for ATT&CK technique ID patterns (T1XXX and T1XXX.XXX). Each technique's score is proportional to the number of distinct skills that reference it, normalized to a 1-100 scale.

Layer Format Copy Chapter

• Format version: 4.5
• ATT&CK version: 14 (Enterprise)
• Navigator version: 4.9.1
• Domain: enterprise-attack

Related Links Copy Chapter

• MITRE ATT&CK Framework
• ATT&CK Navigator
• ATT&CK Navigator GitHub

File: tools/README.md Copy Chapter

Skill Validation Tools

validate-skill.py Copy Chapter

Validate SKILL.md metadata before submitting a PR.

Usage Copy Section

# Validate a single skill
python tools/validate-skill.py skills/my-new-skill/

# Validate all skills
python tools/validate-skill.py --all

What it checks Copy Section

• SKILL.md exists in the skill directory
• Valid YAML frontmatter (between --- markers)
• Required fields present: name, description, domain, subdomain, tags
• Name is kebab-case, 1–64 characters
• Description is at least 50 characters (no upper limit; multi-line folded scalars are valid)
• Domain is cybersecurity
• Subdomain is from the allowed list
• Tags is a list with at least 2 items

Requirements Copy Section

Python 3.8+ (stdlib only, no external dependencies)