Detect unauthorized SaaS and cloud service usage (shadow IT) by parsing proxy access logs, DNS query logs, and firewall/netflow data with Python pandas to aggregate traffic by domain, classify domains against known SaaS categories, and score risk by data volume and user count.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-shadow-it-cloud-usagenpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-shadow-it-cloud-usage -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-shadow-it-cloud-usage -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/detecting-shadow-it-cloud-usagegh skill install mukul975/Anthropic-Cybersecurity-Skills detecting-shadow-it-cloud-usagegit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-shadow-it-cloud-usage ~/.claude/skills/detecting-shadow-it-cloud-usage # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-shadow-it-cloud-usage ~/.agents/skills/detecting-shadow-it-cloud-usage # Codex, Cursor, Gemini CLI, Copilot, OpenCode