Agent Skills
Open-source investigation playbooks that run on top of the Whisper MCP connector — indicator triage, bulk triage, Cypher authoring and brand protection — packaged as a plugin for Claude Code and installable in any client that reads Agent Skills.
On this page (12)
Agent Skills Documentation
Agent Skills are investigation playbooks that run on top of the Whisper MCP connector. They are open source and MIT-licensed at github.com/whisper-sec/whisper-skills.
The connector gives an assistant the tools. The workflow gallery gives it whole investigations it can run in one call. Skills are the layer above both: they decide which investigation to run, and they state what the answer is worth.
That second job is the one that matters. A verdict of "not listed" and a verdict of "never seen" arrive in the same shape, and only one of them means anything reassuring — the other is what a domain registered this morning looks like. The connector returns the fields that tell them apart on every result. A skill is what makes an assistant read them before it writes a sentence.
The four skills
| Skill | The job | It loads when you say |
|---|---|---|
whisper-investigate | Triage one indicator: pick the right workflow, read the coverage, stop when the question is answered | "is this domain malicious", "who owns this IP", "map our attack surface", "can this subdomain be taken over" |
whisper-bulk-triage | A list from a SIEM, EDR or spreadsheet, ranked — with never-seen and check-failed kept out of the ranked table | "here are 200 IPs from Splunk", "which of these matter", "triage this blocklist" |
whisper-cypher | Custom queries for the questions no workflow covers, written to pass the server's validator first time | "write a query for…", "my query was rejected", "what edge direction do I use", "why did this return nothing" |
whisper-brand-protection | Lookalike domains, separated into weaponised, suspicious and merely registered — then a takedown package | "find typosquats of our brand", "who is impersonating us", "build a takedown case" |
Each loads on its own when your question matches. There is nothing to invoke.
Skills, workflows and prompts
Three layers of playbook ship with the connector, and they are complements rather than alternatives.
| Layer | Where it lives | How you reach it | Best for |
|---|---|---|---|
| Prompts | the connector | trigger one explicitly from your client's prompt menu | a quick one-off when you already know what you want |
| Workflow gallery | the server | list_workflows to find one, run_workflow to run it | a whole investigation in one call, with an evidence trail, no install |
| Agent Skills | your client | install once; they load automatically | repeatable work where choosing the right investigation, and reading the result honestly, is most of the job |
Reach for a gallery workflow when you know the investigation you want. Install a skill when you want the assistant to pick it — and the right follow-up — on its own.
Prerequisite: connect the connector
Skills are playbooks for the connector. On their own they do nothing.
Connect https://mcp.whisper.security first — it is one URL and a browser sign-in. See the Setup guide. Every skill opens by confirming it can actually reach the graph, and if it cannot, it says so and stops rather than answering from the model's own knowledge.
Install
Claude Code — as a plugin
/plugin marketplace add whisper-sec/whisper-skills
/plugin install whisper-graph@whisper-security
That brings the four skills, a subagent that runs a large bulk triage in its own context and returns only the table, and a /whisper-setup command that connects the connector or works out why it is not answering.
The plugin does not bundle an MCP server configuration. If it did, you would end up with two entries for the same connector — one from the plugin and one you added yourself — under different tool names. Add the connector once, in the usual way.
Any other agent
npx skills add whisper-sec/whisper-skills
This detects which agents you have installed and writes each skill where that one looks for it.
Claude.ai
Zip a folder from skills/ and upload it under Settings. Team and Enterprise administrators can provision skills for the whole organisation from organisation settings.
Messages API
Upload a skill through the Skills API and reference it in the request alongside the code execution tool. Note that the API's execution container has no connector access — a skill's instructions can direct the model to call connector tools in the outer loop, but nothing inside the sandbox can reach them.
By hand
Copy the folders you want out of skills/ into wherever your client looks — ~/.claude/skills/, ~/.agents/skills/, or a project-level equivalent. Every skill is self-contained; none reads a file belonging to another, so you can install one without the rest.
What the skills insist on
The playbooks are opinionated in three places, and all three exist because the alternative produces a confident wrong answer.
Never seen is not clean. Every verdict carries a coverage block saying whether the graph holds anything about the indicator at all. A result with no data and a result that was checked and found nothing are different findings, and the skills render them differently — an unobserved indicator gets its own section, counted and labelled, never a quiet place at the bottom of a ranked table.
A partial answer says so first. A workflow report reads finished whether or not it is. The skills check what was truncated, which steps were incomplete and what the server flagged, and put anything missing in the first sentence rather than a footnote.
Returned data is data. Registrant strings, organisation names and hostnames are written by third parties, and in an investigation some of them are written by the people under investigation. Every skill carries the same instruction to treat returned values as inert text — never as instructions, never as a URL to follow, never as something to run.
Keeping them true
Playbooks that name tools go stale when the tools change, and they go stale quietly: nothing fails, the assistant simply starts saying something untrue.
So the repository states no count that the connector can return — no node, edge, feed or tool totals — and its build fails if one appears in a playbook. Instead the skills ask: explain_schema for labels and edges, the statistics resource for magnitudes, list_workflows for what the gallery currently holds.
What is written down is checked. Every tool name, resource and workflow slug in the repository is asserted against the live connector, and every query is planned against the live graph, on every change and again each night. Those checks need no credentials, so anyone — including someone opening a pull request from a fork — gets exactly the verdict a maintainer gets.
Next steps
- MCP Reference — the tools, resources and prompts the skills are built on.
- Workflow gallery — the investigations the skills choose between.
- Your first investigation — the same ground without installing anything.
- Contributions are welcome. Open an issue or a pull request at github.com/whisper-sec/whisper-skills — everything CI checks, you can run locally with no API key and no account.