A comprehensive open-source library of 817 structured cybersecurity skills designed for AI agents and coding assistants. Skills span 29 security domains and are mapped to six major frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF, and MITRE F3. The library follows the agentskills.io standard and integrates with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI, and 20+ other platforms out of the box.
This is an open source library of structured cybersecurity skills written for AI agents and coding assistants rather than for people to read directly. The skills span a wide set of security domains and are mapped to established frameworks including MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF and MITRE F3, so an agent working a task can be pointed at the relevant technique or control rather than improvising from general knowledge. The library follows the agentskills.io format, which is what lets the same files load into Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI and other assistants without rewriting them per tool. Worth knowing before you adopt it: despite the name, the repository is published under an individual maintainer account rather than an Anthropic organization, so read it as a community compilation of framework mapped guidance and review the skills you intend to rely on.
This earns its place when you are doing security work with an agent and want its output anchored to a recognized framework instead of to whatever it remembers. Concretely: writing a threat model and needing ATT&CK technique references that actually exist, mapping controls to NIST CSF for an audit conversation, or reviewing an AI system where NIST AI RMF and ATLAS are the vocabulary the other side expects. It is also useful as a coverage checklist, since a library organized by domain makes gaps in your own review visible. It is not an assessment tool and it does not test anything. It supplies structured context. If you need a running agent that actively probes an application, that is a different category of tool, and the guidance here would be a complement rather than a substitute.
Strix is the active counterpart in this category, an agent that goes and exercises a target rather than a body of knowledge the agent consults. Pair them if you do offensive work: the skills supply the framework vocabulary, the agent does the probing. Find Skills solves the discovery problem rather than the content problem, helping you locate the right skill for a task across libraries like this one, which becomes worth having once you have installed several. Marketing Skills is the same packaging idea aimed at an unrelated domain, useful mainly as a sense of how portable the agentskills format is. Choose this library when the gap in your workflow is framework grounded security context, not tooling or search.
Compare with: Strix, Find Skills, Marketing Skills
The catalog records this as free. Skill libraries are plain files you copy into an agent's configuration, so there is nothing to buy and nothing to host. Your cost is context and tokens: loading a large library into every session consumes budget, so most people install the domains they use rather than everything available. Check the repository license before redistributing the files inside a commercial product, and review the content itself before leaning on it in client facing security work.
No notes have been added for this tool yet.
No prompting tips have been added yet.
No reviews yet. Be the first!