The Anthropic Cybersecurity Skills repository is an open-source library containing 817 structured cybersecurity skills designed specifically for AI agents. The project maps these skills across six major security frameworks: MITRE ATT&CK v19.1, NIST CSF 2.0, MITRE ATLAS, MITRE D3FEND, NIST AI RMF, and the MITRE Fight Fraud Framework (F3). This unified cross-framework coverage is unique among open-source skills libraries, allowing each skill to satisfy multiple compliance and security standards simultaneously. The repository follows the agentskills.io open standard and is compatible with over 26 AI platforms including Claude Code, GitHub Copilot, Cursor, Gemini CLI, and numerous others.
The skills span 29 distinct security domains and are organized to provide AI agents with the structured decision-making workflows that senior security analysts follow. Rather than offering generic scripts or wordlists, the repository encodes real practitioner knowledge through YAML frontmatter for rapid discovery and structured Markdown for step-by-step execution. Each skill includes reference files for deeper technical context, enabling agents to understand when to use each technique, what prerequisites to check, how to execute procedures, and how to verify results. The project explicitly addresses the cybersecurity workforce gap, which reached 4.8 million unfilled roles globally in 2024, by augmenting AI agents with domain expertise that transforms them from generic language models into capable security analysts.
The MITRE ATT&CK mapping is comprehensive, with all 754 skills validated against ATT&CK v19.1 using the official mitreattack-python library. The skills cover all 15 Enterprise tactics plus ICS and Mobile techniques where relevant, spanning 286 distinct techniques. The repository reflects ATT&CK v19.1's restructured Defense Evasion tactic, now split into Stealth and Defense Impairment categories. The MITRE Fight Fraud Framework integration is particularly recent, with F3 v1.1 released on April 9, 2026, adding fraud-specific tactics including Positioning and Monetization that extend beyond ATT&CK's initial compromise focus. The repository includes 94 fraud-relevant skills mapped to F3, with all 123 F3 v1.1 technique IDs verified against the upstream STIX bundle.
The project includes explicit security guidance emphasizing authorized and lawful use only. The library encompasses offensive and dual-use techniques such as red-team command and control, phishing simulation, and exploitation tools, which are intended exclusively for authorized penetration testing, security research, defense, and education. Users are required to obtain explicit written permission before testing against systems they do not own and must comply with all applicable laws and rules of engagement. The repository maintains a SECURITY.md file and CODE_OF_CONDUCT.md to establish responsible use expectations. Additionally, the creator is conducting the Global Agentic AI Readiness Survey (GARS-2026), an academic study measuring how prepared security professionals and enterprises are for agentic AI workflows, with survey responses offering early access to casky.ai.
