CyberSecurity
🥈SilverCybersecurity projects, CTF solutions and CVE research, Demostrating practical skills in security analysis, automation, and threat mitigation
600Updated 2w ago
Intermediate30min to implementautomation
Saves ~240 min per use
Quick InstallView Source
git clone https://github.com/AstroTechZM/CyberSecurity.gitWorks with:
Claude
Overview
About This Skill
The CyberSecurity skill within the Claude Code framework is designed to streamline cybersecurity projects, offering solutions for Capture The Flag (CTF) challenges and Common Vulnerabilities and Exposures (CVE) research. This automation skill empowers users to demonstrate practical skills in security analysis, automation, and threat mitigation, making it an essential tool for developers and AI practitioners focused on enhancing security protocols. One of the key benefits of the CyberSecurity skill is its ability to significantly reduce the time spent on manual security assessments. While the exact time savings are currently unknown, the skill's intermediate implementation difficulty and 30-minute setup time suggest that users can quickly integrate it into their existing workflows. By automating routine security tasks, teams can focus on more strategic initiatives, ultimately improving their overall security posture. This skill is particularly beneficial for security analysts, developers, and product managers who are involved in cybersecurity projects. Its practical applications include automating vulnerability assessments, streamlining incident response processes, and enhancing threat detection capabilities. For example, a security analyst could use this skill to automate the analysis of CVEs, allowing for quicker identification of vulnerabilities within their systems. With an intermediate complexity level, the CyberSecurity skill is well-suited for those with a foundational understanding of cybersecurity principles. It fits seamlessly into AI-first workflows, enabling organizations to leverage AI automation for enhanced security measures. As the landscape of cybersecurity continues to evolve, integrating such skills into your toolkit is crucial for staying ahead of potential threats.
How to Use
1. **Gather Data Sources**: Collect your incident reports (e.g., SIEM logs, vulnerability scans) and specify the date range (e.g., 'Q1 2024') and company name. Use tools like Splunk, Elasticsearch, or Nessus to export raw data. 2. **Extract CVEs**: Run a CVE lookup using the NIST NVD API (e.g., `https://services.nvd.nist.gov/rest/json/cves/2.0?pubStartDate=2024-01-01T00:00:00:000 UTC-05:00&pubEndDate=2024-03-31T23:59:59:999 UTC-05:00`) or manually review vendor advisories (e.g., Apache, Microsoft). 3. **Assess Impact**: For each CVE, cross-reference with your asset inventory (e.g., CMDB tools like ServiceNow or Lansweeper) to identify affected systems. Prioritize based on CVSS scores and exploit availability (check [Exploit-DB](https://www.exploit-db.com/) or [Metasploit](https://www.metasploit.com/)). 4. **Generate Mitigation Plan**: Use the prompt template to structure your output. Include deadlines (e.g., 'Immediate', '24h', '1 week') and assign owners (e.g., DevOps, IT Security). Validate with tools like OpenVAS or Qualys for patch verification. 5. **Track Progress**: Update the action plan in your project management tool (e.g., Jira, Trello) or security orchestration platform (e.g., TheHive, Demisto). Schedule follow-up scans to confirm remediation (e.g., `nessuscli scan --id=12345 --target=192.168.1.0/24`). **Pro Tips:** - For **automation**, use the NIST NVD API to pull CVEs dynamically (e.g., `curl -X GET "https://services.nvd.nist.gov/rest/json/cves/2.0?keyword=log4j"`). - For **prioritization**, use the [EPSS (Exploit Prediction Scoring System)](https://www.first.org/epss/) to assess real-world exploitability. - For **collaboration**, share the output in Sortd (if using Gmail) by creating a kanban board with columns: 'Critical', 'High', 'Medium', 'Low' to track remediation status.
Setup & Installation
Quick Install
No install command available. Check the GitHub repository for manual installation instructions.
Alternative Install (Git Clone)
git clone https://github.com/AstroTechZM/CyberSecurityRequirements
- Claude Code or compatible AI agent
- Works with: Claude
Quick Start Guide
1
Install the Skill
Copy the install command above and run it in your terminal.
2
Open Your AI Agent
Launch Claude Code, Cursor, or your preferred AI coding agent.
3
Try It Out
Use the prompt template or examples below to test the skill.
4
Customize
Adapt the skill to your specific use case and workflow.
Usage Examples
Prompt Template
Analyze the cybersecurity incident report for [COMPANY_NAME] from [DATE_RANGE]. Extract all CVEs mentioned, their severity scores, and affected systems. For each CVE, provide a concise mitigation strategy using tools like [NIST_NVD_API], [CVE_Details], or [OpenVAS]. Prioritize remediation based on exploitability and business impact. Format the output as a prioritized action plan with deadlines.
Example Output
### Cybersecurity Incident Analysis Report
**Company:** TechSecure Inc.
**Date Range:** January 1 - March 31, 2024
#### **Critical CVEs Identified (Top 5 by Severity)**
1. **CVE-2024-1234** (CVSS: 9.8 - Critical)
- **Affected System:** Internal Apache Tomcat server (v9.0.70)
- **Impact:** Remote code execution (RCE) via unpatched Log4j vulnerability
- **Exploit Status:** Actively exploited in the wild (verified via [CVE Details](https://www.cvedetails.com/cve/CVE-2024-1234/))
- **Mitigation Strategy:**
- **Immediate (24h):** Apply Apache Tomcat patch (v9.0.73+) via `apt upgrade tomcat9`
- **Short-term (72h):** Deploy WAF rules to block Log4j exploit patterns (Snort/Suricata signatures)
- **Long-term (1 week):** Migrate to Log4j2 v2.23+ and enable JNDI lookup restrictions
- **Owner:** DevOps Team (escalated to CISO)
2. **CVE-2024-5678** (CVSS: 8.7 - High)
- **Affected System:** Customer-facing WordPress plugin (WPForms v1.8.2)
- **Impact:** SQL injection leading to database compromise
- **Exploit Status:** Proof-of-concept available on ExploitDB
- **Mitigation Strategy:**
- **Immediate (12h):** Disable WPForms plugin and switch to Contact Form 7
- **Short-term (48h):** Deploy ModSecurity rules to block SQLi patterns
- **Long-term (2 weeks):** Upgrade to WPForms v1.8.5+ and implement database encryption
- **Owner:** Web Team
3. **CVE-2024-9012** (CVSS: 7.5 - High)
- **Affected System:** Internal Jenkins server (v2.414)
- **Impact:** Credential exposure via unencrypted API tokens
- **Exploit Status:** Detected in SIEM logs (failed login attempts)
- **Mitigation Strategy:**
- **Immediate (6h):** Rotate all Jenkins API tokens and enable credential masking
- **Short-term (24h):** Enable TLS 1.3 for Jenkins API endpoints
- **Long-term (1 week):** Migrate to HashiCorp Vault for secrets management
- **Owner:** DevOps Team
4. **CVE-2024-3456** (CVSS: 6.5 - Medium)
- **Affected System:** Employee laptops (Windows 10 Pro, unpatched)
- **Impact:** Privilege escalation via Print Spooler service
- **Exploit Status:** Public exploit available (GitHub)
- **Mitigation Strategy:**
- **Immediate (4h):** Apply Microsoft KB5034123 patch via WSUS
- **Short-term (24h):** Disable Print Spooler service on non-printing devices
- **Long-term (2 weeks):** Deploy endpoint detection/response (EDR) tools
- **Owner:** IT Security Team
5. **CVE-2024-7890** (CVSS: 5.4 - Medium)
- **Affected System:** Third-party SaaS vendor (Customer.io API)
- **Impact:** Data leakage via misconfigured API endpoints
- **Exploit Status:** Detected in vendor audit logs
- **Mitigation Strategy:**
- **Immediate (24h):** Revoke and regenerate all Customer.io API keys
- **Short-term (72h):** Implement API rate limiting and IP whitelisting
- **Long-term (1 month):** Migrate to a SOC 2-compliant alternative
- **Owner:** Vendor Management Team
#### **Prioritized Action Plan**
| Priority | CVE | Deadline | Owner | Status |
|----------|--------------|-----------|-------------|--------------|
| 1 | CVE-2024-1234| 2024-04-01| DevOps Team | In Progress |
| 2 | CVE-2024-5678| 2024-04-02| Web Team | Not Started |
| 3 | CVE-2024-9012| 2024-04-03| DevOps Team | Not Started |
| 4 | CVE-2024-3456| 2024-04-04| IT Security | Not Started |
| 5 | CVE-2024-7890| 2024-04-05| Vendor Mgmt | Not Started |
#### **Tools Used for Analysis**
- **Vulnerability Scanning:** Nessus Professional (v10.6.1)
- **SIEM:** Splunk Enterprise (v9.0.4)
- **Threat Intelligence:** MITRE ATT&CK Framework, AlienVault OTX
- **Patch Management:** Microsoft WSUS, Canonical Landscape
#### **Next Steps**
1. **Validate all mitigation steps** with a penetration test (scheduled for 2024-04-06).
2. **Update incident response playbooks** to include CVE-2024-1234 and CVE-2024-5678.
3. **Schedule a CISO briefing** on April 7 to review remediation progress and resource allocation.Apply to these tools
Browse all toolsAutoma
Automate your browser workflows effortlessly
Tiga
Hire Tiga Sales AI to Prospect for You
Microsoft Teams
Get more done every day with Microsoft Teams – powered by AI
GPT for work
Automate your spreadsheet tasks with AI power
Respell
Agentic AI Workflow platform
Notion
Connected workspace for docs, wikis, and projects
Compatible MCP servers
Browse all MCP servers
Find the right skills for your stack
Take a free 3-minute scan and get personalized AI skill recommendations.
Take free scan