Uses Falco YAML rules for runtime threat detection in containers and Kubernetes, monitoring syscalls for shell spawns, file tampering, network anomalies, and privilege escalation. Manages Falco rules via the Falco gRPC API and parses Falco alert output. Use when building container runtime security or investigating k8s cluster compromises.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-cloud-native-forensics-with-falconpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-cloud-native-forensics-with-falco -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-cloud-native-forensics-with-falco -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/performing-cloud-native-forensics-with-falcogh skill install mukul975/Anthropic-Cybersecurity-Skills performing-cloud-native-forensics-with-falcogit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/performing-cloud-native-forensics-with-falco ~/.claude/skills/performing-cloud-native-forensics-with-falco # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/performing-cloud-native-forensics-with-falco ~/.agents/skills/performing-cloud-native-forensics-with-falco # Codex, Cursor, Gemini CLI, Copilot, OpenCode