Anthropic-Cybersecurity-Skills

Least-privilege permissions

• Bind skill invocations to a dedicated service account with explicit ALLOW policies for only required skill categories (e.g., NIST CSF 2.0 threat modeling only—deny MITRE ATT&CK exploitation skills if not needed).
• Implement capability-level RBAC: restrict agent access to read-only framework mappings; block direct invocation of reconnaissance or attack-simulation skills by default; require human approval via prompt for sensitive domains (credential management, lateral movement tactics).
• Rotate and vault all external tool credentials (SIEM connectors, threat feeds) separately from agent runtime; inject only scoped tokens with TTL ≤ 1 hour at skill execution time.
• Audit and disable unused skill domains monthly; remove agent access to any of the 29 security domains not explicitly required by the use case.

Network isolation

• Run the MCP connector in a restricted network zone (demilitarized segment or container) with egress filtering; block outbound connections except to explicitly whitelisted security APIs and your organization's internal threat intelligence endpoints.
• Disable or strictly rate-limit skill outputs that query external threat feeds or MITRE repositories; cache framework data locally and refresh on a fixed schedule rather than on-demand to prevent data exfiltration via timing side-channels.
• Require all MCP skill requests and responses to transit through a proxy/gateway with content inspection; log and flag any response containing sensitive keywords (internal hostnames, credential patterns, private IP ranges).

Monitoring

• Alert on anomalous skill invocation patterns: sudden spike in reconnaissance-category skills, sequential execution of ATT&CK tactics, or repeated failed authentication to external security tools.
• Implement structured logging of every skill call (input prompt, framework mapping used, returned results) with immutable audit trail; flag any prompt containing suspicious keywords (e.g., "bypass," "ignore rules," "override policy").
• Monitor GitHub repo for updates and supply-chain changes; subscribe to security advisories and verify commit signatures; require manual code review and staged rollout before upgrading the connector in production.
• Track data exfiltration risk: scan all skill responses for PII, internal organizational details, or incomplete security gap disclosures before agent output reaches end-users or logs.

Red flags to watch for

• Skill responses include detailed attack chains, tool recommendations, or credential/API patterns that could be repurposed by adversaries if chat logs are breached or shared.
• Agent prompt contains framework mapping instructions that redefine threat severity (e.g., "classify high-risk MITRE ATT&CK techniques as low-risk") or inject conflicting security policy interpretations.
• MCP connector silently succeeds in authenticating to external SIEM or threat feed without explicit credential provisioning step, indicating hardcoded secrets or overly permissive environment variables.
• Skill execution time or response size anomalies suggest the agent is enumerating all 817 skills, querying large threat databases without filtering, or attempting to exfiltrate framework metadata in bulk.