fix: #712

Import Anthropic Cybersecurity Skills Library (754 skills, 26 domains, 5 frameworks).

Added:
- scripts/import_cybersecurity_skills.py — import script
- docs/cybersecurity-skills.md — documentation

Features:
- Import all 754 skills or filter by domain/framework
- List available domains and frameworks
- Dry-run mode
- Generate index.json

Closes #712

docs/cybersecurity-skills.md

@@ -0,0 +1,134 @@
+# Anthropic Cybersecurity Skills Integration
+
+Import and use the Anthropic Cybersecurity Skills library (754 skills, 26 domains, 5 frameworks) with Hermes Agent.
+
+## Overview
+
+The Anthropic Cybersecurity Skills library provides 754 production-grade security skills for AI agents. Each skill follows the agentskills.io standard with YAML frontmatter and structured decision-making workflows.
+
+## Source
+
+- **Repository:** https://github.com/mukul975/Anthropic-Cybersecurity-Skills
+- **License:** Apache 2.0
+- **Stars:** 4,385
+- **Compatible:** Hermes Agent, Claude Code, GitHub Copilot, Codex CLI
+
+## Quick Start
+
+```bash
+# Import all skills
+python scripts/import_cybersecurity_skills.py
+
+# Import by domain
+python scripts/import_cybersecurity_skills.py --domain cloud-security
+
+# Import by framework
+python scripts/import_cybersecurity_skills.py --framework nist-csf
+
+# List available domains
+python scripts/import_cybersecurity_skills.py --list-domains
+
+# List available frameworks
+python scripts/import_cybersecurity_skills.py --list-frameworks
+
+# Dry run (show what would be imported)
+python scripts/import_cybersecurity_skills.py --dry-run
+```
+
+## Security Domains (26)
+
+| Domain | Skills | Key Capabilities |
+|--------|--------|-----------------|
+| Cloud Security | 60 | AWS, Azure, GCP hardening, CSPM, cloud forensics |
+| Threat Hunting | 55 | Hypothesis-driven hunts, LOTL detection, behavioral analytics |
+| Threat Intelligence | 50 | STIX/TAXII, MISP, feed integration, actor profiling |
+| Web App Security | 42 | OWASP Top 10, SQLi, XSS, SSRF, deserialization |
+| Network Security | 40 | IDS/IPS, firewall rules, VLAN segmentation |
+| Malware Analysis | 39 | Static/dynamic analysis, reverse engineering, sandboxing |
+| Digital Forensics | 37 | Disk imaging, memory forensics, timeline reconstruction |
+| Security Operations | 36 | SIEM correlation, log analysis, alert triage |
+| IAM | 35 | IAM policies, PAM, zero trust, Okta, SailPoint |
+| SOC Operations | 33 | Playbooks, escalation workflows, tabletop exercises |
+| Container Security | 30 | K8s RBAC, image scanning, Falco, container forensics |
+| OT/ICS Security | 28 | Modbus, DNP3, IEC 62443, SCADA |
+| API Security | 28 | GraphQL, REST, OWASP API Top 10, WAF bypass |
+| Vulnerability Management | 25 | Nessus, scanning workflows, CVSS |
+| Incident Response | 25 | Breach containment, ransomware response, IR playbooks |
+| Red Teaming | 24 | Full-scope engagements, AD attacks, phishing simulation |
+| Penetration Testing | 23 | Network, web, cloud, mobile, wireless |
+| Endpoint Security | 17 | EDR, LOTL detection, fileless malware |
+| DevSecOps | 17 | CI/CD security, code signing, Terraform auditing |
+| Phishing Defense | 16 | Email auth, BEC detection, phishing IR |
+| Cryptography | 14 | Key management, TLS, certificate analysis |
+
+## Framework Mappings (5)
+
+| Framework | Version | Scope |
+|-----------|---------|-------|
+| MITRE ATT&CK | v18 | 14 tactics, 200+ techniques |
+| NIST CSF 2.0 | 2.0 | 6 functions, 22 categories |
+| MITRE ATLAS | v5.4 | 16 tactics, 84 techniques |
+| MITRE D3FEND | v1.3 | 7 categories, 267 techniques |
+| NIST AI RMF | 1.0 | 4 functions, 72 subcategories |
+
+## Skill Format
+
+Each skill follows the agentskills.io standard:
+
+```yaml
+---
+name: analyzing-active-directory-acl-abuse
+description: Detect dangerous ACL misconfigurations in Active Directory
+domain: cybersecurity
+subdomain: identity-security
+tags:
+  - active-directory
+  - acl-abuse
+  - ldap
+version: '1.0'
+author: mahipal
+license: Apache-2.0
+nist_csf:
+  - PR.AA-01
+  - PR.AA-05
+  - PR.AA-06
+---
+```
+
+## Use Cases for Hermes
+
+1. **Fleet security** — Agents can audit their own infrastructure
+2. **Incident response** — Structured IR playbooks for security events
+3. **Threat hunting** — Hypothesis-driven hunts across fleet logs
+4. **Compliance** — Framework-mapped skills for audit preparation
+5. **Training** — Security skills for agents to learn and apply
+
+## Integration with Hermes Skills
+
+The imported skills are compatible with Hermes Agent's skill system:
+
+```bash
+# Skills are installed to ~/.hermes/skills/cybersecurity/
+# Each skill has a SKILL.md file with YAML frontmatter
+
+# Use in Hermes
+hermes skills list | grep cybersecurity
+hermes skills enable cybersecurity/cloud-security
+```
+
+## Adding to Fleet
+
+```bash
+# Import all skills
+python scripts/import_cybersecurity_skills.py
+
+# Import specific domain for fleet security
+python scripts/import_cybersecurity_skills.py --domain incident-response
+
+# Import for compliance
+python scripts/import_cybersecurity_skills.py --framework nist-csf
+```
+
+## Index
+
+After import, an index is generated at `~/.hermes/skills/cybersecurity/index.json` listing all installed skills with their metadata.

scripts/import_cybersecurity_skills.py

@@ -0,0 +1,245 @@
+#!/usr/bin/env python3
+"""
+import_cybersecurity_skills.py — Import Anthropic Cybersecurity Skills Library
+
+Downloads and integrates the Anthropic Cybersecurity Skills library into
+Hermes Agent's skill system.
+
+Source: https://github.com/mukul975/Anthropic-Cybersecurity-Skills
+License: Apache 2.0
+Skills: 754 across 26 security domains, 5 frameworks
+
+Usage:
+    python scripts/import_cybersecurity_skills.py
+    python scripts/import_cybersecurity_skills.py --domain cloud-security
+    python scripts/import_cybersecurity_skills.py --framework nist-csf
+"""
+
+import argparse
+import json
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+import urllib.request
+from pathlib import Path
+from typing import List, Dict, Any
+
+# Configuration
+REPO_URL = "https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git"
+SKILLS_DIR = Path.home() / ".hermes" / "skills" / "cybersecurity"
+CACHE_DIR = Path.home() / ".hermes" / "cache" / "cybersecurity-skills"
+
+# Framework mappings
+FRAMEWORKS = {
+    "mitre-attack": "MITRE ATT&CK v18",
+    "nist-csf": "NIST CSF 2.0",
+    "mitre-atlas": "MITRE ATLAS v5.4",
+    "mitre-d3fend": "MITRE D3FEND v1.3",
+    "nist-ai-rmf": "NIST AI RMF 1.0",
+}
+
+# Security domains
+DOMAINS = [
+    "cloud-security", "threat-hunting", "threat-intelligence",
+    "web-app-security", "network-security", "malware-analysis",
+    "digital-forensics", "security-operations", "iam",
+    "soc-operations", "container-security", "ot-ics-security",
+    "api-security", "vulnerability-management", "incident-response",
+    "red-teaming", "penetration-testing", "endpoint-security",
+    "devsecops", "phishing-defense", "cryptography",
+]
+
+
+def clone_repo(target_dir: Path) -> bool:
+    """Clone the cybersecurity skills repository."""
+    print(f"Cloning {REPO_URL}...")
+    try:
+        subprocess.run(
+            ["git", "clone", "--depth", "1", REPO_URL, str(target_dir)],
+            check=True,
+            capture_output=True,
+        )
+        return True
+    except subprocess.CalledProcessError as e:
+        print(f"Error cloning repository: {e}", file=sys.stderr)
+        return False
+
+
+def parse_skill_file(skill_path: Path) -> Dict[str, Any]:
+    """Parse a skill YAML/Markdown file."""
+    content = skill_path.read_text(encoding="utf-8")
+    
+    # Extract YAML frontmatter
+    if content.startswith("---"):
+        parts = content.split("---", 2)
+        if len(parts) >= 3:
+            import yaml
+            try:
+                metadata = yaml.safe_load(parts[1])
+                metadata["content"] = parts[2].strip()
+                metadata["path"] = str(skill_path)
+                return metadata
+            except Exception:
+                pass
+    
+    # Fallback: use filename as name
+    return {
+        "name": skill_path.stem,
+        "description": content[:200],
+        "content": content,
+        "path": str(skill_path),
+    }
+
+
+def find_skills(repo_dir: Path, domain: str = None, framework: str = None) -> List[Path]:
+    """Find skill files in the repository."""
+    skills = []
+    
+    # Look for skills in common locations
+    search_dirs = [
+        repo_dir / "skills",
+        repo_dir / "cybersecurity",
+        repo_dir,
+    ]
+    
+    for search_dir in search_dirs:
+        if not search_dir.exists():
+            continue
+        
+        for path in search_dir.rglob("*.md"):
+            # Skip README files
+            if path.name.upper() == "README.MD":
+                continue
+            
+            # Filter by domain if specified
+            if domain:
+                if domain.lower() not in str(path).lower():
+                    continue
+            
+            # Filter by framework if specified
+            if framework:
+                content = path.read_text(encoding="utf-8", errors="ignore").lower()
+                if framework.lower() not in content:
+                    continue
+            
+            skills.append(path)
+    
+    return skills
+
+
+def install_skills(skills: List[Path], target_dir: Path) -> int:
+    """Install skills to Hermes skill directory."""
+    target_dir.mkdir(parents=True, exist_ok=True)
+    
+    installed = 0
+    for skill_path in skills:
+        skill = parse_skill_file(skill_path)
+        name = skill.get("name", skill_path.stem)
+        
+        # Create skill directory
+        skill_dir = target_dir / name
+        skill_dir.mkdir(exist_ok=True)
+        
+        # Copy skill file
+        dest = skill_dir / "SKILL.md"
+        shutil.copy2(skill_path, dest)
+        
+        installed += 1
+    
+    return installed
+
+
+def generate_index(skills_dir: Path) -> Dict[str, Any]:
+    """Generate an index of installed skills."""
+    index = {
+        "source": "Anthropic Cybersecurity Skills Library",
+        "url": REPO_URL,
+        "license": "Apache-2.0",
+        "skills": [],
+    }
+    
+    for skill_dir in skills_dir.iterdir():
+        if not skill_dir.is_dir():
+            continue
+        
+        skill_file = skill_dir / "SKILL.md"
+        if not skill_file.exists():
+            continue
+        
+        skill = parse_skill_file(skill_file)
+        index["skills"].append({
+            "name": skill.get("name", skill_dir.name),
+            "description": skill.get("description", "")[:200],
+            "domain": skill.get("domain", ""),
+            "frameworks": skill.get("frameworks", []),
+        })
+    
+    return index
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Import Anthropic Cybersecurity Skills")
+    parser.add_argument("--domain", "-d", help="Filter by security domain")
+    parser.add_argument("--framework", "-f", help="Filter by framework (e.g., nist-csf)")
+    parser.add_argument("--list-domains", action="store_true", help="List available domains")
+    parser.add_argument("--list-frameworks", action="store_true", help="List available frameworks")
+    parser.add_argument("--output", "-o", help="Output directory for skills")
+    parser.add_argument("--dry-run", action="store_true", help="Show what would be imported")
+    
+    args = parser.parse_args()
+    
+    # List domains
+    if args.list_domains:
+        print("Available security domains:")
+        for domain in DOMAINS:
+            print(f"  - {domain}")
+        return
+    
+    # List frameworks
+    if args.list_frameworks:
+        print("Available frameworks:")
+        for key, name in FRAMEWORKS.items():
+            print(f"  - {key}: {name}")
+        return
+    
+    # Set output directory
+    output_dir = Path(args.output) if args.output else SKILLS_DIR
+    
+    # Clone repository
+    with tempfile.TemporaryDirectory() as tmpdir:
+        repo_dir = Path(tmpdir) / "cybersecurity-skills"
+        
+        if not clone_repo(repo_dir):
+            sys.exit(1)
+        
+        # Find skills
+        print(f"Searching for skills (domain={args.domain}, framework={args.framework})...")
+        skills = find_skills(repo_dir, args.domain, args.framework)
+        print(f"Found {len(skills)} skills")
+        
+        if args.dry_run:
+            print("\nDry run — skills that would be imported:")
+            for skill_path in skills[:20]:
+                skill = parse_skill_file(skill_path)
+                print(f"  - {skill.get('name', skill_path.stem)}: {skill.get('description', '')[:60]}...")
+            if len(skills) > 20:
+                print(f"  ... and {len(skills) - 20} more")
+            return
+        
+        # Install skills
+        print(f"Installing to {output_dir}...")
+        installed = install_skills(skills, output_dir)
+        print(f"Installed {installed} skills")
+        
+        # Generate index
+        index = generate_index(output_dir)
+        index_path = output_dir / "index.json"
+        with open(index_path, "w") as f:
+            json.dump(index, f, indent=2)
+        print(f"Index saved to {index_path}")
+
+
+if __name__ == "__main__":
+    main()