The Largest Agent Security Library Wasn't Built by Anthropic

Namesake vs. Maker

In February 2026, Anthropic launched Claude Code Security, a research preview that scans codebases for subtle vulnerabilities and suggests patches for human review. The company stress-tested the system through Capture-the-Flag competitions and a partnership with Pacific Northwest National Laboratory, using Claude Opus 4.6 to uncover more than 500 bugs in production open-source code. It is a serious, well-funded push into autonomous security review. Around the same time, a community repository called Anthropic Cybersecurity Skills began drawing serious attention on GitHub. The project, maintained by Mahipal Jangra and explicitly unaffiliated with Anthropic PBC, has been indexed at up to 817 structured skills across 29 security domains, with third-party trackers recording roughly 28,500 stars and 3,400 forks. The project’s own documentation currently lists 754 production-grade skills across 26 domains, reflecting rapid post-release growth. The naming collision is awkward but revealing: the repository is designed for the Anthropic agent ecosystem—Claude Code, primarily—yet it is entirely third-party. That tension between official frontier labs and grassroots context engineering is becoming a defining feature of the agentic security landscape.

Skills Are Not Scripts

What makes the repository genuinely interesting is not its size alone, but its format. Most open-source security collections offer wordlists, payloads, or exploit code. This library offers structured operational knowledge encoded for consumption by large language models. Each entry follows the agentskills.io standard and lives in its own directory containing a skill definition file, reference documents, helper scripts, and report templates. The skill file itself is split between YAML frontmatter and a Markdown body. The frontmatter carries name, description, domain, subdomain, tags, and framework identifiers; the body includes trigger conditions, prerequisites, a step-by-step workflow, and verification checks.

The distinction matters because existing security repositories typically optimize for human consumption: a README explains a tool, a script automates a task, and a wiki documents a procedure. This library optimizes for agent consumption. The frontmatter is keyword-rich so an agent can match a user prompt to the correct skill via semantic similarity rather than exact string matching. The workflow section is written in imperative prose structured as a sequence of decisions, not a narrative. Even the verification section serves a mechanical purpose, giving the agent explicit criteria to check before declaring a task complete.

The design treats a skill as a modular context unit rather than a script. As one developer noted while adapting the same concept to GitHub Copilot, these specialized Markdown instruction sets function as expert personas that automatically load when a user request aligns with the skill, reducing the context the AI must process and lowering hallucination risk. The project’s homepage notes that each skill costs roughly 40 tokens to scan and up to 2,000 to fully load, letting an agent survey hundreds of skills without exhausting its context window. The result is not a tutorial for humans, but a decision tree for machines: when to activate a skill, what prerequisites to verify, how to execute step-by-step, and how to confirm success.

Five Frameworks, One Context Window

The library’s metadata layer is where the tedious work lives—and where its real utility hides. The core library maps skills to five industry frameworks: MITRE ATT&CK v19.1 for adversary behaviors, NIST CSF 2.0 for organizational security posture, MITRE ATLAS for AI/ML adversarial threats, MITRE D3FEND for defensive countermeasures, and NIST AI RMF for AI risk management. Some third-party indexes also track a sixth, MITRE F3. The mapping is contextual, not universal; a forensics skill might tag ATT&CK and NIST CSF, while an AI-security skill adds ATLAS and AI RMF. The repository claims to be the only open-source skills library with unified cross-framework coverage of this breadth.

The ATT&CK mapping alone covers 286 distinct techniques across all 15 Enterprise tactics, plus ICS and Mobile techniques where relevant, reflecting v19.1’s recent restructuring of Defense Evasion into separate Stealth and Defense Impairment tactics. NIST CSF 2.0 alignment spans all six functions, including the newly added Govern function, referencing 106 subcategories. ATLAS v5.4 covers 16 tactics and 84 techniques, including agentic AI attack vectors such as MCP server compromises and malicious agent deployment added in late 2025. D3FEND contributes a knowledge graph of 267 defensive techniques organized across seven tactical categories, bidirectionally mapped to ATT&CK through a shared Digital Artifact layer built on OWL 2 ontology. NIST AI RMF 1.0, paired with the GenAI Profile, defines 72 subcategories for trustworthy AI development.

For an agent, this means a single user prompt like “analyze this memory dump for credential theft” can trigger a structured workflow that references Volatility3 plugins, LSASS access patterns, and Windows event logs, while simultaneously mapping findings to ATT&CK technique T1003 and NIST CSF categories. The agent is not guessing at tool commands; it is following a practitioner playbook that has been pre-aligned to compliance and threat-intelligence taxonomies. That alignment turns raw LLM output into auditable, framework-aware reasoning. The inclusion of NIST AI RMF is particularly timely: Colorado’s AI Act, effective February 2026, offers a legal safe harbor for organizations complying with that framework, making these mappings directly relevant to regulatory compliance.

The Workforce Gap and the Agentic Promise

The project arrives at a moment when the cybersecurity industry faces an estimated 4.8 million unfilled roles globally. Agentic AI is increasingly framed as a force multiplier that can close this gap by automating sophisticated threat detection, analysis, and response. Unlike traditional AI systems that rely on historical data and pattern matching within predefined parameters, agentic systems operate autonomously: planning modules decompose objectives, memory retains past encounters, tool-use capabilities interact with external systems, and reflection loops refine strategies without explicit human programming for every contingency.

In practice, this means an agent could independently investigate a suspicious file’s origin, contain its spread, and remediate affected systems. Eye Security observes that AI agents amplify speed and scale on both offense and defense, though they do not invent new attack techniques; they simply execute known playbooks faster. The skills library feeds directly into this architecture by supplying the structured domain knowledge that generic agents lack. Coverage spans domains from cloud security and threat hunting to digital forensics, malware analysis, OT/ICS security, and container hardening.

When an analyst asks an agent to analyze a memory dump for credential theft, the agent does not need to recall every Volatility3 plugin from its training data. Instead, it scans the frontmatter of all 754 skills, identifies the subset tagged for memory forensics and credential access, loads the top matches, and executes the structured workflow: run specific plugins, check for LSASS access patterns, correlate with event logs, and map the results to ATT&CK T1003. This is the difference between a language model improvising and an agent following a playbook. Without such playbooks, an agent might write code or search the web; with them, it can theoretically follow the same decision tree a senior analyst would use during a breach investigation.

Dual-Use and the Trust Problem

The repository is not without friction. It includes offensive and dual-use techniques—red-team command-and-control setups, phishing simulation, exploitation workflows—explicitly tagged for authorized penetration testing and research only. That designation is necessary, but it highlights a broader unresolved question: as state-aligned groups are already reported to be experimenting with fully agent-driven attack chains, a public library of agent-optimized offensive skills becomes a readily available force multiplier for both sides.

Defensively, the library inherits the trust boundaries of the agents it runs on. Anthropic’s own Claude Code Security Review GitHub Action, an official tool with 5.9k stars, carries a blunt warning that it is not hardened against prompt injection and should only review trusted pull requests. If Anthropic’s own security tooling admits that limitation, a community skills library inherits the same vulnerability surface. The agent’s ability to follow a verification section or resist a maliciously crafted input is only as strong as the model reading the skill. An automated scan of the repository reported no issues, though the hosting directory notes this does not constitute a full security certification.

Where This Goes Next

The project is positioning itself as infrastructure rather than content. The maintainers are running a global academic study, GARS-2026, supervised by SRH Berlin, to measure how ready security professionals and enterprise teams actually are for agentic AI workflows. Participants receive early access tokens for Casky.ai, a playground offering live skill exercises against real targets without local setup. Meanwhile, the agentskills.io standard is spreading: developers have already replicated the Claude Skills pattern inside GitHub Copilot using custom instruction files, suggesting the concept of modular security context will outlive any single platform.

The library itself continues to grow since its v1.0.0 release on March 11, 2026, with framework mappings expanding and MITRE ATT&CK v19’s split of Defense Evasion into Stealth and Defense Impairment awaiting full integration. The open question is whether these skills will mature into a trusted, verified knowledge graph or remain a high-quality but unvetted collection of prompts—useful, impressive in scope, and ultimately dependent on the judgment of the agent holding them.