Appearance

Cybersecurity Skills Library ​

agents-fleet vendors the Anthropic Cybersecurity Skills library — a collection of 817 atomic skills covering 29 cybersecurity domains. The library is licensed under Apache-2.0.

Off by Default ​

The vendored library is OFF by default and never loads unless explicitly opted in. This is intentional: the skills cover dual-use and offensive security topics intended for authorized-scope security research and testing only.

Opt-in ​

Enable via either of two mechanisms (OR'd — any one enables the tier):

MechanismHow
CLI flag--enable-cybersec-skills
Environment variableAGENTS_FLEET_CYBERSEC_SKILLS=1 (strict '1' literal)

Source: src/commands/resolveEnableCybersecSkills.ts

Example ​

bash
# Via CLI flag
agents-fleet --enable-cybersec-skills

# Via environment variable
AGENTS_FLEET_CYBERSEC_SKILLS=1 agents-fleet

What's Included ​

817 skills across 29 cybersecurity domains, including:

  • Active Directory security and abuse techniques
  • Application security (web, API, mobile)
  • Binary analysis and reverse engineering
  • Cloud security (AWS, Azure, GCP)
  • Compliance frameworks (CMMC, SOC 2, NIST, PCI-DSS, HIPAA)
  • Container and Kubernetes security
  • Cryptographic analysis
  • Digital forensics and incident response
  • Exploitation techniques and mitigations
  • Fuzzing and vulnerability research
  • Hardware and firmware security
  • ICS/SCADA and OT security
  • IoT security
  • Malware analysis
  • Network security and protocol analysis
  • OSINT and reconnaissance
  • Penetration testing methodologies
  • Privilege escalation techniques
  • Red team operations
  • Reverse engineering
  • Social engineering
  • Supply chain security
  • Threat intelligence
  • Wireless security

Each skill is a .skill.md file with YAML frontmatter (name, description) and a Markdown body containing the skill's knowledge and instructions.

Precedence ​

The vendored cybersec tier has the lowest precedence in the skill resolution hierarchy:

project tier (.fleet/skills/)     ← highest
user tier    (~/.fleet/skills/)
bundled tier (src/skills/bundled/)
vendored tier (cybersec)          ← lowest (when enabled)

A same-named skill at any higher tier overrides the vendored version. This lets you customize individual cybersec skills by placing an override in your project or user tier.

Interaction with list_features ​

When enabled, all 817 skills appear in the coordinator's list_features tool output (kind: skill, source: vendored). When disabled (the default), they are invisible to feature discovery.

Usage Tips ​

  1. Enable only when needed — the 817 skills add to registry load time and context. Enable for dedicated security sessions, not everyday coding.

  2. Combine with the security autopilots — the built-in security autopilots (/security-autopilot, /security-binary-autopilot, /security-disclosure-autopilot) use the bundled sec-* skills and roles by default. The vendored library extends coverage to specialized domains not covered by the 17 bundled sec-* skills.

  3. Authorized scope only — these skills cover offensive techniques. Use them only against systems you own or are explicitly authorized to test.

See also: Security Autopilots guide, Bundled Skills reference