Developers can equip AI agents with 818 practical cybersecurity procedures
When deciding which plugin to run on a suspicious memory dump or how to narrow down a cloud intrusion, AI agents now follow verified procedures instead of vague guesses. This repository structures the decision-making workflows used by security professionals in the field into a knowledge base that AI can use immediately. It is a collection of manuals that explain which tools to use, in what order, and in what situations, rather than code.
Added F3 Framework for Financial Fraud Response
A recent update added mapping to the MITRE Fight Fraud Framework (F3), expanding the scope of financial fraud response. The 818 skills are categorized according to six industry standards: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF, and F3. Each skill is mapped only to frameworks relevant to its topic, filtering out unnecessary information. For example, forensic skills are linked to ATT&CK and CSF, while AI security skills are connected to ATLAS and AI RMF. This structure allows agents to quickly find the most appropriate defensive or analytical perspective for a specific threat.
Step-by-Step Information Loading for Token Efficiency
AI agents do not read all skills at once; they first scan approximately 30 tokens of metadata to select relevant skills. They then load and execute only the detailed workflow (500 to 2,000 tokens) of the selected skill. This method efficiently uses the agent's context window, allowing it to search through more than 800 skills in a single pass. Each skill includes four sections: 'When to Use', 'Prerequisites', 'Step-by-Step Workflow', and 'Result Verification', which improves execution accuracy. This replicates the logical flow followed by senior analysts rather than simply listing commands.
Practical Scope Covering 34 Security Domains
The repository covers 34 specific domains, including cloud security, SOC operations, threat hunting, digital forensics, red teaming, and AI security. Each domain is built around actual tools and techniques. For instance, the digital forensics domain includes memory analysis procedures using Volatility3, while the red team domain includes attack scenarios utilizing BloodHound CE and Sliver C2. It also includes areas with relatively fewer skills, such as OT/ICS security and blockchain security, making it applicable to various security environments. All skills follow the agentskills.io standard, so they can be used immediately without configuration on more than 20 AI platforms, including Claude Code, GitHub Copilot, and Cursor.
Legal Liability and Precautions for Offensive Techniques
This repository is a community project and is not affiliated with Anthropic. It includes offensive techniques such as red team C2, phishing simulation, and exploits, so it must only be used on systems where ownership or explicit written permission has been obtained. Unauthorized use results in legal liability, so clarifying the authority scope of the target system is the top priority. Although the number of skills has increased since v1.0.0, some PRs are pending review, so it is recommended to check the latest tagged release. The Apache 2.0 license permits commercial use, but the user bears the final responsibility for technical accuracy.
