What are Claude Cybersecurity Skills? Complete Guide

Claude cybersecurity skills are the foundation of how AI agents do security work. If you have heard the term thrown around but are not sure what it actually means in practice, this guide covers everything.

What a Skill Is

A Claude cybersecurity skill is a structured text file that gives an AI agent precise instructions for completing one security task. Each file combines two things: context about the task domain, and a step-by-step methodology the agent follows when it runs.

The format comes from the agentskills.io open standard, which defines how skills should be structured so any compatible agent can read and execute them consistently.

A skill is not a script or a binary. It is closer to a well-written runbook, except the reader is an AI with access to security tools.

What Is Inside a Skill File

Every skill file has a YAML frontmatter block at the top and a markdown body below it.

The frontmatter carries metadata:

name and description of the skill
frameworks it maps to (MITRE ATT&CK technique, NIST CSF function, OWASP category)
severity guidance for finding classification
allowed_roles for access control
tags for search and filtering

The markdown body is the execution guide. It walks the agent through the task using natural language: what to look for, which tools to run, how to interpret output, and what to include in the finding.

Here is a simplified example of what the frontmatter looks like:

name: subdomain-enumeration
description: Enumerate subdomains of a target domain using passive and active techniques
mitre_technique: T1595.002
nist_function: ID.RA
owasp_category: A05
severity: medium

How Framework Mapping Works

Every skill is mapped to one or more security frameworks. This is what makes the skill library useful for compliance and reporting, not just execution.

The three primary mappings are:

MITRE ATT&CK maps skills to specific adversary techniques and tactics. A subdomain enumeration skill maps to T1595 (Active Scanning). A credential stuffing skill maps to T1110 (Brute Force). This lets you tie AI-generated findings directly to the ATT&CK matrix.
NIST CSF 2.0 maps skills to the six core functions: Govern, Identify, Protect, Detect, Respond, and Recover. Most offensive skills sit under Identify. Detection and monitoring skills fall under Detect.
OWASP Top 10 maps application security skills to the ten most critical web application risk categories. An injection testing skill maps to A03. An authentication testing skill maps to A07.

When an agent runs a skill, it inherits these mappings and can include them in any report it generates.

The Open Source Library

The skills used in Casky come from an open source library maintained on GitHub: mukul975/Anthropic-Cybersecurity-Skills.

The library currently contains 754 skills across 26 security domains , including OSINT and reconnaissance, web application and API security, network security, cloud infrastructure, malware analysis, digital forensics, identity and access management, red teaming, and more.

It is licensed under Apache 2.0, which means anyone can use it, contribute to it, or build on top of it.

The library has also been featured in awesome-agent-skills, a community collection of agent skills across multiple platforms.

How an Agent Runs a Skill

When you run a skill in Casky, the Claude agent receives the skill file as part of its context. It reads the methodology, uses the tools available in the sandbox, and works through the task step by step.

The agent produces a structured finding that includes what it found, how severe it is, which framework controls it relates to, and suggested remediation steps. Multiple findings roll up into a CVSS-scored report.

The agent does not improvise. The skill file is the constraint. This is intentional because it makes results reproducible and auditable, which matters when you are showing findings to a CISO or a compliance team.

Why Skills Instead of Prompts

A common question is why not just write a prompt. The answer comes down to consistency and coverage.

A one-off prompt produces one-off results. A skill file is a repeatable unit that any agent, on any run, executes the same way. You can version it, review it, map it to frameworks, assign it access controls, and audit its usage.

Skills also compose. A penetration test is not one task, it is dozens of tasks run in sequence. Having a library of 754 skills means you can chain them into comprehensive assessments without writing new instructions every time.

What Skills Cover

The 26 security domains in the library cover the full range of modern security work:

Reconnaissance and OSINT
Web application testing (injection, authentication, authorization, serialization)
API security
Network scanning and analysis
Cloud security (AWS, Azure, GCP)
Container and Kubernetes security
Active Directory and identity attacks
Malware analysis and reverse engineering
Digital forensics and incident response
Threat intelligence
Red teaming and post-exploitation
SOC operations and detection engineering
DevSecOps and supply chain security