# External AI agent skills — director-of-compliance-and-information-security

Proven, publicly available AI agent skills mapped to this occupation.
Nothing is copied from the sources: every entry is a name, a one-line
summary and a link to the upstream skill package. Each section names
its source repository, commit, license and retrieval date.

**Tiers:** `core` = the skill directly exercises a top market hard
skill, tool or method (from gated job-ad evidence) or an essential
ESCO competence of this occupation; `adjacent` =
plausibly useful, secondary. Entries are capped at 12 per source
and 80 in total per occupation (core first,
strongest matches survive); everything beyond the caps is excluded
and logged in the pipeline audit trail, not in this package.

_Matched deterministically (ISCO group + title/competence keywords,
tiered against market evidence + ESCO essentials) by
`pipeline/p5_enrich_ai_skills.py` on 2026-07-14._

## Source: anthropics/skills

- Repository: [https://github.com/anthropics/skills](https://github.com/anthropics/skills) (commit `f6656c1`, retrieved 2026-07-14)
- License: Apache-2.0; the document skills (docx/pdf/pptx/xlsx) are source-available — see the LICENSE.txt in the upstream skill folder

| Skill | Tier | What it adds | Upstream |
|---|---|---|---|
| `docx` | adjacent | Use this skill whenever the user wants to create, read, edit, or manipulate Word documents (.docx files) or Word templates (.dotx files). Triggers include: any mention of 'Word doc', 'word document', '.docx', '.dotx', or requests to … | [source](https://github.com/anthropics/skills/tree/main/skills/docx) |
| `pdf` | adjacent | Use this skill whenever the user wants to do anything with PDF files. This includes reading or extracting text/tables from PDFs, combining or merging multiple PDFs into one, splitting PDFs apart, rotating pages, adding watermarks, creating … | [source](https://github.com/anthropics/skills/tree/main/skills/pdf) |
| `pptx` | adjacent | Use this skill any time a .pptx or .potx file is involved in any way — as input, output, or both. This includes: creating slide decks, pitch decks, or presentations; reading, parsing, or extracting text from any .pptx or .potx file (even … | [source](https://github.com/anthropics/skills/tree/main/skills/pptx) |
| `skill-creator` | adjacent | Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with … | [source](https://github.com/anthropics/skills/tree/main/skills/skill-creator) |

## Source: wshobson/agents

- Repository: [https://github.com/wshobson/agents](https://github.com/wshobson/agents) (commit `6fd3247`, retrieved 2026-07-14)
- License: MIT (c) Seth Hobson

| Skill | Tier | What it adds | Upstream |
|---|---|---|---|
| `security-compliance-security-auditor (agent)` | core | Expert security auditor specializing in DevSecOps, comprehensive cybersecurity, and compliance frameworks. Masters vulnerability assessment, threat modeling, secure authentication (OAuth2/OIDC), OWASP standards, cloud security, and … | [source](https://github.com/wshobson/agents/tree/main/plugins/security-compliance/agents/security-auditor.md) |
| `frontend-mobile-security-frontend-developer (agent)` | core | Build React components, implement responsive layouts, and handle client-side state management. Masters React 19, Next.js 15, and modern frontend architecture. Optimizes performance and ensures accessibility. Use PROACTIVELY when creating … | [source](https://github.com/wshobson/agents/tree/main/plugins/frontend-mobile-security/agents/frontend-developer.md) |
| `stride-analysis-patterns` | core | Apply STRIDE methodology to systematically identify threats. Use when analyzing system security, conducting threat modeling sessions, or creating security documentation. | [source](https://github.com/wshobson/agents/tree/main/plugins/security-scanning/skills/stride-analysis-patterns) |
| `threat-mitigation-mapping` | core | Map identified threats to appropriate security controls and mitigations. Use when prioritizing security investments, creating remediation plans, or validating control effectiveness. | [source](https://github.com/wshobson/agents/tree/main/plugins/security-scanning/skills/threat-mitigation-mapping) |
| `incident-runbook-templates` | core | Create structured incident response runbooks with step-by-step procedures, escalation paths, and recovery actions. Use this skill when building a service outage runbook for a payment processing system; creating database incident procedures … | [source](https://github.com/wshobson/agents/tree/main/plugins/incident-response/skills/incident-runbook-templates) |
| `anti-reversing-techniques` | core | Understand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use this skill when analyzing malware evasion techniques, when implementing anti-debugging protections for CTF challenges, when reverse … | [source](https://github.com/wshobson/agents/tree/main/plugins/reverse-engineering/skills/anti-reversing-techniques) |
| `postmortem-writing` | core | Write effective blameless postmortems with root cause analysis, timelines, and action items. Use when conducting incident reviews, writing postmortem documents, or improving incident response processes. | [source](https://github.com/wshobson/agents/tree/main/plugins/incident-response/skills/postmortem-writing) |
| `protocol-reverse-engineering` | core | Master network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation. Use when analyzing network traffic, understanding proprietary protocols, or debugging network communication. | [source](https://github.com/wshobson/agents/tree/main/plugins/reverse-engineering/skills/protocol-reverse-engineering) |
| `memory-forensics` | core | Master memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use when analyzing memory dumps, investigating incidents, or performing malware analysis from … | [source](https://github.com/wshobson/agents/tree/main/plugins/reverse-engineering/skills/memory-forensics) |
| `binary-analysis-patterns` | core | Master binary analysis patterns including disassembly, decompilation, control flow analysis, and code pattern recognition. Use when analyzing executables, understanding compiled code, or performing static analysis on binaries. | [source](https://github.com/wshobson/agents/tree/main/plugins/reverse-engineering/skills/binary-analysis-patterns) |
| `backend-api-security-backend-architect (agent)` | adjacent | Expert backend architect specializing in scalable API design, microservices architecture, and distributed systems. Masters REST/GraphQL/gRPC APIs, event-driven architectures, service mesh patterns, and modern backend frameworks. Handles … | [source](https://github.com/wshobson/agents/tree/main/plugins/backend-api-security/agents/backend-architect.md) |
| `sast-configuration` | adjacent | Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection. | [source](https://github.com/wshobson/agents/tree/main/plugins/security-scanning/skills/sast-configuration) |

## Source: ConardLi/garden-skills

- Repository: [https://github.com/ConardLi/garden-skills](https://github.com/ConardLi/garden-skills) (commit `fbd6453`, retrieved 2026-07-14)
- License: MIT

| Skill | Tier | What it adds | Upstream |
|---|---|---|---|
| `kb-retriever` | adjacent | 面向本地知识库目录的检索和问答助手。核心流程：(1)分层索引导航 (2)遇到PDF/Excel时必须先读取references学习处理方法 (3)处理文件后再检索。按文件类型组合使用 grep、Read、pdfplumber、pandas 进行渐进式检索，避免整文件加载。用户问题涉及"从知识库目录回答问题/检索信息/查资料"时使用。 | [source](https://github.com/ConardLi/garden-skills/tree/fbd6453/skills/kb-retriever) |

## Source: a5c-ai/babysitter

- Repository: [https://github.com/a5c-ai/babysitter](https://github.com/a5c-ai/babysitter) (commit `44a5d58b`, retrieved 2026-07-14)
- License: MIT

| Skill | Tier | What it adds | Upstream |
|---|---|---|---|
| `bug-bounty` | core | Bug bounty program management and security disclosure expertise for smart contracts. Covers program setup on Immunefi, vulnerability triage, responsible disclosure coordination, bounty payments, and post-disclosure analysis. | [source](https://github.com/a5c-ai/babysitter/tree/44a5d58b/library/specializations/cryptography-blockchain/skills/bug-bounty) |
| `security-sandbox` | core | Isolated analysis environment management for malware and exploit testing. Create and manage isolated VMs, configure Cuckoo Sandbox, set up REMnux/FlareVM environments, manage Docker-based analysis containers, and capture filesystem and … | [source](https://github.com/a5c-ai/babysitter/tree/44a5d58b/library/specializations/security-research/skills/security-sandbox) |
| `echidna-fuzzer` | core | Property-based testing and fuzzing using Echidna for smart contracts. Includes invariant definition, corpus management, coverage analysis, and CI/CD integration for comprehensive security testing. | [source](https://github.com/a5c-ai/babysitter/tree/44a5d58b/library/specializations/cryptography-blockchain/skills/echidna-fuzzer) |
| `gdpr-compliance-automator` | core | GDPR compliance assessment and automation for data mapping, consent management, DSAR handling, and privacy impact assessments | [source](https://github.com/a5c-ai/babysitter/tree/44a5d58b/library/specializations/security-compliance/skills/gdpr-compliance-automator) |
| `policy-management` | core | Manage corporate policy lifecycle from drafting through compliance | [source](https://github.com/a5c-ai/babysitter/tree/44a5d58b/library/specializations/domains/business/legal/skills/policy-management) |
| `cloud-security-testing` | core | Multi-cloud security assessment and penetration testing capabilities. Execute Prowler/ScoutSuite assessments, analyze IAM policies, identify cloud misconfigurations, test permissions, and enumerate cloud resources across AWS/GCP/Azure. | [source](https://github.com/a5c-ai/babysitter/tree/44a5d58b/library/specializations/security-research/skills/cloud-security-testing) |
| `openzeppelin` | core | Expert usage of OpenZeppelin Contracts library for secure smart contract development. Covers access control, token standards, governance, upgrades, and security utilities. | [source](https://github.com/a5c-ai/babysitter/tree/44a5d58b/library/specializations/cryptography-blockchain/skills/openzeppelin) |
| `regulatory-compliance-assessment` | core | Evaluate organizational compliance with healthcare regulations including HIPAA, CMS Conditions of Participation, and accreditation standards through gap analysis and audit procedures | [source](https://github.com/a5c-ai/babysitter/tree/44a5d58b/library/specializations/domains/social-sciences-humanities/healthcare/skills/regulatory-compliance-assessment) |
| `constitution-creation` | core | Establish project governing principles including dev guidelines, code quality standards, testing policies, UX requirements, performance benchmarks, and security constraints. | [source](https://github.com/a5c-ai/babysitter/tree/44a5d58b/library/methodologies/spec-kit/skills/constitution-creation) |
| `solidity-dev` | core | Deep expertise in Solidity language features, patterns, and best practices for secure smart contract development. Covers ERC standards, gas optimization, upgradeable contracts, and security patterns. | [source](https://github.com/a5c-ai/babysitter/tree/44a5d58b/library/specializations/cryptography-blockchain/skills/solidity-dev) |
| `Static Analysis Tools Skill` | core | Integration with security-focused static analysis tools | [source](https://github.com/a5c-ai/babysitter/tree/44a5d58b/library/specializations/security-research/skills/static-analysis-tools) |
| `code-review-patterns` | core | Multi-dimensional code assessment across security, quality, performance, and maintainability with confidence-gated reporting (>=80%) and Router Contract generation. | [source](https://github.com/a5c-ai/babysitter/tree/44a5d58b/library/methodologies/cc10x/skills/code-review-patterns) |

## Source: alirezarezvani/claude-code-skill-factory

- Repository: [https://github.com/alirezarezvani/claude-code-skill-factory](https://github.com/alirezarezvani/claude-code-skill-factory) (commit `ba18b31`, retrieved 2026-07-14)
- License: MIT

| Skill | Tier | What it adds | Upstream |
|---|---|---|---|
| `tech-stack-evaluator` | core | Comprehensive technology stack evaluation and comparison tool with TCO analysis, security assessment, and intelligent recommendations for engineering teams | [source](https://github.com/alirezarezvani/claude-code-skill-factory/tree/ba18b31/generated-skills/tech-stack-evaluator) |

## Source: alirezarezvani/claude-skills

- Repository: [https://github.com/alirezarezvani/claude-skills](https://github.com/alirezarezvani/claude-skills) (commit `0241f43`, retrieved 2026-07-14)
- License: MIT

| Skill | Tier | What it adds | Upstream |
|---|---|---|---|
| `ciso-advisor` | core | Security leadership for growth-stage companies. Risk quantification in dollars, compliance roadmap (SOC 2/ISO 27001/HIPAA/GDPR), security architecture strategy, incident response leadership, and board-level security reporting. Use when … | [source](https://github.com/alirezarezvani/claude-skills/tree/0241f43/c-level-advisor/skills/ciso-advisor) |
| `iso42001-specialist` | core | ISO/IEC 42001:2023 AI Management System (AIMS) specialist for compliance teams running internal audits. Three decisions: (1) Where are the gaps against Clauses 4-10 and what do we close first? (2) What goes in the AI risk register and … | [source](https://github.com/alirezarezvani/claude-skills/tree/0241f43/ra-qm-team/compliance-team-iso42001/skills/iso42001-specialist) |

## Source: avelikiy/great_cto

- Repository: [https://github.com/avelikiy/great_cto](https://github.com/avelikiy/great_cto) (commit `4fe1e39`, retrieved 2026-07-14)
- License: MIT

| Skill | Tier | What it adds | Upstream |
|---|---|---|---|
| `well-architected` | core | 6-pillar architecture review framework. Adapted from AWS Well-Architected for use by great_cto's architect agent on every non-nano ARCH document. Forces explicit answers across operational excellence, security, reliability, performance, … | [source](https://github.com/avelikiy/great_cto/tree/4fe1e39/skills/well-architected) |

## Source: bitwize-music-studio/claude-ai-music-skills

- Repository: [https://github.com/bitwize-music-studio/claude-ai-music-skills](https://github.com/bitwize-music-studio/claude-ai-music-skills) (commit `96446de`, retrieved 2026-07-14)
- License: custom (see upstream LICENSE)

| Skill | Tier | What it adds | Upstream |
|---|---|---|---|
| `researchers-security` | core | Researches malware analysis, CVEs, attribution reports, and hacker community sources. Use when the album subject involves cybersecurity incidents or threat actors. | [source](https://github.com/bitwize-music-studio/claude-ai-music-skills/tree/96446de/skills/researchers-security) |

## Source: brycewang-stanford/Auto-Empirical-Research-Skills

- Repository: [https://github.com/brycewang-stanford/Auto-Empirical-Research-Skills](https://github.com/brycewang-stanford/Auto-Empirical-Research-Skills) (commit `85bf545`, retrieved 2026-07-14)
- License: CC-BY-4.0

| Skill | Tier | What it adds | Upstream |
|---|---|---|---|
| `cs-skills` | core | 10 computer science skills. Trigger: algorithms, systems research, software engineering, security papers. Design: theory, complexity analysis, code-centric research, and security methods. | [source](https://github.com/brycewang-stanford/Auto-Empirical-Research-Skills/tree/85bf545/skills/43-wentorai-research-plugins/skills/domains/cs) |

## Source: davila7/claude-code-templates

- Repository: [https://github.com/davila7/claude-code-templates](https://github.com/davila7/claude-code-templates) (commit `fa79251`, retrieved 2026-07-14)
- License: MIT

| Skill | Tier | What it adds | Upstream |
|---|---|---|---|
| `security-compliance` | core | Guides security professionals in implementing defense-in-depth security architectures, achieving compliance with industry frameworks (SOC2, ISO27001, GDPR, HIPAA), conducting threat modeling and risk assessments, managing security … | [source](https://github.com/davila7/claude-code-templates/tree/fa79251/cli-tool/components/skills/development/security-compliance) |
| `Data Privacy Compliance` | core | Data privacy and regulatory compliance specialist for GDPR, CCPA, HIPAA, and international data protection laws. Use when implementing privacy controls, conducting data protection impact assessments, ensuring regulatory compliance, or … | [source](https://github.com/davila7/claude-code-templates/tree/fa79251/cli-tool/components/skills/enterprise-communication/data-privacy-compliance) |
| `gdpr-dsgvo-expert` | core | Senior GDPR/DSGVO expert and internal/external auditor for data protection compliance. Provides EU GDPR and German DSGVO expertise, privacy impact assessments, data protection auditing, and compliance verification. Use for GDPR compliance … | [source](https://github.com/davila7/claude-code-templates/tree/fa79251/cli-tool/components/skills/enterprise-communication/gdpr-dsgvo-expert) |
| `laravel-expert` | core | Senior Laravel Engineer role for production-grade, maintainable, and idiomatic Laravel solutions. Focuses on clean architecture, security, performance, and modern standards (Laravel 10/11+). | [source](https://github.com/davila7/claude-code-templates/tree/fa79251/cli-tool/components/skills/development/laravel-expert) |

## Source: jeremylongshore/claude-code-plugins-plus-skills

- Repository: [https://github.com/jeremylongshore/claude-code-plugins-plus-skills](https://github.com/jeremylongshore/claude-code-plugins-plus-skills) (commit `e112938a`, retrieved 2026-07-14)
- License: MIT

| Skill | Tier | What it adds | Upstream |
|---|---|---|---|
| `cursor-compliance-audit` | core | Compliance and security auditing for Cursor IDE usage: SOC 2, GDPR, HIPAA assessment, evidence collection, and remediation. Triggers on "cursor compliance", "cursor audit", "cursor security review", "cursor soc2", "cursor gdpr", "cursor … | [source](https://github.com/jeremylongshore/claude-code-plugins-plus-skills/tree/e112938a/plugins/saas-packs/cursor-pack/skills/cursor-compliance-audit) |
| `generating-compliance-reports` | core | Generate comprehensive compliance reports for security standards. Use when creating compliance documentation. Trigger with 'generate compliance report', 'compliance status', or 'audit compliance'. | [source](https://github.com/jeremylongshore/claude-code-plugins-plus-skills/tree/e112938a/plugins/security/compliance-report-generator/skills/generating-compliance-reports) |
| `plugin-auditor` | core | Audit automatically audits AI assistant code plugins for security vulnerabilities, best practices, AI assistant.md compliance, and quality standards when user mentions audit plugin, security review, or best practices check. specific to AI … | [source](https://github.com/jeremylongshore/claude-code-plugins-plus-skills/tree/e112938a/plugins/examples/jeremy-plugin-tool/skills/plugin-auditor) |
| `instantly-data-handling` | core | Implement Instantly.ai lead data management, GDPR/CAN-SPAM compliance, and list operations. Use when handling lead imports, managing block lists, implementing unsubscribe flows, or ensuring compliance with email regulations. Trigger with … | [source](https://github.com/jeremylongshore/claude-code-plugins-plus-skills/tree/e112938a/plugins/saas-packs/instantly-pack/skills/instantly-data-handling) |
| `supabase-data-handling` | core | Implement GDPR/CCPA compliance with Supabase: RLS for data isolation, user deletion via auth.admin.deleteUser(), data export via SQL, PII column management, backup/restore workflows, and retention policies. Use when handling sensitive … | [source](https://github.com/jeremylongshore/claude-code-plugins-plus-skills/tree/e112938a/plugins/saas-packs/supabase-pack/skills/supabase-data-handling) |
| `flexport-data-handling` | core | Implement data handling for Flexport supply chain data including PII redaction, shipment data retention, GDPR compliance, and secure document management. Trigger: "flexport data handling", "flexport PII", "flexport GDPR", "flexport data … | [source](https://github.com/jeremylongshore/claude-code-plugins-plus-skills/tree/e112938a/plugins/saas-packs/flexport-pack/skills/flexport-data-handling) |
| `twinmind-data-handling` | core | Handle TwinMind meeting data with GDPR compliance: transcript storage, memory vault management, data export, and deletion policies. Use when implementing data handling, or managing TwinMind meeting AI operations. Trigger with phrases like … | [source](https://github.com/jeremylongshore/claude-code-plugins-plus-skills/tree/e112938a/plugins/saas-packs/twinmind-pack/skills/twinmind-data-handling) |
| `apollo-data-handling` | core | Apollo.io data management and compliance. Use when handling contact data, implementing GDPR compliance, or managing data exports and retention. Trigger with phrases like "apollo data", "apollo gdpr", "apollo compliance", "apollo data … | [source](https://github.com/jeremylongshore/claude-code-plugins-plus-skills/tree/e112938a/plugins/saas-packs/apollo-pack/skills/apollo-data-handling) |
| `posthog-data-handling` | core | PostHog PII handling, GDPR compliance, consent management, data deletion, property sanitization, and privacy-safe analytics configuration. Trigger: "posthog data", "posthog PII", "posthog GDPR", "posthog data retention", "posthog privacy", … | [source](https://github.com/jeremylongshore/claude-code-plugins-plus-skills/tree/e112938a/plugins/saas-packs/posthog-pack/skills/posthog-data-handling) |
| `canva-data-handling` | core | Implement Canva Connect API data handling, PII protection, and GDPR/CCPA compliance. Use when handling user design data, implementing data retention policies, or ensuring privacy compliance for Canva integrations. Trigger with phrases like … | [source](https://github.com/jeremylongshore/claude-code-plugins-plus-skills/tree/e112938a/plugins/saas-packs/canva-pack/skills/canva-data-handling) |
| `clay-data-handling` | core | Implement GDPR/CCPA-compliant data handling for Clay enrichment pipelines. Use when handling PII from enrichments, implementing data retention policies, or ensuring regulatory compliance for Clay-enriched lead data. Trigger with phrases … | [source](https://github.com/jeremylongshore/claude-code-plugins-plus-skills/tree/e112938a/plugins/saas-packs/clay-pack/skills/clay-data-handling) |
| `figma-policy-guardrails` | core | Enforce security policies and coding standards for Figma API integrations. Use when setting up linting rules for Figma tokens, preventing accidental credential leaks, or enforcing API usage best practices. Trigger with phrases like "figma … | [source](https://github.com/jeremylongshore/claude-code-plugins-plus-skills/tree/e112938a/plugins/saas-packs/figma-pack/skills/figma-policy-guardrails) |

## Source: mohitagw15856/pm-claude-skills

- Repository: [https://github.com/mohitagw15856/pm-claude-skills](https://github.com/mohitagw15856/pm-claude-skills) (commit `876fa30`, retrieved 2026-07-14)
- License: MIT

| Skill | Tier | What it adds | Upstream |
|---|---|---|---|
| `compliance-checklist` | core | Generate a prioritised compliance checklist for GDPR, SOC 2, ISO 27001, FCA, HIPAA, or other frameworks with a gap analysis. Use when asked for a compliance checklist, gap analysis, readiness assessment, or audit preparation for any … | [source](https://github.com/mohitagw15856/pm-claude-skills/tree/876fa30/plugins/pm-legal/skills/compliance-checklist) |

## Source: mukul975/Anthropic-Cybersecurity-Skills

- Repository: [https://github.com/mukul975/Anthropic-Cybersecurity-Skills](https://github.com/mukul975/Anthropic-Cybersecurity-Skills) (commit `673da1f`, retrieved 2026-07-14)
- License: Apache-2.0

| Skill | Tier | What it adds | Upstream |
|---|---|---|---|
| `achieving-cmmc-level-2-compliance` | core | Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14 families, compute the SPRS score with the DoD Assessment Methodology, … | [source](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/673da1f/skills/achieving-cmmc-level-2-compliance) |
| `implementing-iso-27001-information-security-management` | core | ISO/IEC 27001:2022 is the international standard for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). This skill covers the complete | [source](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/673da1f/skills/implementing-iso-27001-information-security-management) |
| `implementing-azure-defender-for-cloud` | core | Implementing Microsoft Defender for Cloud to enable cloud security posture management, workload protection across VMs, containers, databases, and storage, configure security recommendations, and set up adaptive security controls with … | [source](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/673da1f/skills/implementing-azure-defender-for-cloud) |
| `hardening-linux-endpoint-with-cis-benchmark` | core | Hardens Linux endpoints using CIS Benchmark recommendations for Ubuntu, RHEL, and CentOS to reduce attack surface, enforce security baselines, and meet compliance requirements. Use when deploying new Linux servers, remediating audit … | [source](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/673da1f/skills/hardening-linux-endpoint-with-cis-benchmark) |
| `hardening-windows-endpoint-with-cis-benchmark` | core | Hardens Windows endpoints using CIS (Center for Internet Security) Benchmark recommendations to reduce attack surface, enforce security baselines, and meet compliance requirements. Use when deploying new Windows workstations or servers, … | [source](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/673da1f/skills/hardening-windows-endpoint-with-cis-benchmark) |
| `implementing-aws-security-hub-compliance` | core | Implementing AWS Security Hub to aggregate security findings across AWS accounts, enable compliance standards like CIS AWS Foundations and PCI DSS, configure automated remediation with EventBridge and Lambda, and create custom security … | [source](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/673da1f/skills/implementing-aws-security-hub-compliance) |
| `implementing-aws-security-hub` | core | This skill covers deploying AWS Security Hub as a centralized cloud security posture management platform that aggregates findings from GuardDuty, Inspector, Macie, and third-party tools. It details enabling security standards like CIS AWS … | [source](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/673da1f/skills/implementing-aws-security-hub) |
| `auditing-cloud-with-cis-benchmarks` | core | This skill details how to conduct cloud security audits using Center for Internet Security benchmarks for AWS, Azure, and GCP. It covers interpreting CIS Foundations Benchmark controls, running automated assessments with tools like Prowler … | [source](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/673da1f/skills/auditing-cloud-with-cis-benchmarks) |
| `prioritizing-vulnerabilities-with-cvss-scoring` | core | The Common Vulnerability Scoring System (CVSS) is the industry standard framework maintained by FIRST (Forum of Incident Response and Security Teams) for assessing vulnerability severity. CVSS v4.0 (r | [source](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/673da1f/skills/prioritizing-vulnerabilities-with-cvss-scoring) |
| `securing-kubernetes-on-cloud` | core | This skill covers hardening managed Kubernetes clusters on EKS, AKS, and GKE by implementing Pod Security Standards, network policies, workload identity, RBAC scoping, image admission controls, and runtime security monitoring. It addresses … | [source](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/673da1f/skills/securing-kubernetes-on-cloud) |
| `auditing-foundry-smart-contract-security` | core | Pre-deployment security audit of Solidity smart contracts in a Foundry project. Combines static analysis (Slither, Aderyn), symbolic execution (Mythril), and property-based testing (forge fuzz + invariant tests with handlers) to catch … | [source](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/673da1f/skills/auditing-foundry-smart-contract-security) |
| `detecting-spearphishing-with-email-gateway` | core | Spearphishing targets specific individuals using personalized, researched content that bypasses generic spam filters. Email security gateways (SEGs) like Microsoft Defender for Office 365, Proofpoint, | [source](https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/673da1f/skills/detecting-spearphishing-with-email-gateway) |

## Source: nWave-ai/nWave

- Repository: [https://github.com/nWave-ai/nWave](https://github.com/nWave-ai/nWave) (commit `1d0f13c`, retrieved 2026-07-14)
- License: MIT

| Skill | Tier | What it adds | Upstream |
|---|---|---|---|
| `nw-security-and-governance` | core | Database security (encryption, access control, injection prevention), data governance (lineage, quality, MDM), and compliance frameworks (GDPR, CCPA, HIPAA) | [source](https://github.com/nWave-ai/nWave/tree/1d0f13c/nWave/skills/nw-security-and-governance) |

## Source: rsmdt/the-startup

- Repository: [https://github.com/rsmdt/the-startup](https://github.com/rsmdt/the-startup) (commit `ff6a0be`, retrieved 2026-07-14)
- License: MIT

| Skill | Tier | What it adds | Upstream |
|---|---|---|---|
| `code-quality-review` | core | Unified code review skill for correctness, design, readability, security, performance, testability, accessibility, and error-handling conventions. Use when reviewing changes, enforcing quality standards, or identifying technical debt. | [source](https://github.com/rsmdt/the-startup/tree/ff6a0be/plugins/team/skills/quality/code-quality-review) |

## Source: samber/cc-skills-golang

- Repository: [https://github.com/samber/cc-skills-golang](https://github.com/samber/cc-skills-golang) (commit `4881c01`, retrieved 2026-07-14)
- License: MIT

| Skill | Tier | What it adds | Upstream |
|---|---|---|---|
| `golang-security` | core | Security best practices and vulnerability prevention for Golang. Covers injection (SQL, command, XSS), cryptography, filesystem safety, network security, cookies, secrets management, memory safety, and logging. Apply when writing, … | [source](https://github.com/samber/cc-skills-golang/tree/4881c01/skills/golang-security) |

## Source: Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

- Repository: [https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance](https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance) (commit `71d8920`, retrieved 2026-07-14)
- License: MIT

| Skill | Tier | What it adds | Upstream |
|---|---|---|---|
| `gdpr-compliance` | core | Expert GDPR compliance assistant covering all four core workflows: (1) auditing code and systems for GDPR violations, (2) drafting GDPR-compliant documents such as privacy policies, Data Processing Agreements (DPAs), and consent notices, … | [source](https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance/tree/71d8920/plugins/gdpr-compliance/skills/gdpr-compliance) |

## Source: trailofbits/skills

- Repository: [https://github.com/trailofbits/skills](https://github.com/trailofbits/skills) (commit `cfe5d7b`, retrieved 2026-07-14)
- License: custom (see upstream LICENSE)

| Skill | Tier | What it adds | Upstream |
|---|---|---|---|
| `c-review` | core | Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C/C++ applications, reviewing daemons or services for memory safety, or … | [source](https://github.com/trailofbits/skills/tree/cfe5d7b/plugins/c-review/skills/c-review) |
| `rust-review` | core | Performs comprehensive Rust security review for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS, FFI safety, and async runtime mistakes. Use when auditing Rust crates, services, or … | [source](https://github.com/trailofbits/skills/tree/cfe5d7b/plugins/rust-review/skills/rust-review) |
| `secure-workflow-guide` | core | Guides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual security diagrams, helps document security properties for … | [source](https://github.com/trailofbits/skills/tree/cfe5d7b/plugins/building-secure-contracts/skills/secure-workflow-guide) |
| `audit-prep-assistant` | core | Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user … | [source](https://github.com/trailofbits/skills/tree/cfe5d7b/plugins/building-secure-contracts/skills/audit-prep-assistant) |
| `entry-point-analyzer` | core | Analyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level (public, admin, role-restricted, contract-only), and … | [source](https://github.com/trailofbits/skills/tree/cfe5d7b/plugins/entry-point-analyzer/skills/entry-point-analyzer) |

## Source: vibeeval/vibecosystem

- Repository: [https://github.com/vibeeval/vibecosystem](https://github.com/vibeeval/vibecosystem) (commit `cea9462`, retrieved 2026-07-14)
- License: MIT

| Skill | Tier | What it adds | Upstream |
|---|---|---|---|
| `compliance-patterns` | core | GDPR data handling, audit logging, data classification, retention policies, and consent management for regulatory compliance. | [source](https://github.com/vibeeval/vibecosystem/tree/cea9462/skills/compliance-patterns) |
| `kvkk-compliance` | core | KVKK and GDPR compliance patterns - consent management, right to erasure, breach notification, audit logging, cookie consent, and data classification. | [source](https://github.com/vibeeval/vibecosystem/tree/cea9462/skills/kvkk-compliance) |
| `saas-launch-checklist` | core | Pre-launch verification across infrastructure, security, legal, payment, email, analytics, and performance. Day-1 monitoring, rollback plan, incident response skeleton, and post-launch week-1 checklist. | [source](https://github.com/vibeeval/vibecosystem/tree/cea9462/skills/saas-launch-checklist) |
| `gdpr-compliance` | core | GDPR compliance - data subject rights, lawful basis, DPIA, privacy by design, breach notification, consent management, cross-border transfers, PII masking | [source](https://github.com/vibeeval/vibecosystem/tree/cea9462/skills/gdpr-compliance) |
| `hipaa-compliance` | core | HIPAA compliance - PHI protection, technical/administrative/physical safeguards, minimum necessary standard, BAA requirements, de-identification, access logging | [source](https://github.com/vibeeval/vibecosystem/tree/cea9462/skills/hipaa-compliance) |

## Source: zebbern/claude-code-guide

- Repository: [https://github.com/zebbern/claude-code-guide](https://github.com/zebbern/claude-code-guide) (commit `d2c5280`, retrieved 2026-07-14)
- License: MIT

| Skill | Tier | What it adds | Upstream |
|---|---|---|---|
| `regulatory-audit-generator` | core | Builds compliance checklists for business scenarios involving GDPR, PIPL, or advertising/data laws. Outputs a structured checklist with check items, legal basis, risk levels, and actionable recommendations. Triggered by requests like \"run … | [source](https://github.com/zebbern/claude-code-guide/tree/d2c5280/skills/regulatory-audit-generator) |

## Source: zxkane/aws-skills

- Repository: [https://github.com/zxkane/aws-skills](https://github.com/zxkane/aws-skills) (commit `68530c6`, retrieved 2026-07-14)
- License: MIT

| Skill | Tier | What it adds | Upstream |
|---|---|---|---|
| `aws-cost-operations` | core | AWS cost optimization, monitoring, and operational excellence expert. Use when analyzing AWS bills, estimating costs, setting up CloudWatch alarms, querying logs, auditing CloudTrail activity, or assessing security posture. Essential when … | [source](https://github.com/zxkane/aws-skills/tree/68530c6/plugins/aws-cost-ops/skills/aws-cost-operations) |