Claude Code Cybersecurity Skill — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Claude Code Cybersecurity Skill (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<p align="center"> <img src="assets/banner.png" alt="Claude Code Cyber Security Skills" width="100%">
<img src="https://img.shields.io/badge/Claude%20Code-CyberSecurity%20Skills-red?style=for-the-badge" alt="Claude Code CyberSecurity Skills"/> <br/> <img src="https://img.shields.io/badge/Skills-19-blue?style=flat-square" alt="Skills"/> <img src="https://img.shields.io/badge/Version-3.0.0-orange?style=flat-square" alt="Version"/> <img src="https://img.shields.io/badge/License-MIT-green?style=flat-square" alt="License"/> <img src="https://img.shields.io/badge/Python-3.10%2B-blue?style=flat-square&logo=python" alt="Python"/> <img src="https://img.shields.io/badge/Platform-Linux%20%7C%20macOS%20%7C%20Windows-lightgrey?style=flat-square" alt="Platform"/> </p>
<a href="https://www.star-history.com/?repos=Masriyan%2FClaude-Code-CyberSecurity-Skill&type=date&legend=top-left"> <picture> <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=Masriyan/Claude-Code-CyberSecurity-Skill&type=date&theme=dark&legend=top-left" /> <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=Masriyan/Claude-Code-CyberSecurity-Skill&type=date&legend=top-left" /> <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=Masriyan/Claude-Code-CyberSecurity-Skill&type=date&legend=top-left" /> </picture> </a>
19 production-quality Claude Code Skills for cybersecurity professionals — covering offensive security, defensive operations, reverse engineering, threat hunting, CSOC automation, AI/LLM security, mobile, OT/ICS, GRC, and more. Version 3.0 — expanded coverage, sharper methodology, and stronger automation.
Transform Claude Code into your ultimate cybersecurity co-pilot. Each skill provides Claude with structured methodology, decision frameworks, ready-to-run commands, and output templates that enable precise, expert-level assistance for real-world security operations.
Claude Code Skills are structured SKILL.md files that you install into your ~/.claude/skills/ directory (global) or .claude/skills/ (project-specific). When Claude reads these files, it gains deep, domain-specific expertise that goes far beyond generic knowledge.
Skills are instruction documents Claude reads at conversation start. Each SKILL.md contains:
name, description, tags for skill identificationThese skills are built around what Claude does natively in Claude Code:
| # | Skill | Domain | Key Capabilities |
|---|---|---|---|
| 01 | Recon & OSINT | Reconnaissance | Subdomain enum, DNS analysis, technology fingerprinting, Google dorking, WHOIS |
| 02 | Vulnerability Scanner | Assessment | Dependency auditing, config review, CVSS scoring, structured vulnerability reports |
| 03 | Exploit Development | Offensive | PoC templates, payload generation, buffer overflow, web exploit payloads |
| 04 | Reverse Engineering | Analysis | Binary triage, assembly interpretation, firmware RE, protocol reversing, CTF |
| 05 | Malware Analysis | Threat Analysis | Static analysis, YARA generation, sandbox setup, behavioral analysis, IOC extraction |
| 06 | Threat Hunting | Hunting | IOC extraction, ATT&CK mapping, hunt hypotheses, Sigma + SIEM query library |
| 07 | Incident Response | IR & Forensics | PICERL playbooks, evidence collection, timeline analysis, memory forensics, IR reports |
| 08 | Network Security | Network | PCAP analysis, Suricata/Snort rules, firewall auditing, beaconing detection |
| 09 | Web Security | Web | OWASP Top 10, injection testing, API security, JWT analysis, security headers |
| 10 | Cloud Security | Cloud | AWS/Azure/GCP audit, Dockerfile review, K8s hardening, IaC scanning |
| 11 | CSOC Automation | SOC Operations | Alert triage, playbook YAML, escalation workflows, shift reports, KPI tracking |
| 12 | Log Analysis & SIEM | Log Analysis | SIEM query library (Splunk/KQL/EQL), Sigma rules, anomaly detection, correlation |
| 13 | Cryptographic Analysis | Cryptography | TLS auditing, cipher analysis, hash identification, crypto code review, PQC guidance |
| 14 | Red Team Operations | Red Team | Engagement planning, C2 design, AD attacks, OPSEC, social engineering, reporting |
| 15 | Blue Team Defense | Blue Team | Linux/Windows hardening, detection engineering, baselines, patch management |
| 16 | AI & LLM Security | AI Security | Prompt injection, OWASP LLM Top 10, RAG & agent/tool-use security, model supply chain, AI red teaming |
| 17 | Mobile Security | Mobile | Android/iOS testing, MASVS/MASTG, APK/IPA static analysis, Frida/objection, mobile malware triage |
| 18 | OT / ICS / SCADA Security | Industrial | Purdue model, Modbus/DNP3/S7 analysis, IEC 62443, ATT&CK for ICS, safety-first methodology |
| 19 | GRC & Compliance | Governance | Risk scoring, NIST CSF 2.0/ISO 27001/SOC 2 mapping, gap analysis, audit evidence, policy generation |
git clone https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill.git
cd Claude-Code-CyberSecurity-SkillClaude Code loads skills from two locations:
| Location | Scope | Path |
|---|---|---|
| Global | All projects | ~/.claude/skills/ |
| Project | This project only | ./.claude/skills/ |
# Install globally (recommended — available everywhere)
mkdir -p ~/.claude/skills
cp -r skills/* ~/.claude/skills/
# Or symlink for development (changes auto-sync)
ln -sf "$(pwd)/skills/"* ~/.claude/skills/
# Or install to a specific project
mkdir -p /path/to/project/.claude/skills
cp -r skills/* /path/to/project/.claude/skills/Open Claude Code and talk naturally. Claude activates the relevant skill based on what you ask:
claudeExample interactions:
# Recon (Skill 01 activates)
> Enumerate all subdomains for example.com and fingerprint the web stack
# Vulnerability Assessment (Skill 02 activates)
> Audit the Python dependencies in my project for known CVEs
# Malware Analysis (Skill 05 activates)
> Generate YARA rules from this suspicious PE file and extract all IOCs
# Threat Hunting (Skill 06 activates)
> Map these TTPs to MITRE ATT&CK and write Splunk SPL queries to hunt for them
# Blue Team (Skill 15 activates)
> Give me hardening commands to secure this Ubuntu 24.04 server following CIS Level 1
# Incident Response (Skill 07 activates)
> Create a ransomware incident response playbook for our SOC team
# AI/LLM Security (Skill 16 activates)
> Threat-model this RAG chatbot against the OWASP LLM Top 10 and test it for prompt injection
# Mobile Security (Skill 17 activates)
> Analyze this APK for exported components and hardcoded secrets against OWASP MASVS
# OT/ICS Security (Skill 18 activates)
> From this capture, which hosts are sending Modbus write commands to the PLCs?
# GRC & Compliance (Skill 19 activates)
> Run a SOC 2 gap analysis and map our controls to NIST CSF 2.0You can also explicitly name a skill:
> Use the reverse-engineering skill to interpret this ARM assembly
> Use the log-analysis skill to build a Sentinel KQL query for DCSync detection
> Use the blue-team-defense skill to audit this DockerfileBigger, sharper, more powerful — four new domains and a full refresh of the original 15:
pickle) scannerClaude-Code-CyberSecurity-Skill/
├── README.md
├── INSTALL.md
├── USAGE.md
├── CONTRIBUTING.md
├── CHANGELOG.md
├── SECURITY.md
├── LICENSE
├── .gitignore
│
└── skills/
├── 01-recon-osint/ SKILL.md + scripts/ + examples/ + resources/
├── 02-vulnerability-scanner/ SKILL.md + scripts/ + examples/
├── 03-exploit-development/ SKILL.md + scripts/ + examples/
├── 04-reverse-engineering/ SKILL.md + scripts/ + examples/
├── 05-malware-analysis/ SKILL.md + scripts/ + examples/
├── 06-threat-hunting/ SKILL.md + scripts/ + examples/
├── 07-incident-response/ SKILL.md + scripts/ + examples/
├── 08-network-security/ SKILL.md + scripts/ + examples/
├── 09-web-security/ SKILL.md + scripts/ + examples/
├── 10-cloud-security/ SKILL.md + scripts/ + examples/
├── 11-csoc-automation/ SKILL.md + scripts/ + examples/
├── 12-log-analysis/ SKILL.md + scripts/ + examples/
├── 13-crypto-analysis/ SKILL.md + scripts/ + examples/
├── 14-red-team-ops/ SKILL.md + scripts/ + examples/
├── 15-blue-team-defense/ SKILL.md + scripts/ + examples/
├── 16-ai-llm-security/ SKILL.md + scripts/ + examples/
├── 17-mobile-security/ SKILL.md + scripts/ + examples/
├── 18-ot-ics-security/ SKILL.md + scripts/ + examples/
└── 19-grc-compliance/ SKILL.md + scripts/ + examples/| Requirement | Version | Purpose |
|---|---|---|
| Claude Code | Latest | AI coding assistant — install guide |
| Python | 3.10+ | Automation scripts |
| Git | 2.x+ | Repository management |
Contributions are welcome. See CONTRIBUTING.md for:
MIT License — see LICENSE for details.
This skill collection is intended for authorized security testing, research, CTF competitions, and educational purposes only. Users are solely responsible for compliance with all applicable laws. Offensive skills (Exploit Development, Red Team Operations) require explicit authorization confirmation before Claude will assist. The authors assume no liability for misuse.
<p align="center"> <b>Built for the CyberSecurity Community</b><br/> <a href="https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill">GitHub</a> • <a href="https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/issues">Issues</a> • <a href="https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/discussions">Discussions</a> </p>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.