🛡️ Antivirus Notice: Some AV engines may flag this repository due to security testing payload templates (string constants for authorized pentesting). These are false positives — no executable malware exists. This is standard for all cybersecurity toolkits (SecLists, PayloadsAllTheThings, Metasploit face the same detections). See SECURITY.md for details.

Claude Code CyberSecurity Skill Collection

22 production-quality Claude Code Skills for cybersecurity professionals — covering offensive security, defensive operations, reverse engineering, threat hunting, threat intelligence, purple team / adversary emulation, CSOC automation, AI/LLM security, mobile, OT/ICS, GRC, software supply chain security, and more. Version 3.1 — expanded coverage, sharper methodology, and stronger automation.

Transform Claude Code into your ultimate cybersecurity co-pilot. Each skill provides Claude with structured methodology, decision frameworks, ready-to-run commands, and output templates that enable precise, expert-level assistance for real-world security operations.

---

What Are Claude Code Skills?

Claude Code Skills are structured SKILL.md files that you install into your ~/.claude/skills/ directory (global) or .claude/skills/ (project-specific). When Claude reads these files, it gains deep, domain-specific expertise that goes far beyond generic knowledge.

How Skills Work

Skills are instruction documents Claude reads at conversation start. Each SKILL.md contains:

1. YAML frontmatter — name, description, tags for skill identification
2. Activation triggers — Explicit list of prompts that should invoke this skill
3. Methodology — Step-by-step procedures Claude follows natively
4. Output templates — Exact formats for reports, rules, and artifacts Claude produces
5. Script references — When and how to use the included Python automation scripts
6. Authorization gates — Built-in prompts for offensive skills to confirm legal scope

Claude Code-Native Design

These skills are built around what Claude does natively in Claude Code:

• Read configuration files, code, and logs directly — no copy-paste needed
• Bash tool to run scripts, network commands, and system queries
• Analysis of disassembly, PCAP data, log events, and code with full context
• Generation of detection rules, hardening scripts, reports, and payloads
• WebSearch for CVE lookups, threat intelligence, and vulnerability research

---

Update proof of works

Update testing

Skill Collection