Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add HermeticOrmus/LibreSecOps-Claude-Code --skill mitre-attack-frameworkgit clone --depth 1 https://github.com/HermeticOrmus/LibreSecOps-Claude-CodeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hermeticormus/libresecops-claude-code/mitre-attack-framework)<a href="https://agentmods.dev/skills/hermeticormus/libresecops-claude-code/mitre-attack-framework"><img src="https://agentmods.dev/badge/skills/hermeticormus/libresecops-claude-code/mitre-attack-framework/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hermeticormus/libresecops-claude-code/mitre-attack-framework"><img src="https://agentmods.dev/badge/skills/hermeticormus/libresecops-claude-code/mitre-attack-framework.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00049 | $0.02585 |
| Opus 5.5 | $0.00020 | $0.01034 |
| Sonnet 5.5 | $0.00010 | $0.00517 |
| Haiku 4.5 | $0.00005 | $0.00259 |
Grade A, and why
mitre-attack-framework scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 199 lines — stays where its author put it; the contents beside it link to each section on GitHub.
MITRE ATT&CK Framework
Reference knowledge covering ATT&CK Enterprise tactics, selected key techniques with detection guidance, and framework usage for adversary emulation planning.
Knowledge Base
What is MITRE ATT&CK
MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a globally accessible knowledge base of adversary behavior based on real-world observations. It catalogs the TTPs (Tactics, Techniques, and Procedures) used by threat actors, organized into a matrix that maps the phases of an attack lifecycle.
ATT&CK serves both offense and defense:
- Red teams use it to plan realistic adversary emulations.
- Blue teams use it to build detections, measure coverage, and prioritize gaps.
- Threat intelligence uses it as a common language for describing adversary behavior.
Enterprise ATT&CK Tactics (v15)
The 14 tactics represent the adversary's tactical objectives -- the "why" behind each action:
| ID | Tactic | Purpose | Example Question |
|---|---|---|---|
| TA0043 | Reconnaissance | Gather info for targeting | What is exposed on the internet? |
| TA0042 | Resource Development | Build attack infrastructure | Set up C2, acquire tools, create accounts |
| TA0001 | Initial Access | Get into the network | Phishing, exploiting public-facing apps |
| TA0002 | Execution | Run adversary code | PowerShell, WMI, command line |
| TA0003 | Persistence | Maintain access across restarts | Registry run keys, scheduled tasks, implants |
| TA0004 | Privilege Escalation | Get higher permissions | Exploit vulnerabilities, token manipulation |
| TA0005 | Defense Evasion | Avoid detection | Obfuscation, disabling security tools, timestomping |
| TA0006 | Credential Access | Steal credentials | Keylogging, dumping LSASS, Kerberoasting |
| TA0007 | Discovery | Learn about the environment | Network scanning, account enumeration |
| TA0008 | Lateral Movement | Move through the network | RDP, SMB, WinRM, Pass-the-Hash |
| TA0009 | Collection | Gather target data | Keylogging, screen capture, email collection |
| TA0011 | Command and Control | Communicate with implants | HTTPS C2, DNS tunneling, encrypted channels |
| TA0010 | Exfiltration | Steal data out | Cloud storage upload, encrypted channels |
| TA0040 | Impact | Disrupt, destroy, manipulate | Ransomware encryption, data destruction, defacement |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago Changed · +5 lines · +49 tokens per session ed2c2f643af6
- 1mo ago First seen · 194 lines · 0 tokens per session scan A cb690f2dd47d
mitre-attack-framework is a skill published in the GitHub repository HermeticOrmus/LibreSecOps-Claude-Code (4 stars, last pushed 9d ago), licensed MIT. It adds 49 tokens to every session and 2,585 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
implementing-devsecops-security-scanning
Integrates Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) into CI/CD pipelines using open-source tools. Covers Semgrep for SAST, Trivy for SCA and container scanning, OWASP ZAP for DAST, and Gitleaks for secrets detection. Activates for…
building-devsecops-pipeline-with-gitlab-ci
Design and implement a comprehensive DevSecOps pipeline in GitLab CI/CD integrating SAST, DAST, container scanning, dependency scanning, and secret detection.
integrating-dast-with-owasp-zap-in-pipeline
This skill covers integrating OWASP ZAP (Zed Attack Proxy) for Dynamic Application Security Testing in CI/CD pipelines. It addresses configuring baseline, full, and API scans against running applications, interpreting ZAP findings, tuning scan policies, and establishing DAST quality gates in GitHub Actions and GitLab…
implementing-runtime-application-self-protection
Deploy Runtime Application Self-Protection (RASP) agents to detect and block attacks from within application runtime, covering OpenRASP integration, attack pattern detection, and security policy configuration for Java and Python web applications.
integrating-dast-with-owasp-zap-in-pipeline
This skill covers integrating OWASP ZAP (Zed Attack Proxy) for Dynamic Application Security Testing in CI/CD pipelines. It addresses configuring baseline, full, and API scans against running applications, interpreting ZAP findings, tuning scan policies, and establishing DAST quality gates in GitHub Actions and GitLab…
audit-production-readiness
Audit a repository or service for release-blocking bugs, security, data/privacy, AI-agent, supply-chain, operability, and scale risks. Use for deep code audits, threat models, pre-production reviews, vulnerability triage, incidents, defensive investigation, release gates, or evidence-based 10k-to-1M-user readiness.