Daniel Kim

Posted on Aug 19

A Solo Developer's 29K-Star Repo Just Validated Anthropic's Open Skills Bet

#security #ai #github #opensource

Nine months ago, Anthropic made a decision that looked, on the surface, like giving away a feature it could have kept proprietary. Agent Skills — a lightweight, folder-based format for packaging domain expertise so an AI agent can load it on demand — had launched as a Claude-only capability in October 2025. Two months later, Anthropic published it as an open standard instead. Any platform could implement it. Any developer could write skills once and have them run in Claude Code, GitHub Copilot, Cursor, OpenAI's Codex CLI, or two dozen other agentic tools, without rewriting a line.

This week, the first real evidence that bet paid off showed up on GitHub's trending page. mukul975/Anthropic-Cybersecurity-Skills — a solo-maintained repository of 817 structured cybersecurity workflows built entirely on top of the open Agent Skills format — crossed 29,000 stars and 3,500 forks, gaining hundreds of stars in a single day. It's not built by Anthropic, a security vendor, or a well-funded startup. It's maintained by one developer, Mahipal Jangra, publishing under the handle @mukul975, with help from eight listed contributors. And it's currently one of the largest structured knowledge bases for AI agents on GitHub, in any domain.

That's the story worth unpacking: not "here's a cool repo," but what it means that the biggest proof-of-concept for cross-platform agent interoperability is a community project a corporate security team would never have signed off on funding.

What the repo actually contains

Strip away the framing and Anthropic-Cybersecurity-Skills is exactly what it says: 817 Markdown-based "skills," each a self-contained folder that teaches an AI agent how to execute one cybersecurity procedure the way a working analyst would — not a Stack Overflow answer, not a tool's --help text, but the actual decision tree.

A skill directory looks like this:

skills/performing-memory-forensics-with-volatility3/
├── SKILL.md              ← YAML frontmatter + Markdown body
├── references/
│   ├── standards.md      ← framework mappings
│   └── workflows.md      ← deep technical procedure reference
├── scripts/
│   └── process.py        ← working helper scripts
└── assets/
    └── template.md        ← checklists and report templates

The SKILL.md frontmatter for that example:

---
name: performing-memory-forensics-with-volatility3
description: ">-"
  Analyze memory dumps to extract running processes, network connections,
  injected code, and malware artifacts using the Volatility3 framework.
domain: cybersecurity
subdomain: digital-forensics
tags: [forensics, memory-analysis, volatility3, incident-response, dfir]
atlas_techniques: [AML.T0047]
d3fend_techniques: [D3-MA, D3-PSMD]
nist_ai_rmf: [MEASURE-2.6]
nist_csf: [DE.CM-01, RS.AN-03]
version: "1.2"
author: mukul975
license: Apache-2.0
---

The Markdown body underneath follows a fixed four-section shape — When to Use, Prerequisites, Workflow, Verification — which is the actual point. It's not a wiki page an agent has to interpret loosely; it's a structured runbook with explicit trigger conditions and a way to check the output was correct.

The 817 skills span 29 security domains, weighted toward what security teams actually spend time on: cloud security (66 skills covering AWS, Azure, and GCP hardening and forensics), threat hunting (58), threat intelligence (52), network security (43), web application security (42), digital forensics (41), and malware analysis (39), down to smaller categories like hardware/firmware security (4) and deception technology (6).

The mechanism: progressive disclosure, and why it matters at 817 skills

The reason a repo this size doesn't blow out an agent's context window is the specific thing the Agent Skills format was designed to solve. Per the README, each skill costs roughly 30 tokens to scan — name, description, tags in the frontmatter — and 500 to 2,000 tokens to fully load once it's selected. An agent facing a prompt like "analyze this memory dump for signs of credential theft" scans all 817 frontmatters in a single pass, narrows to a handful of candidates by keyword and description match, loads the two or three that actually apply, executes the Workflow section, and checks its own work against Verification. The other 800-plus skills never touch the context window at all.

This is the practical difference between Agent Skills and simply dumping documentation into a system prompt or a retrieval index: the frontmatter/body split is a built-in two-stage retrieval mechanism, cheap enough that loading all 817 headers costs less than a single paragraph of prose.

It's also worth being precise about what this is not. Agent Skills is not Model Context Protocol (MCP). MCP is the connector layer — it gives an agent access to a tool or a data source (a database, a ticketing system, a shell). Agent Skills is the procedural-knowledge layer — it tells the agent when and how to use what it already has access to. The two are explicitly designed to compose: several of the repo's AI Security skills reference MCP server compromise and tool-invocation abuse as their own attack surface, which is a small, telling sign of how entangled the two standards are becoming in practice.

What changed since Agent Skills went cross-platform

The timeline matters here. Anthropic shipped Agent Skills as a Claude-specific feature on October 16, 2025. On December 18, 2025, it published the specification at agentskills.io as an open, vendor-neutral standard, with partner-built skills from Canva, Stripe, Notion, and Zapier available at launch. According to reporting at the time, Microsoft integrated it into VS Code and OpenAI added it to ChatGPT and Codex CLI within 48 hours of the announcement. Atlassian, Figma, and GitHub followed. The current count of compatible platforms sits above 26, spanning code assistants (Claude Code, GitHub Copilot, Cursor, Windsurf, Cline, Continue, Roo Code, Amazon Q Developer, Tabnine, Sourcegraph Cody, JetBrains AI), CLI agents (Codex CLI, Gemini CLI), autonomous agents (Devin, Replit Agent, SWE-agent, OpenHands), and frameworks (LangChain, CrewAI, AutoGen, Semantic Kernel, Haystack, the Vercel AI SDK).

What Anthropic-Cybersecurity-Skills demonstrates, eight months on, is that the standard's value wasn't just "install a Canva skill in ChatGPT." It's that a single motivated domain expert can produce a knowledge base large and structured enough to rival what a well-funded security vendor might ship as a product — and have it work identically across every tool on that list, with zero platform-specific engineering. That's a genuinely different distribution model than the one that preceded it, where a security-focused prompt library was, at best, a set of copy-pasteable strings tied to whichever chat interface you happened to be using.

Framing it against the field: VoltAgent's awesome-agent-skills index — a curated list the repo itself is featured in — reportedly tracks over 1,000 skills across all domains and publishers combined. If that figure is roughly accurate, one solo maintainer's cybersecurity library alone accounts for a meaningful fraction of the entire public Agent Skills catalog, in a single vertical, less than a year after the standard opened.

Six frameworks, one mapping problem solved (mostly)

The part of this repo that reads as genuinely load-bearing engineering, rather than content aggregation, is the framework mapping. Every skill's frontmatter can carry identifiers from up to six industry frameworks, applied selectively based on what the skill actually covers:

Framework	Version	What it covers	Skills mapped
MITRE ATT&CK	v19.1	Adversary behaviors and TTPs, 15 tactics	805
NIST CSF 2.0	2.0	Organizational security posture, 6 functions	804
MITRE D3FEND	v1.4.0	270 defensive countermeasures	139
NIST AI RMF	1.0	AI risk governance	97
MITRE F3 (Fight Fraud Framework)	v1.1	Cyber-enabled financial fraud	94
MITRE ATLAS	2026.07	AI/ML adversarial threats	93

The MITRE ATT&CK mapping is validated programmatically against the official mitreattack-python library, and the README claims zero revoked or deprecated technique IDs across 290 distinct techniques and sub-techniques — a level of rigor that's unusual for a community repo and that most enterprise security teams don't apply to their own internal runbooks. The most recent addition is MITRE F3, released April 9, 2026, by MITRE's Center for Threat-Informed Defense with backing from JPMorganChase, Citigroup, Lloyds Banking Group, and Standard Chartered — it fills a real gap ATT&CK doesn't cover (what happens after a fraud actor gets in: account takeover monetization, mule layering, synthetic-identity positioning), and its inclusion here, four months after F3 shipped, is a fast turnaround for a volunteer project.

The NIST AI RMF mapping has a specific, concrete payoff worth calling out: Colorado's AI Act, effective February 2026, provides a legal safe harbor for organizations that can demonstrate compliance with the NIST AI RMF. A skill library that ships pre-mapped AI RMF references isn't just a nice-to-have taxonomy — it's a starting point for an actual compliance artifact, assuming a legal team is willing to treat community-sourced mappings as a foundation rather than a finished product (more on that caveat below).

Why this should matter to developers who aren't in security

Even outside cybersecurity, the pattern here is the more interesting story than the repo itself. Three things compound:

Portability kills the rewrite tax. Before an open skills standard, building agent-usable domain knowledge meant picking a target platform and writing for it — a LangChain tool spec looks nothing like a custom GPT's instructions, which looks nothing like a Claude Project's knowledge files. A skill written against the agentskills.io spec runs, unmodified, in Claude Code and in Cursor and in Codex CLI. For a maintainer, that's the difference between building for one customer base and building for the entire agentic tooling market at once — which is very likely why one person was able to produce 817 of these and reach 29,000 stars instead of a few hundred.

Token economics change what's viable to bundle. The 30-token scan cost means an agent can carry knowledge of 817 procedures — or ten times that — without meaningfully taxing every request with unrelated context. That's a different design space than RAG-over-a-vector-store (retrieval quality and latency-dependent) or a giant system prompt (doesn't scale past a few dozen entries before context and cost balloon). Teams building internal agents for any structured-procedure domain — legal review checklists, SRE runbooks, compliance audits, onboarding workflows — have a template here for how to ship that knowledge cheaply.

Crowdsourced content is now a credible substitute for vendor content, at least in scale. Stripe, Notion, Canva, and Zapier shipped official skills at the standard's launch. A solo developer's community project now outweighs any single one of those in raw skill count, at least within cybersecurity. That's a genuine shift in where "authoritative" agent knowledge can plausibly come from — and it cuts both ways, which is the subject of the next section.

What the README doesn't fully reckon with

A few things are worth separating from the repo's own framing before anyone points an agent at this in production:

It ships offensive, dual-use content by design. The README is upfront about this — red-team C2 tooling, phishing simulation, exploitation techniques are explicitly included, with a warning to use them only against systems you own or have written authorization to test. That's the right disclaimer to have, but a disclaimer isn't an access control. Once a skill for, say, NTLM relay attacks or device-code phishing is npx skills add-installed into an agent, nothing in the Agent Skills format itself distinguishes "an authorized pentester's agent" from any other agent that happens to load the same package. The standard, as documented, doesn't appear to define a provenance or signing mechanism — installing a skill is a filesystem operation, not a verified supply chain.

The trust model is one person plus a 48-hour PR review promise. The README states every pull request is reviewed for technical accuracy and standard compliance within 48 hours — a self-reported process, not an independently audited one, run by a single maintainer across 817 technical procedures spanning cloud security, memory forensics, cryptography, and OT/ICS. That's an enormous surface for one reviewer to hold accurately, and the project's own "featured in" section — being cited by curated lists and a skills marketplace — doesn't substitute for a security audit of the workflows themselves. Nothing here suggests bad-faith content; it's simply an open question whether crowdsourced review catches subtle procedural errors in, say, an OT/ICS Modbus workflow the way a domain specialist team would.

The README also isn't purely the technical artifact it presents itself as. Mixed into the documentation are calls to action for an unrelated third-party product — a "Casky.ai" agent playground with waitlist sign-up, UTM-tagged links, and a token-reward incentive for completing a linked academic survey. None of that undermines the technical work, but it's a departure from how a pure open-source reference project usually reads, and worth noticing before treating every claim in the README with equal weight.

"26+ platforms" means format compatibility, not tested behavior. Any tool that implements the folder-plus-YAML-frontmatter convention can technically load these skills. Whether a given platform's agent reliably follows a 2,000-token Workflow section the way Claude Code does is untested and unclaimed by the README itself.

Competitive and ecosystem context

The Agent Skills standard's closest conceptual competitor is arguably not a rival open format but MCP — both emerged from Anthropic, both are now multi-vendor, and both get bundled together in most serious agent deployments rather than treated as either/or. The more direct comparison for this specific repo is the pre-standard status quo: security "cheat sheet" repos, wordlist and payload collections, and tool-specific prompt libraries that have existed for years but were never designed for an agent to select and execute autonomously. Anthropic-Cybersecurity-Skills is closer in spirit to a structured expert-system knowledge base — the kind that was expensive, bespoke, and mostly confined to defense contractors and threat-intel vendors a decade ago — repackaged into a format a $0 GitHub clone and any of two dozen agent tools can consume immediately.

The independent read

The genuinely notable thing here isn't the repo's size — GitHub has plenty of large lists. It's that the size and structure were achievable by one person specifically because the underlying format removed the platform-lock-in tax that used to make this kind of investment only make sense for a company with a distribution channel already built. Anthropic didn't just open a spec; it changed the economics of who can profitably build agent-facing domain knowledge, and the ROI showed up fastest in a domain — cybersecurity — that already had well-documented, framework-driven procedures ready to be reformatted rather than invented from scratch. That's a repeatable playbook: any field with existing structured methodology (clinical protocols, financial audit procedures, engineering runbooks) is a candidate for the same move, and the barrier to entry is now "one motivated domain expert with a weekend," not "a funded team and a distribution deal."

The unresolved part is governance. An open standard with no central content review is exactly the kind of system that scales fast and then has a bad week — a subtly wrong forensics procedure, a compliance mapping that's stale against a framework revision, an exploitation technique with an unclear authorization boundary, surfacing in production because an agent picked it up automatically. Nothing about this specific repo has shown that failure mode yet. But 817 skills reviewed by one person in 48-hour windows is a bet that hasn't been stress-tested at scale, and the standard itself doesn't yet supply the tooling — signing, provenance, independent audit trails — that would catch it if it happens.

Who should actually use this

Security teams already running agent-assisted SOC, DFIR, or pentest workflows in sandboxed or explicitly authorized environments have a legitimate reason to pilot this now — the framework mapping alone (particularly ATT&CK and NIST CSF) saves real time over hand-rolling agent prompts from scratch, and the progressive-disclosure structure means adding it costs almost nothing in context budget even if an agent only ends up using a handful of the 817 skills. Compliance and GRC teams eyeing the NIST AI RMF mapping for something like the Colorado AI Act safe harbor should treat it as a first draft, not a finished compliance artifact, and get it reviewed by counsel and an internal security architect before relying on it. Teams building agents for regulated, high-consequence domains outside security — healthcare, finance, critical infrastructure — should watch this as a proof of concept for the pattern, not necessarily adopt this specific repo. And anyone not currently building or deploying AI agents that touch security workflows can safely ignore it entirely; there's nothing here that changes how you'd use Claude, Copilot, or Cursor for ordinary software work.

What would actually change the calculus on trust here — a MITRE-endorsed review process, a signed-skill mechanism baked into the agentskills.io spec, a corporate sponsor taking over maintenance — none of that exists yet. Whether the ecosystem builds it before or after the first bad incident is the open question worth watching.

Discussion: If Agent Skills' progressive-disclosure model is enough to let an agent index 817+ procedural skills for a few tokens of overhead, what's actually stopping teams from shipping ten times that many, across every internal domain — is it a tooling gap, a governance gap, or just that most organizations haven't inventoried their own tribal knowledge into a structured-enough form to convert yet?

Sources:

DEV Community