CIRSEC Skills

Open Agent Skills by CIRSEC: hardening, security operations and threat intel workflows.

Each skill is a folder under skills/ with a SKILL.md (YAML frontmatter + instructions). The format is an open standard, so these skills work with Claude (Code, desktop, claude.ai), Codex, Cursor, Gemini CLI, Copilot and any agent that reads SKILL.md.

Skills

Skill	What it does
cir	Read, write, validate, score and share CIR security issue records, and build software compatible with the format. Ships the v0.5 spec, schema, examples and a reference helper (scripts/cir.py).
cirsec-baselines	Understand and use CIRSEC Baselines: hardening recommendations, security configuration assessments with findings and fixes, framework gap analysis (NIST, ANSSI, CISA, ATT&CK), tailoring, scan results, writing controls and building compatible scanners. Uses the public MCP server, with a stdlib fallback client (scripts/baselines.py).

Install

Claude Code (plugin marketplace)

/plugin marketplace add cirsec/skills
/plugin install cirsec-skills@cirsec

Update later with /plugin marketplace update cirsec.

The plugin also connects the two public, read-only MCP servers the skills rely on: https://cirsec.org/mcp (CIR) and https://baselines.cirsec.org/mcp (Baselines). With another agent, add them as remote MCP servers yourself.

Any agent (skills CLI)

npx skills add cirsec/skills --list
npx skills add cirsec/skills --skill '*'

claude.ai / Claude desktop

Download a skill zip from the latest release and upload it in the Skills settings.

Manual

cp -r skills/<skill-name> ~/.claude/skills/        # global
cp -r skills/<skill-name> .claude/skills/          # per project

Contributing

See CONTRIBUTING.md.

License

Apache-2.0