reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/Anthropic-Cybersecurity-Skills/.github/FUNDING.yml

@@ -0,0 +1,2 @@
+github: mukul975
+custom: ["https://paypal.me/mahipaljangra"]

vendor-new/Anthropic-Cybersecurity-Skills/.github/ISSUE_TEMPLATE/bug-report.yml

@@ -0,0 +1,50 @@
+name: Bug Report
+description: Report a SKILL.md validation error, broken script, or incorrect content
+title: "[Bug]: "
+labels: ["bug", "needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to report a bug!
+  - type: input
+    id: skill-name
+    attributes:
+      label: Skill Name
+      description: Which skill has the issue?
+      placeholder: e.g., analyzing-disk-image-with-autopsy
+    validations:
+      required: true
+  - type: dropdown
+    id: bug-type
+    attributes:
+      label: Bug Type
+      options:
+        - SKILL.md validation error
+        - Broken/incorrect script
+        - Wrong instructions or commands
+        - Missing required files
+        - Incorrect metadata/frontmatter
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: What is the issue?
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected Behavior
+      description: What should happen instead?
+    validations:
+      required: true
+  - type: input
+    id: ai-agent
+    attributes:
+      label: AI Agent Used
+      description: Which AI agent were you using?
+      placeholder: e.g., Claude Code, GitHub Copilot, Codex CLI

vendor-new/Anthropic-Cybersecurity-Skills/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security Vulnerability
+    url: https://github.com/mukul975/Anthropic-Cybersecurity-Skills/security/advisories/new
+    about: Report a security vulnerability in this repository
+  - name: Discussion
+    url: https://github.com/mukul975/Anthropic-Cybersecurity-Skills/discussions
+    about: Ask questions or discuss ideas

vendor-new/Anthropic-Cybersecurity-Skills/.github/ISSUE_TEMPLATE/improve-skill.md

@@ -0,0 +1,19 @@
+---
+name: Improve existing skill
+about: Suggest improvements to an existing skill
+title: '[IMPROVE] skill-name-here'
+labels: 'enhancement'
+assignees: ''
+---
+
+## Skill to improve
+<!-- Folder name of the skill -->
+
+## What needs improvement?
+- [ ] agent.py has errors or placeholders
+- [ ] api-reference.md is incomplete
+- [ ] SKILL.md frontmatter is missing fields
+- [ ] ATT&CK mapping is incorrect
+- [ ] Other:
+
+## Suggested improvement

vendor-new/Anthropic-Cybersecurity-Skills/.github/ISSUE_TEMPLATE/new-skill-request.yml

@@ -0,0 +1,58 @@
+name: New Skill Request
+description: Request a new cybersecurity skill to be added to the database
+title: "[Skill Request]: "
+labels: ["enhancement", "new-skill", "help wanted"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Request a new cybersecurity skill. The more detail you provide, the faster we can add it!
+  - type: input
+    id: skill-name
+    attributes:
+      label: Proposed Skill Name
+      description: Kebab-case gerund form (e.g., analyzing-memory-dump-with-volatility)
+      placeholder: performing-task-name
+    validations:
+      required: true
+  - type: dropdown
+    id: category
+    attributes:
+      label: Category
+      options:
+        - Threat Detection
+        - Incident Response
+        - Penetration Testing
+        - Digital Forensics
+        - Compliance & Governance
+        - Network Security
+        - Cloud Security
+        - Application Security
+        - Malware Analysis
+        - OSINT
+        - Zero Trust Architecture
+        - OT/ICS Security
+        - DevSecOps
+        - Ransomware Defense
+        - Threat Intelligence
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: description
+    attributes:
+      label: Skill Description
+      description: What should this skill teach an AI agent to do?
+    validations:
+      required: true
+  - type: input
+    id: mitre-attack
+    attributes:
+      label: MITRE ATT&CK Technique(s)
+      description: Optional - relevant technique IDs
+      placeholder: e.g., T1059, T1078
+  - type: textarea
+    id: tools
+    attributes:
+      label: Key Tools
+      description: What tools/commands should this skill cover?

vendor-new/Anthropic-Cybersecurity-Skills/.github/ISSUE_TEMPLATE/new-skill.md

@@ -0,0 +1,25 @@
+---
+name: Add new skill
+about: Propose a new cybersecurity skill for the database
+title: '[NEW SKILL] skill-name-here'
+labels: 'new-skill, good first issue'
+assignees: ''
+---
+
+## Skill name (kebab-case)
+<!-- e.g., detecting-lateral-movement-in-azure -->
+
+## Domain / Subdomain
+<!-- e.g., cybersecurity / threat-hunting -->
+
+## Description
+<!-- One sentence describing what this skill does -->
+
+## MITRE ATT&CK techniques
+<!-- e.g., T1021.001, T1078.004 -->
+
+## NIST CSF function
+<!-- Identify, Protect, Detect, Respond, or Recover -->
+
+## Why is this skill needed?
+<!-- What problem does it solve for security practitioners? -->

vendor-new/Anthropic-Cybersecurity-Skills/.github/ISSUE_TEMPLATE/skill-improvement.yml

@@ -0,0 +1,41 @@
+name: Skill Improvement
+description: Suggest improvements to an existing skill
+title: "[Improvement]: "
+labels: ["enhancement", "skill-improvement"]
+body:
+  - type: input
+    id: skill-name
+    attributes:
+      label: Skill Name
+      placeholder: e.g., analyzing-network-traffic-with-wireshark
+    validations:
+      required: true
+  - type: dropdown
+    id: improvement-type
+    attributes:
+      label: Type of Improvement
+      options:
+        - More accurate/updated instructions
+        - Better workflow steps
+        - Add missing tools or commands
+        - Improve description for agent discovery
+        - Add MITRE ATT&CK mapping
+        - Add NIST CSF alignment
+        - Improve scripts/assets
+        - Fix outdated content
+    validations:
+      required: true
+  - type: textarea
+    id: current-issue
+    attributes:
+      label: Current Issue
+      description: What is wrong or missing?
+    validations:
+      required: true
+  - type: textarea
+    id: suggested-improvement
+    attributes:
+      label: Suggested Improvement
+      description: What should be changed or added?
+    validations:
+      required: true

vendor-new/Anthropic-Cybersecurity-Skills/.github/copilot-instructions.md

@@ -0,0 +1,546 @@
+# Copilot Instructions for Anthropic-Cybersecurity-Skills
+
+**Anthropic-Cybersecurity-Skills** is the largest open-source cybersecurity skills library for AI agents, containing 817 production-grade skills mapped to 6 industry frameworks (MITRE ATT&CK, NIST CSF, MITRE ATLAS, MITRE D3FEND, NIST AI RMF, MITRE F3). This document guides Copilot agents contributing new skills and framework mappings.
+
+## Quick Facts
+
+- **Type**: Open-source cybersecurity skills library + framework mapping hub
+- **Skills**: 817 across 29 security domains
+- **Frameworks**: 6 (MITRE ATT&CK v14, NIST CSF 2.0, MITRE ATLAS, MITRE D3FEND, NIST AI RMF, MITRE F3)
+- **Format**: agentskills.io standard (YAML frontmatter + Markdown)
+- **License**: Apache 2.0 (ethical use required)
+- **Community**: Independent, community-created (not affiliated with Anthropic)
+
+## Repository Structure
+
+```
+Anthropic-Cybersecurity-Skills/
+├── skills/                    # 817 skill directories (kebab-case)
+│   ├── abusing-dpapi-for-credential-access/
+│   │   ├── SKILL.md          # Frontmatter + detailed instructions
+│   │   ├── LICENSE
+│   │   ├── scripts/
+│   │   │   └── process.py    # Optional helper scripts
+│   │   └── references/
+│   │       ├── api-reference.md
+│   │       ├── standards.md
+│   │       └── workflows.md
+│   └── ... (816 more)
+├── mappings/                  # Framework coverage & alignment
+│   ├── mitre-attack/
+│   │   ├── attack-navigator-layer.json
+│   │   └── coverage-summary.md
+│   ├── nist-csf/
+│   ├── owasp/
+│   └── README.md
+├── docs/                      # Additional documentation
+├── index.json                 # Central skill registry (auto-generated)
+├── CONTRIBUTING.md            # Contribution guide
+├── SECURITY.md               # Ethical use & dual-use policies
+└── CODE_OF_CONDUCT.md        # Community guidelines
+```
+
+## Build & Development
+
+### Prerequisites
+
+- **Git** (for cloning and version control)
+- **Python 3.8+** (optional, for scripts/metadata generation)
+- **jq** (optional, for JSON processing; useful for index.json queries)
+
+### Local Setup
+
+```bash
+# Clone the repository
+git clone https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
+cd Anthropic-Cybersecurity-Skills
+
+# No installation needed—skills are static Markdown files
+# View a skill directly:
+cat skills/abusing-dpapi-for-credential-access/SKILL.md
+
+# Search for skills by keyword:
+grep -r "credential-access" skills/*/SKILL.md | head -10
+
+# Query the central index:
+jq '.skills[] | select(.description | contains("Active Directory"))' index.json
+```
+
+### Generating/Updating index.json
+
+When adding new skills, the index must be regenerated:
+
+```bash
+# If a script exists (check repository):
+python3 generate_index.py
+
+# Otherwise, manually verify:
+jq '.skills | length' index.json  # Should match skill directory count
+```
+
+## Architecture & Concepts
+
+### Skill Structure
+
+Each skill is a **self-contained directory** following the `agentskills.io` standard:
+
+```
+skills/skill-name/
+├── SKILL.md              # The authoritative skill definition
+├── LICENSE               # Apache 2.0 (usually)
+├── scripts/
+│   └── process.py        # Optional: helper scripts, agent implementations
+└── references/
+    ├── api-reference.md  # Technical API docs for the skill
+    ├── standards.md      # CVE, NIST, MITRE refs
+    └── workflows.md      # Deep technical procedures
+```
+
+### SKILL.md Format
+
+Every skill follows this structure:
+
+```markdown
+---
+name: skill-name-kebab-case
+description: >-
+  Clear, agent-discoverable description.
+  Include keywords for search/filtering.
+  This is what agents read to decide whether to use this skill.
+domain: cybersecurity
+subdomain: red-teaming  # e.g. digital-forensics, compliance-governance, etc.
+tags:
+  - tool-names (mimikatz, burp-suite, etc.)
+  - frameworks (active-directory, cloud, kubernetes, etc.)
+  - techniques (credential-access, privilege-escalation, etc.)
+version: "1.0"
+author: github-username
+license: Apache-2.0
+nist_csf:
+  - DE.CM-01
+  - PR.AC-01
+mitre_attack:
+  - T1555.004
+  - T1078.002
+mitre_atlas:
+  - AML.P1.003
+mitre_d3fend:
+  - D3-CAA
+  - D3-PCA
+nist_ai_rmf:
+  - GOV-1
+mitre_f3:
+  - FI-B-003
+---
+
+# Skill Title
+
+> **Legal Notice:** This skill is for authorized [penetration testing/research/defense] only.
+> Unauthorized use may violate computer fraud laws. Always operate within rules-of-engagement.
+
+## Overview
+
+Clear, concise explanation of what the skill does and why an agent needs it.
+Include threat model context if applicable.
+
+## When to Use
+
+- Specific scenario 1
+- Specific scenario 2
+- Real-world contexts where this skill applies
+
+## Prerequisites
+
+- Required tools (with install commands if applicable)
+- Required access/permissions
+- Required knowledge/certifications
+- System requirements
+
+## Workflow
+
+### Step 1: [Action]
+Clear instructions with real commands.
+```bash
+tool-name --flag value
+```
+
+### Step 2: [Next Action]
+Continue with detailed steps.
+
+### Output Format
+
+What success looks like:
+```
+Expected output or indicator
+```
+
+## Key Concepts
+
+| Term | Definition |
+|------|-----------|
+| Concept1 | Explanation |
+| Concept2 | Explanation |
+
+## Tools & Systems
+
+- **Tool A** — What it does, where to get it
+- **Tool B** — What it does, where to get it
+
+## Common Scenarios
+
+### Scenario 1
+When X, do Y.
+
+### Scenario 2
+When A, do B.
+
+## References
+
+- [MITRE ATT&CK: T1555.004](https://attack.mitre.org/techniques/T1555/004/)
+- [NIST CSF: DE.CM-01](https://csrc.nist.gov/)
+```
+
+### Framework Mappings
+
+Each skill can map to multiple frameworks. Key mappings:
+
+| Framework | Scope | Example |
+|-----------|-------|---------|
+| **MITRE ATT&CK** | Adversarial tactics/techniques | T1555.004 (Credentials from Password Stores) |
+| **NIST CSF 2.0** | Cybersecurity functions & categories | DE.CM (Detect - Monitor) |
+| **MITRE ATLAS** | AI/ML system attacks | AML.P (AI Preparation) |
+| **MITRE D3FEND** | Defensive techniques | D3-CAA (Capture Analysis Analytics) |
+| **NIST AI RMF** | AI risk management | GOV (Governance) |
+| **MITRE F3** | Fraud-specific techniques | FI-B (Fraud Impact) |
+
+### Subdomains (Choose One)
+
+- **web-application-security** — OWASP, API, web app testing
+- **network-security** — Network tools, protocols, monitoring
+- **penetration-testing** — General penetration testing methodology
+- **red-teaming** — Simulating advanced attackers (C2, evasion, etc.)
+- **digital-forensics** — Incident response, forensic analysis, disk imaging
+- **malware-analysis** — Static/dynamic malware analysis, reverse engineering
+- **threat-intelligence** — Gathering, analyzing, sharing threat data
+- **cloud-security** — AWS/Azure/GCP-specific security
+- **container-security** — Docker, Kubernetes, container runtime
+- **identity-access-management** — Active Directory, IAM, authentication
+- **cryptography** — Encryption, hashing, key management
+- **vulnerability-management** — Scanning, assessment, remediation
+- **compliance-governance** — CMMC, HIPAA, SOC2, auditing
+- **zero-trust-architecture** — Zero-trust implementation patterns
+- **ot-ics-security** — Operational technology, ICS/SCADA
+- **devsecops** — Secure software development, CI/CD security
+
+## Conventions & Patterns
+
+### Naming
+
+- **Directory/file**: kebab-case, lowercase with hyphens (e.g., `abusing-dpapi-for-credential-access`)
+- **Skill name**: Same as directory (in YAML frontmatter)
+- **GitHub usernames**: Use lowercase GitHub username as author
+
+### Description Quality
+
+Descriptions should be **agent-discoverable** — concise, keyword-rich, action-oriented:
+
+```yaml
+# ✗ Vague
+description: How to abuse DPAPI
+
+# ✓ Clear and searchable
+description: >-
+  Extract DPAPI-protected secrets such as credentials and browser data
+  offline and online using SharpDPAPI, Mimikatz, or impacket. Ideal
+  for post-exploitation Windows credential harvesting and offline analysis.
+```
+
+### Tags Strategy
+
+Use 3-5 tags for discoverability:
+
+```yaml
+tags:
+  - tool-names           # mimikatz, sharpdpapi, burp-suite
+  - attack-frameworks    # active-directory, kerberos, oauth
+  - techniques           # credential-access, privilege-escalation, lateral-movement
+  - platforms            # windows, linux, macos, cloud
+  - use-cases            # post-exploitation, threat-intel, forensics
+```
+
+### Framework ID Format
+
+IDs are **case-sensitive** and **exact**:
+
+```yaml
+mitre_attack:
+  - T1055                   # Parent technique
+  - T1055.001               # Sub-technique
+nist_csf:
+  - DE.CM-01                # NIST Cybersecurity Framework 2.0
+mitre_atlas:
+  - AML.P1.003              # MITRE ATLAS for AI/ML
+mitre_d3fend:
+  - D3-CAA                  # MITRE D3FEND defensive technique ID
+nist_ai_rmf:
+  - GOV-1                   # NIST AI Risk Management Framework
+mitre_f3:
+  - FI-B-003                # MITRE Fight Fraud Framework
+```
+
+## Common Tasks
+
+### Adding a New Skill
+
+1. **Create skill directory** (kebab-case):
+   ```bash
+   mkdir -p skills/your-skill-name
+   ```
+
+2. **Create SKILL.md** with required frontmatter:
+   ```bash
+   cat > skills/your-skill-name/SKILL.md << 'EOF'
+   ---
+   name: your-skill-name
+   description: >-
+     Clear, discoverable description with keywords.
+   domain: cybersecurity
+   subdomain: red-teaming
+   tags:
+     - tool-name
+     - technique
+     - use-case
+   version: "1.0"
+   author: your-github-username
+   license: Apache-2.0
+   mitre_attack:
+     - T1234.567
+   nist_csf:
+     - DE.CM-01
+   mitre_atlas:
+     - AML.P1.003
+   mitre_d3fend:
+     - D3-CAA
+   nist_ai_rmf:
+     - GOV-1
+   mitre_f3:
+     - FI-B-003
+   ---
+   
+   # Skill Title
+   
+   > **Legal Notice:** Authorized use only. [...]
+   
+   ## Overview
+   
+   Clear explanation...
+   EOF
+   ```
+
+3. **Write detailed sections** in Markdown:
+   - When to Use (specific scenarios)
+   - Prerequisites (tools, permissions, access)
+   - Workflow (numbered steps with real commands)
+   - Key Concepts (table for terminology)
+   - Tools & Systems
+   - Common Scenarios
+   - References (framework links)
+
+4. **Add optional supporting files**:
+   ```
+   scripts/process.py         # Helper script or agent implementation
+   references/standards.md    # CVE, NIST, MITRE links
+   references/workflows.md    # Deep technical procedures
+   ```
+
+5. **Add LICENSE**:
+   ```bash
+   cp LICENSE skills/your-skill-name/LICENSE
+   # Or use a specific open-source license file
+   ```
+
+6. **Regenerate index** (if automation exists):
+   ```bash
+   python3 generate_index.py  # Updates index.json
+   ```
+
+7. **Submit PR**:
+   ```bash
+   git add skills/your-skill-name
+   git commit -m "Add skill: your-skill-name"
+   git push origin feature/add-skill-name
+   # Create PR with title: "Add skill: your-skill-name"
+   ```
+
+### Updating Framework Mappings
+
+If a skill maps to new frameworks or techniques change:
+
+1. **Update SKILL.md frontmatter**:
+   ```yaml
+   mitre_attack:
+     - T1555.004      # Add new technique IDs
+   nist_csf:
+     - DE.CM-01       # Add new control IDs
+   ```
+
+2. **Regenerate index** (if automation exists):
+   ```bash
+   python3 generate_index.py
+   ```
+
+3. **Verify mapping coverage**:
+   ```bash
+   # Check if all referenced IDs are valid:
+   grep -r "T1[0-9]" skills/*/SKILL.md | grep -v "http"
+   ```
+
+### Searching Skills
+
+**By keyword**:
+```bash
+grep -r "active-directory" skills/*/SKILL.md
+```
+
+**By framework**:
+```bash
+grep -r "T1055" skills/*/SKILL.md  # MITRE ATT&CK technique
+```
+
+**By subdomain**:
+```bash
+grep "subdomain: red-teaming" skills/*/SKILL.md
+```
+
+**Using jq (if index.json exists)**:
+```bash
+# Find skills by keyword
+jq '.skills[] | select(.tags[] | contains("credential-access"))' index.json
+
+# Count skills by subdomain
+jq '[.skills[] | .subdomain] | group_by(.) | map({subdomain: .[0], count: length})' index.json
+```
+
+## Platform & Framework Notes
+
+### Windows-Specific Skills
+
+- Often leverage PowerShell, Windows APIs, Active Directory
+- Reference MITRE ATT&CK Windows tactics: T1021 (Lateral Movement), T1078 (Valid Accounts)
+- Include prerequisite (SYSTEM/Administrator access, domain join, etc.)
+
+### Linux/macOS Skills
+
+- Use standard Unix tools (bash, Python, curl, etc.)
+- Note platform availability differences
+- Cloud/container skills often multi-platform
+
+### Cloud Security Skills
+
+- Specify cloud provider (AWS, Azure, GCP, multi-cloud)
+- Reference cloud-specific tools (awscli, az, gcloud)
+- Map to cloud-specific MITRE ATLAS techniques
+
+### AI/ML Attack Skills
+
+- Use MITRE ATLAS techniques (AML.P1, AML.E1, etc.)
+- Include model/system type (LLM, transformer, computer vision, etc.)
+- Note NIST AI RMF alignment (GOV, MAP, MEASURE, MANAGE)
+
+## Gotchas & Known Issues
+
+### Legal & Ethical
+
+- **Dual-use policy**: Skills for red-teaming and exploitation require legal notice
+  - Must include "authorized use only" disclaimer
+  - Reference SECURITY.md for policy
+- **No credentials**: Never embed API keys, tokens, or credentials
+- **Attribution**: Cite original tool authors and researchers
+
+### Framework Maintenance
+
+- **MITRE ATT&CK updates**: v14 is current; check attack.mitre.org for latest
+- **NIST CSF 2.0**: Rolled out Feb 2024; use subcategory IDs as in this repo (e.g., `DE.CM-01`, `PR.PS-01`)
+- **Technique changes**: Techniques may deprecate; verify via attack.mitre.org
+
+### Subdomain Assignment
+
+- **Common mistake**: Using wrong subdomain (e.g., "red-teaming" for defensive skill)
+  - red-teaming = offensive/attacker perspective
+  - compliance-governance = defensive/compliance perspective
+  - Choose the **primary** subdomain if skill spans multiple
+
+### index.json Generation
+
+- If index doesn't auto-regenerate, manually verify:
+  ```bash
+  # Count skills in index vs directories
+  jq '.skills | length' index.json
+  ls -d skills/*/ | wc -l
+  # Should match (or index may be stale)
+  ```
+
+## Testing & Quality
+
+### Skill Quality Checklist
+
+Before submitting a PR:
+
+- [ ] **Name**: Kebab-case, 1-64 chars, descriptive
+- [ ] **Description**: Clear, includes keywords, discoverable by agents
+- [ ] **Instructions**: Actionable with real commands and tool names
+- [ ] **Subdomain**: Correctly assigned (red-teaming vs defensive)
+- [ ] **Tags**: 3-5 relevant tags (tools, techniques, platforms)
+- [ ] **Framework IDs**: Valid MITRE ATT&CK, NIST CSF, MITRE ATLAS IDs
+- [ ] **Legal notice**: Included if skill is offensive/dual-use
+- [ ] **References**: Links to official framework docs
+- [ ] **Formatting**: Proper Markdown, no typos, code blocks highlighted
+
+### Manual Verification
+
+```bash
+# Validate skill frontmatter and conventions (repo validator):
+python3 tools/validate-skill.py skills/my-skill/
+# Or validate all skills:
+python3 tools/validate-skill.py --all
+
+# Check for framework ID patterns:
+grep -E "^  - (T1[0-9]{3,4}(\.[0-9]{3})?|DE\.[A-Z]{2}-[0-9]{2}|AML\.)" skills/*/SKILL.md
+
+# Verify all referenced skills have directories:
+jq -r '.skills[].name' index.json | while read skill; do
+  [ -d "skills/$skill" ] || echo "Missing: $skill"
+done
+```
+
+## Contributing Notes
+
+- **No build required** — Skills are static files; git pull = ready to use
+- **Skill dependencies**: Skills are independent; if skill A requires skill B, note it in the workflow
+- **Tool versions**: Mention tool versions in prerequisites (e.g., "Burp Suite 2024.1+")
+- **Testing**: Test commands on actual systems before submitting
+- **Code of Conduct**: See CODE_OF_CONDUCT.md — be respectful, follow ethical use policy
+
+## Resources & Links
+
+- **agentskills.io Standard**: https://agentskills.io (format specification)
+- **MITRE ATT&CK**: https://attack.mitre.org (techniques, tactics)
+- **NIST Cybersecurity Framework**: https://csrc.nist.gov/projects/cybersecurity-framework (controls)
+- **MITRE ATLAS**: https://atlas.mitre.org (AI/ML attacks)
+- **MITRE D3FEND**: https://d3fend.mitre.org (defensive techniques)
+- **NIST AI RMF**: https://nvlabs.nist.gov/display/AIRFF (AI risk management)
+- **Contributing Guide**: `CONTRIBUTING.md` in repo
+- **Security Policy**: `SECURITY.md` — dual-use & ethical use
+- **Code of Conduct**: `CODE_OF_CONDUCT.md`
+- **Community Playground**: https://casky.ai (test skills in browser)
+
+## Quick Reference
+
+| Task | Command |
+|------|---------|
+| Add skill | `mkdir skills/name && cat > SKILL.md` |
+| Search by technique | `grep -r "T1055" skills/` |
+| Search by subdomain | `grep "subdomain: red-teaming" skills/*/SKILL.md` |
+| Validate skill | `python3 tools/validate-skill.py skills/my-skill/` |
+| Regenerate index | `python3 generate_index.py` (if exists) |
+| View mapping coverage | Open `mappings/mitre-attack/attack-navigator-layer.json` in ATT&CK Navigator |

vendor-new/Anthropic-Cybersecurity-Skills/.github/workflows/sync-marketplace-version.yml

@@ -0,0 +1,43 @@
+name: Sync Marketplace Version on Release
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  sync-version:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          ref: main
+          fetch-depth: 0
+
+      - name: Extract version from tag
+        id: version
+        run: |
+          VERSION=${GITHUB_REF_NAME#v}
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "tag=$GITHUB_REF_NAME" >> $GITHUB_OUTPUT
+
+      - name: Update marketplace.json and plugin.json version
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          jq --arg v "$VERSION" '.metadata.version = $v | .plugins[].version = $v' .claude-plugin/marketplace.json > tmp.json
+          mv tmp.json .claude-plugin/marketplace.json
+          jq --arg v "$VERSION" '.version = $v' .claude-plugin/plugin.json > tmp.json
+          mv tmp.json .claude-plugin/plugin.json
+          echo "Updated marketplace.json and plugin.json to version $VERSION"
+
+      - name: Commit and push
+        run: |
+          git config user.name "mukul975"
+          git config user.email "mukuljangra5@gmail.com"
+          git add .claude-plugin/marketplace.json .claude-plugin/plugin.json
+          git diff --staged --quiet || git commit -m "chore: bump plugin version to ${{ steps.version.outputs.tag }}"
+          git push origin HEAD:main

vendor-new/Anthropic-Cybersecurity-Skills/.github/workflows/update-contributors.yml

@@ -0,0 +1,44 @@
+name: Update contributors
+
+on:
+  push:
+    branches: [main]
+  schedule:
+    # GitHub's contributors API is cached and lags a merge by up to ~24h, so a
+    # weekly pass catches anyone the push-triggered run was too early to see.
+    - cron: '17 4 * * 1'
+  workflow_dispatch:
+
+# Only one run at a time; a burst of merges must not race on README.md.
+concurrency:
+  group: update-contributors
+  cancel-in-progress: false
+
+jobs:
+  update:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Regenerate the contributor wall
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: python3 tools/update-contributors.py
+
+      - name: Commit if it changed
+        run: |
+          git config user.name "mukul975"
+          git config user.email "mukuljangra5@gmail.com"
+          git add README.md
+          if git diff --staged --quiet; then
+            echo "No new contributors."
+            exit 0
+          fi
+          git commit -m "chore: update contributor wall"
+          # Another workflow (update-index) may have pushed while this ran.
+          git pull --rebase --autostash origin main
+          git push

vendor-new/Anthropic-Cybersecurity-Skills/.github/workflows/update-index.yml

@@ -0,0 +1,79 @@
+name: Update marketplace index
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'skills/**'
+      - '.github/workflows/update-index.yml'
+  workflow_dispatch:
+
+jobs:
+  update-index:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Install dependencies
+        run: pip install pyyaml
+
+      # Generation lives in tools/generate-index.py so it is testable outside CI
+      # and shares one PyYAML-backed frontmatter parser with the validators.
+      # The previous inline regex parser silently truncated 604/817 descriptions
+      # to their first line for every YAML scalar style except '>'/'|'.
+      - name: Regenerate index.json
+        run: python3 tools/generate-index.py
+
+      - name: Sync skill count into README and marketplace
+        run: |
+          python3 << 'EOF'
+          import os, re, json
+
+          # Authoritative count: directories under skills/ that contain a SKILL.md
+          # and are not .bak backups (matches index.json generation above).
+          count = 0
+          for name in os.listdir("skills"):
+              if name.endswith(".bak"):
+                  continue
+              if os.path.isfile(os.path.join("skills", name, "SKILL.md")):
+                  count += 1
+          print(f"Authoritative skill count: {count}")
+
+          # README.md — replace the skills badge and every "<NNN> ... skills" phrase.
+          with open("README.md", encoding="utf-8") as f:
+              readme = f.read()
+          readme = re.sub(r"(badge/skills-)\d+", rf"\g<1>{count}", readme)
+          # "817 production-grade", "817 structured", "817 skills", "all 817 skills",
+          # "Scans 817 skill", "contains **817 skills**", BibTeX "{817 structured"
+          readme = re.sub(r"\b\d+(?=\s+production-grade cybersecurity skills)", str(count), readme)
+          readme = re.sub(r"\b\d+(?=\s+structured cybersecurity skills)", str(count), readme)
+          readme = re.sub(r"(all\s+)\d+(?=\s+skills)", rf"\g<1>{count}", readme)
+          readme = re.sub(r"(Scans\s+)\d+(?=\s+skill\b)", rf"\g<1>{count}", readme)
+          readme = re.sub(r"(contains\s+\*\*)\d+(?=\s+skills\*\*)", rf"\g<1>{count}", readme)
+          readme = re.sub(r"(\{)\d+(?=\s+structured cybersecurity skills)", rf"\g<1>{count}", readme)
+          with open("README.md", "w", encoding="utf-8") as f:
+              f.write(readme)
+
+          # marketplace.json + plugin.json — patch "<NNN> cybersecurity skills" in descriptions.
+          for path in (".claude-plugin/marketplace.json", ".claude-plugin/plugin.json"):
+              with open(path, encoding="utf-8") as f:
+                  data = f.read()
+              data = re.sub(r"\b\d+(?=\s+cybersecurity skills)", str(count), data)
+              json.loads(data)  # fail loudly if the regex broke JSON
+              with open(path, "w", encoding="utf-8") as f:
+                  f.write(data)
+
+          print("Synced skill count into README.md, marketplace.json, plugin.json")
+          EOF
+
+      - name: Commit updated index and skill count
+        run: |
+          git config user.name "mukul975"
+          git config user.email "mukuljangra5@gmail.com"
+          git add index.json README.md .claude-plugin/marketplace.json .claude-plugin/plugin.json
+          git diff --staged --quiet || git commit -m "chore: auto-update index.json and skill count"
+          git push

vendor-new/Anthropic-Cybersecurity-Skills/.github/workflows/validate-skills.yml

@@ -0,0 +1,126 @@
+name: Validate SKILL.md files
+
+on:
+  push:
+    paths:
+      - 'skills/**'
+      - 'tools/**'
+      - '.github/workflows/validate-skills.yml'
+  pull_request:
+    paths:
+      - 'skills/**'
+      - 'tools/**'
+      - '.github/workflows/validate-skills.yml'
+  workflow_dispatch:
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    name: Validate SKILL.md frontmatter
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install dependencies
+        run: pip install pyyaml
+
+      # All frontmatter is parsed by tools/skill_frontmatter.py (PyYAML). Any
+      # reintroduced regex parser silently truncates multi-line descriptions --
+      # that bug shipped 604/817 broken descriptions before it was caught.
+      - name: Guard against hand-rolled YAML parsers
+        run: |
+          if grep -rnE '(re\.(search|match|compile)\([^)]*description|^\s*description:.*\(\.\*\))' \
+               tools/ --include='*.py' ; then
+            echo "::error::Regex-based frontmatter parsing detected. Use tools/skill_frontmatter.py."
+            exit 1
+          fi
+          echo "OK: no regex frontmatter parsers"
+
+      # Single source of truth: tools/validate-skill.py validates required
+      # frontmatter fields, kebab-case name, description length, subdomain, and
+      # tag count. (Previously this step duplicated a weaker inline parser.)
+      - name: Validate SKILL.md frontmatter
+        run: python3 tools/validate-skill.py --all
+
+      # agentskills.io conformance: name==directory, 1..1024 description,
+      # reserved-word ban, angle-bracket injection check.
+      - name: Validate agentskills.io conformance
+        run: python3 tools/validate-agentskills.py --strict
+
+      # index.json is generated; a PR that changes a description must regenerate it.
+      # Pull requests only: on a push to main, update-index.yml regenerates
+      # index.json in parallel with this job, so checking here would race and go
+      # red on every merge that adds a skill before self-healing seconds later.
+      - name: Check index.json is current
+        if: github.event_name == 'pull_request'
+        run: python3 tools/generate-index.py --check
+
+      # Description quality gate. Pre-existing failures are grandfathered in
+      # tools/lint-baseline.json so this blocks NEW debt only; the baseline is
+      # allowed to shrink and never to grow.
+      - name: Lint descriptions
+        run: python3 tools/lint-descriptions.py --all --stats
+
+      # Ratchet: the number of unreviewed near-duplicate description pairs may
+      # never increase. Lower this cap as disambiguation lands.
+      - name: Detect skill collisions
+        run: python3 tools/detect-collisions.py --max-unreviewed 55
+
+      - name: Check for duplicate skill names
+        run: |
+          python3 << 'EOF'
+          import os
+          import re
+          from collections import Counter
+
+          names = []
+          for root, dirs, files in os.walk('skills'):
+              for file in files:
+                  if file == 'SKILL.md':
+                      path = os.path.join(root, file)
+                      with open(path, 'r', encoding='utf-8') as f:
+                          content = f.read()
+                      fm_match = re.match(r'^---\n(.*?)\n---', content, re.DOTALL)
+                      if fm_match:
+                          name_match = re.search(r'^name:\s*(.+)$', fm_match.group(1), re.MULTILINE)
+                          if name_match:
+                              names.append(name_match.group(1).strip().strip('"'))
+
+          duplicates = [name for name, count in Counter(names).items() if count > 1]
+          if duplicates:
+              print(f"❌ Duplicate skill names found: {duplicates}")
+              exit(1)
+          print(f"✅ No duplicate names in {len(names)} skills")
+          EOF
+
+      - name: Report skill counts
+        if: always()
+        run: |
+          echo "## Skill Database Stats" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          python3 << 'EOF'
+          import os
+          import re
+          from collections import Counter
+
+          subdomain_counts = Counter()
+          total = 0
+          for root, dirs, files in os.walk('skills'):
+              for file in files:
+                  if file == 'SKILL.md':
+                      total += 1
+                      path = os.path.join(root, file)
+                      with open(path, 'r', encoding='utf-8') as f:
+                          content = f.read()
+                      fm_match = re.match(r'^---\n(.*?)\n---', content, re.DOTALL)
+                      if fm_match:
+                          sd_match = re.search(r'^subdomain:\s*(.+)$', fm_match.group(1), re.MULTILINE)
+                          if sd_match:
+                              subdomain_counts[sd_match.group(1).strip()] += 1
+
+          print(f"**Total Skills: {total}**")
+          print("")
+          print("| Subdomain | Count |")
+          print("|-----------|-------|")
+          for sd, count in sorted(subdomain_counts.items(), key=lambda x: -x[1]):
+              print(f"| {sd} | {count} |")
+          EOF