# maheshadi/anthropic-cybersecurity-skills architecture

> Architecture diagram of the GitHub repository maheshadi/anthropic-cybersecurity-skills, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-11). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/maheshadi/anthropic-cybersecurity-skills
- Repository: https://github.com/maheshadi/anthropic-cybersecurity-skills

## Overview

This repository is a library of agent-readable cybersecurity skills, not a single executable application. An AI agent uses the skill collection for task-specific guidance, producing investigation, assessment, defensive, or operational outcomes. The README documents broad security-domain coverage and framework mappings; sampled scripts show that some skills also implement focused workflows. The tree and excerpts do not establish a shared runtime that dispatches among skills, so the graph does not imply one. Many skill directories were not sampled; their capability branches are represented at the directory level.

Main entry points: [`skills/analyzing-sbom-for-supply-chain-vulnerabilities/scripts/agent.py`](https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/skills/analyzing-sbom-for-supply-chain-vulnerabilities/scripts/agent.py) (Cybersecurity skills), [`README.md`](https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/README.md) (Framework mappings), [`skills/analyzing-linux-elf-malware/scripts/agent.py`](https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/skills/analyzing-linux-elf-malware/scripts/agent.py) (Malware analysis), [`skills/analyzing-memory-dumps-with-volatility/scripts/agent.py`](https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/skills/analyzing-memory-dumps-with-volatility/scripts/agent.py) (Digital forensics)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_library["Skill library"]
  node_skills["Cybersecurity skills<br/>[agent.py]"]
  node_frameworks["Framework mappings<br/>[README.md]"]
end

subgraph group_threat["Threat analysis"]
  node_malware["Malware analysis<br/>[agent.py]"]
  node_forensics["Digital forensics<br/>[agent.py]"]
  node_threatintel["Threat intelligence<br/>[agent.py]"]
  node_network["Network investigations<br/>[agent.py]"]
  node_incident["Incident response<br/>[agent.py]"]
end

subgraph group_defense["Defensive security"]
  node_detection["Threat detection<br/>[agent.py]"]
  node_deception["Deception monitoring<br/>[agent.py]"]
  node_identity["Identity security<br/>[agent.py]"]
  node_cloud["Cloud security<br/>[agent.py]"]
end

subgraph group_assurance["Assessment and assurance"]
  node_privacy["Privacy assessment<br/>[agent.py]"]
  node_dsar["Data access requests<br/>[agent.py]"]
  node_gdpr["GDPR compliance"]
  node_crypto["Crypto migration<br/>[agent.py]"]
  node_attack["Attack surface assessment<br/>[agent.py]"]
end

node_agent(("AI agent"))

node_agent -->|"uses guidance"| node_skills
node_skills -->|"maps to"| node_frameworks
node_skills -->|"covers"| node_malware
node_skills -->|"covers"| node_forensics
node_skills -->|"covers"| node_threatintel
node_skills -->|"covers"| node_network
node_skills -->|"covers"| node_incident
node_skills -->|"covers"| node_detection
node_skills -->|"covers"| node_deception
node_skills -->|"covers"| node_identity
node_skills -->|"covers"| node_cloud
node_skills -->|"covers"| node_privacy
node_skills -->|"covers"| node_dsar
node_skills -->|"covers"| node_gdpr
node_skills -->|"covers"| node_crypto
node_skills -->|"covers"| node_attack

click node_skills "https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/skills/analyzing-sbom-for-supply-chain-vulnerabilities/scripts/agent.py"
click node_frameworks "https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/README.md"
click node_malware "https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/skills/analyzing-linux-elf-malware/scripts/agent.py"
click node_forensics "https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/skills/analyzing-memory-dumps-with-volatility/scripts/agent.py"
click node_threatintel "https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/skills/analyzing-threat-intelligence-feeds/scripts/agent.py"
click node_network "https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/skills/analyzing-network-traffic-for-incidents/scripts/agent.py"
click node_incident "https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/skills/conducting-malware-incident-response/scripts/agent.py"
click node_detection "https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/skills/detecting-command-and-control-over-dns/scripts/agent.py"
click node_deception "https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/skills/deploying-active-directory-honeytokens/scripts/agent.py"
click node_identity "https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/skills/auditing-azure-active-directory-configuration/scripts/agent.py"
click node_cloud "https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/skills/conducting-cloud-incident-response/scripts/agent.py"
click node_privacy "https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/skills/performing-privacy-impact-assessment/scripts/agent.py"
click node_dsar "https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/skills/implementing-gdpr-data-subject-access-request/scripts/agent.py"
click node_gdpr "https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/skills/conducting-gdpr-compliance-assessment/scripts/article30_parser.py"
click node_crypto "https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/skills/performing-post-quantum-cryptography-migration/scripts/agent.py"
click node_attack "https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/skills/implementing-attack-surface-management/scripts/agent.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_skills,node_frameworks toneBlue
class node_malware,node_forensics,node_threatintel,node_network,node_incident toneAmber
class node_detection,node_deception,node_identity,node_cloud toneMint
class node_privacy,node_dsar,node_gdpr,node_crypto,node_attack toneRose
class node_agent toneIndigo
```

## Components

### Skill library

- [Cybersecurity skills](https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/skills/analyzing-sbom-for-supply-chain-vulnerabilities/scripts/agent.py): `skills/analyzing-sbom-for-supply-chain-vulnerabilities/scripts/agent.py`
- [Framework mappings](https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/README.md): `README.md`

### Threat analysis

- [Malware analysis](https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/skills/analyzing-linux-elf-malware/scripts/agent.py): `skills/analyzing-linux-elf-malware/scripts/agent.py`
- [Digital forensics](https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/skills/analyzing-memory-dumps-with-volatility/scripts/agent.py): `skills/analyzing-memory-dumps-with-volatility/scripts/agent.py`
- [Threat intelligence](https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/skills/analyzing-threat-intelligence-feeds/scripts/agent.py): `skills/analyzing-threat-intelligence-feeds/scripts/agent.py`
- [Network investigations](https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/skills/analyzing-network-traffic-for-incidents/scripts/agent.py): `skills/analyzing-network-traffic-for-incidents/scripts/agent.py`
- [Incident response](https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/skills/conducting-malware-incident-response/scripts/agent.py): `skills/conducting-malware-incident-response/scripts/agent.py`

### Defensive security

- [Threat detection](https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/skills/detecting-command-and-control-over-dns/scripts/agent.py): `skills/detecting-command-and-control-over-dns/scripts/agent.py`
- [Deception monitoring](https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/skills/deploying-active-directory-honeytokens/scripts/agent.py): `skills/deploying-active-directory-honeytokens/scripts/agent.py`
- [Identity security](https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/skills/auditing-azure-active-directory-configuration/scripts/agent.py): `skills/auditing-azure-active-directory-configuration/scripts/agent.py`
- [Cloud security](https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/skills/conducting-cloud-incident-response/scripts/agent.py): `skills/conducting-cloud-incident-response/scripts/agent.py`

### Assessment and assurance

- [Privacy assessment](https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/skills/performing-privacy-impact-assessment/scripts/agent.py): `skills/performing-privacy-impact-assessment/scripts/agent.py`
- [Data access requests](https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/skills/implementing-gdpr-data-subject-access-request/scripts/agent.py): `skills/implementing-gdpr-data-subject-access-request/scripts/agent.py`
- [GDPR compliance](https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/skills/conducting-gdpr-compliance-assessment/scripts/article30_parser.py): `skills/conducting-gdpr-compliance-assessment/scripts/article30_parser.py`
- [Crypto migration](https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/skills/performing-post-quantum-cryptography-migration/scripts/agent.py): `skills/performing-post-quantum-cryptography-migration/scripts/agent.py`
- [Attack surface assessment](https://github.com/maheshadi/anthropic-cybersecurity-skills/blob/main/skills/implementing-attack-surface-management/scripts/agent.py): `skills/implementing-attack-surface-management/scripts/agent.py`

### Other components

- **AI agent**

## Connections

- AI agent → Cybersecurity skills: uses guidance (evidence: `README.md`)
- Cybersecurity skills → Framework mappings: maps to (evidence: `README.md`)
- Cybersecurity skills → Malware analysis: covers (evidence: `README.md`)
- Cybersecurity skills → Digital forensics: covers (evidence: `README.md`)
- Cybersecurity skills → Threat intelligence: covers (evidence: `README.md`)
- Cybersecurity skills → Network investigations: covers (evidence: `README.md`)
- Cybersecurity skills → Incident response: covers (evidence: `README.md`)
- Cybersecurity skills → Threat detection: covers (evidence: `README.md`)
- Cybersecurity skills → Deception monitoring: covers (evidence: `README.md`)
- Cybersecurity skills → Identity security: covers (evidence: `README.md`)
- Cybersecurity skills → Cloud security: covers (evidence: `README.md`)
- Cybersecurity skills → Privacy assessment: covers (evidence: `README.md`)
- Cybersecurity skills → Data access requests: covers (evidence: `README.md`)
- Cybersecurity skills → GDPR compliance: covers (evidence: `README.md`)
- Cybersecurity skills → Crypto migration: covers (evidence: `README.md`)
- Cybersecurity skills → Attack surface assessment: covers (evidence: `README.md`)