754 Playbooks to Stop Your AI Agent from Guessing

What it does

This repo contains 754 structured cybersecurity skills for AI agents, spanning 26 domains from cloud forensics to OT/ICS security. Each skill is a Markdown file with YAML frontmatter for fast discovery and detailed workflow sections for step-by-step execution. The idea is to give agents the judgment of a senior analyst—when to run Volatility3, how to verify credential-theft artifacts—instead of letting them guess at commands.

The interesting bit

The architecture uses progressive disclosure: an agent scans all 754 frontmatters in one pass (~30 tokens each) to pick candidates, then loads only the full workflows it needs (500–2,000 tokens). Every skill is simultaneously mapped to MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, and NIST AI RMF, so one skill can cover adversary behavior, defensive countermeasures, and compliance posture at once.

Key highlights

• 754 skills across 26 domains, including threat hunting, malware analysis, digital forensics, and container security
• Standardized YAML frontmatter with cross-framework tags (ATT&CK technique IDs, NIST categories, ATLAS references)
• Built for the agentskills.io open standard; works with Claude Code, Copilot, Codex CLI, Cursor, Gemini CLI, and similar platforms
• Each skill defines trigger conditions, prerequisites, execution workflows, and verification steps—not just command references
• Apache 2.0 licensed and explicitly community-run; not an official Anthropic project despite the name

Caveats

• The per-domain breakdown in the README totals 713 skills, leaving a 41-skill gap unexplained
• Framework and version claims differ between the repository description and the README (e.g., MITRE ATT&CK v18 versus v19.1, five frameworks listed versus six)
• Coverage is uneven: Deception Technology has only 2 skills, and Compliance & Governance has 5, so some domains are closer to stubs than playbooks

Verdict

Security teams and agent builders who need structured, framework-mapped reasoning for incident response or threat hunting should grab this. If you want exploit payloads or copy-paste one-liners, this is the wrong repo—these are decision trees, not shell scripts.