Skill

mapping-mitre-attack-techniques

skill:mukul975/anthropic-cybersecurity-skills#mapping-mitre-attack-techniques

Maps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and guide control prioritization. Use when building an ATT&CK-based coverage heatmap, tagging SIEM alerts with technique IDs, aligning security controls to adversary playbooks, or reporting threat exposure to executives. Activates for requests involving ATT&CK Navigator, Sigma rules, MITRE D3FEND, or coverage gap analysis.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 21:52 UTC at 54a7988

findings

medium

highest severity

threat classes

4,532

files scanned

74/74

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:skills/mapping-mitre-attack-techniques:skills/mapping-mitre-attack-techniques/SKILL.md:74:SUPPLY

Security findings 1

Supply chain

mediumContextual risklow confidence

The skill instructs the agent to download the ATT&CK STIX data bundle via curl from the unpinned mutable master branch of raw.githubusercontent.com into the workspace, where agent.py then parses it, so the dataset the analysis consumes can change silently at any time (data only; it is parsed as JSON, not executed, and DET:6b8ac6fc96a01a66's EXFIL framing is not supported since nothing local is sent).

skills/mapping-mitre-attack-techniques/SKILL.md:74-75

https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json

vector:instruction

Counter-argument considered

Refutation fails on all four gates: the curl instruction sits in the skill body agents execute, the fetch is from an unpinned mutable master ref (not a pinned official-registry install carve-out), the network access appears nowhere in the declared description, and the downloaded file is wired directly into the analysis via the shown mitreattack-python parse, so the low-severity data-integrity supply concern stands. The finding correctly disavows the DET lead's EXFIL framing, and its agent.py detail is unsupported by the shown evidence (the parsing instruction is in SKILL.md itself), but neither point kills the core claim.