# Analyzing Indicators Of Compromise (agent skill)

> Analyzing Indicators Of Compromise is an agent skill (a SKILL.md file) from mukul975/Anthropic-Cybersecurity-Skills. Analyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to determine maliciousness confidence, campaign attribution… It works with Claude Code, Codex, Cursor, Gemini CLI and GitHub Copilot and has 35,033 GitHub stars across a repository of 6 listed skills.

Analyzes indicators of compromise (IOCs) including IP addresses, domains, file hashes, URLs, and email artifacts to determine maliciousness confidence, campaign attribution, and blocking priority. Use when triaging IOCs from phishing emails, security alerts, or external threat feeds; enriching raw IOCs with multi-source intelligence; or making block/monitor/whitelist decisions. Activates for requests involving VirusTotal, AbuseIPDB, MalwareBazaar, MISP, or IOC enrichment pipelines.

## Key facts

| Fact | Value |
|---|---|
| Repository | https://github.com/mukul975/Anthropic-Cybersecurity-Skills |
| Skill path | skills/analyzing-indicators-of-compromise/SKILL.md |
| Skill name | analyzing-indicators-of-compromise |
| GitHub stars | 35,033 |
| Installs on skills.sh | not listed |
| License | Apache-2.0 |
| Skills in repo | 6 |
| Plugin marketplace | anthropic-cybersecurity-skills |
| Official | no |
| Works with | Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot |
| Category | Security |
| Last commit | Aug 31, 2026 |

## When it triggers

- Use when triaging IOCs from phishing emails, security alerts, or external threat feeds; enriching raw IOCs with multi-source intelligence; or making block/monitor/whitelist decisions.
- Activates for requests involving VirusTotal, AbuseIPDB, MalwareBazaar, MISP, or IOC enrichment pipelines.

## Add this skill

### Claude Code

```sh
/plugin marketplace add mukul975/Anthropic-Cybersecurity-Skills
/plugin install cybersecurity-skills@anthropic-cybersecurity-skills
```

In the Claude apps, zip the skill folder and upload it under Customize > Skills > + > Upload a skill (code execution must be on).

### ChatGPT / Codex

```sh
git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
cp -r Anthropic-Cybersecurity-Skills/skills/analyzing-indicators-of-compromise .agents/skills/analyzing-indicators-of-compromise   # repo; ~/.agents/skills for all projects
```

### Cursor

```sh
git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
cp -r Anthropic-Cybersecurity-Skills/skills/analyzing-indicators-of-compromise .cursor/skills/analyzing-indicators-of-compromise   # project; ~/.cursor/skills for all projects
```

Sources (checked 2026-10-07): https://code.claude.com/docs/en/skills, https://support.claude.com/en/articles/12512180-using-skills-in-claude, https://learn.chatgpt.com/docs/build-skills, https://cursor.com/docs/context/skills

---

Canonical page: https://appsgit.com/skills/mukul975-analyzing-indicators-of-compromise
Source: appsgit (https://appsgit.com), the app store for github. Data from the GitHub API, refreshed daily.
Machine access: JSON API https://appsgit.com/api/v1/apps (OpenAPI: https://appsgit.com/openapi.json), MCP server https://mcp.appsgit.com/mcp, full index https://appsgit.com/llms-full.txt.