Skill

analyzing-cyber-kill-chain

skill:mukul975/anthropic-cybersecurity-skills#analyzing-cyber-kill-chain

Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases an adversary has completed, where defenses succeeded or failed, and what controls would have interrupted the attack at earlier phases. Use when conducting post-incident analysis, building prevention-focused security controls, or mapping detection gaps to kill chain phases. Activates for requests involving kill chain analysis, intrusion kill chain, attack phase mapping, or Lockheed Martin kill chain framework.

skills.sh SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 21:53 UTC at 54a7988

findings

high

highest severity

threat classes

4,532

files scanned

78/78

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:skills/analyzing-cyber-kill-chain:skills/analyzing-cyber-kill-chain/references/api-reference.md:43:EXFIL

Security findings 1

Data exfiltration

highContextual risklow confidence

The API reference instructs the agent to POST a locally generated ATT&CK Navigator layer file to the external host mitre-attack.github.io, sending locally produced analysis data off-host to an undeclared network destination, though the destination appears to be the official MITRE Navigator service consistent with the skill's declared Navigator workflow.

skills/analyzing-cyber-kill-chain/references/api-reference.md:43

curl -X POST https://mitre-attack.github.io/attack-navigator/api/layers

vector:instruction

Counter-argument considered

Strongest case against: the destination is the official MITRE Navigator host and the payload is a generated layer file, suggesting a benign, standard workflow; strongest case for: the declared description covers only local kill-chain analysis and mapping, never Navigator exports or any network destination, so this is undeclared egress of locally produced analysis data with a concrete curl instruction, and no listed carve-out (installs, wrapped-service keys, etc.) applies to posting data to an external host. The finding survives at its contextual/low severity.