Guide · Agent skill
How to use the ICS Anomaly Detection agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains the detecting-anomalies-in-industrial-control-systems skill, a playbook that teaches an AI agent how to watch OT and ICS networks for unusual behavior. It is written for readers who have not used agent skills before. By the end you will know what the skill does, how to install it, how to ask for it in plain language, and what you need before relying on it.
ICS Anomaly Detectionmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download the ZIP. Get the skill ZIP from this page.
- 2Unzip into the skills folder. Place the folder in ~/.claude/skills/ for personal use or .claude/skills/ inside a project.
- 3Or upload in the Claude apps. Go to Settings → Capabilities → Skills and upload the skill.
- 4Install optional packages. Run pip install pymodbus if you plan to use the device scan script, and confirm Python 3.9+ with scikit-learn, numpy, pandas and requests.
- 5Prepare your capture. Confirm passive sensors on SPAN/TAP ports and 2 to 4 weeks of normal-operation traffic.
- 6Ask for an analysis. Describe the task in plain language, naming the protocol and data you have.
- 7Review the output. Have an OT expert check every flagged anomaly before acting on it.
What is an agent skill and what does this one do?
An agent skill is a folder of instructions and supporting files that an AI agent loads when a task matches the skill's description. This one is for industrial control networks, such as those running factory equipment, power or water systems.
The skill tells the agent how to learn what normal traffic looks like between controllers and field devices using Modbus, DNP3 and OPC UA. It then uses machine learning to flag deviations: unusual timing, new communication pairs, unexpected function codes and mismatches against process historian data.
- Builds baselines of communication pairs, polling intervals and function codes
- Uses an Isolation Forest model to score unusual traffic samples
- Flags new or unauthorized communication pairs as high severity
- Includes a separate script that attempts to query Modbus devices directly
How do you install the skill?
Download the ZIP for this skill from this page and unzip it. For a personal setup, place the unzipped folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder.
You can also upload the skill in the Claude apps under Settings → Capabilities → Skills.
- Personal: ~/.claude/skills/detecting-anomalies-in-industrial-control-systems/
- Project: .claude/skills/detecting-anomalies-in-industrial-control-systems/
- Claude apps: Settings → Capabilities → Skills, then upload the skill
Install the Python dependencies
The skill's code needs Python 3.9 or newer. The source lists scikit-learn, numpy and pandas for model training, plus requests for historian and SIEM API access. pymodbus is optional and only needed for the device scan script.
The API reference lists the pymodbus install command below. The other packages are named in the source but no install command for them is given there.
- Required: Python 3.9+, scikit-learn, numpy, pandas, requests
- Optional: pymodbus, for the Modbus device scan script
pip install pymodbusHow do you trigger the skill with a natural request?
You do not need to name the skill. Describe the OT monitoring task in plain language and the agent will load it when the request matches the skill's description. Good triggers mention continuous OT monitoring, SCADA polling baselines, or Nozomi Guardian or Dragos alerts that need protocol-level analysis.
Be specific about your data. Say what capture you have, which protocols appear, and whether you have historian data.
- "Build a baseline from our two weeks of OT traffic capture and flag new Modbus communication pairs."
- "We got a Nozomi Guardian alert on a PLC. Analyze the Modbus function codes around that time."
- "Set up behavior-based monitoring for our DNP3 substation network, which has no IDS."
- "Compare polling intervals in this capture against the historian values for the same period."
What do you need before you start?
The skill assumes passive monitoring is already in place. The source lists passive network sensors on SPAN or TAP ports and a minimum of 2 to 4 weeks of baseline traffic captured during normal operations. Process historian access is optional but improves physical process correlation.
Your baseline should include normal operational patterns such as shift changes, batch processes and maintenance windows, or the agent will mistake them for anomalies.
- Passive sensors on SPAN/TAP ports
- 2 to 4 weeks of baseline capture during normal operations
- Optional process historian access
- Documented operating patterns: shifts, batches, maintenance windows
Safety notes: scripts and network access
This skill runs scripts and uses the network. The device scan script attempts to query Modbus devices directly, and active scanning of live control devices can disrupt processes. Run it only with expert review and off production control paths.
The code is incomplete: the detector class is cut off mid-method, so treat the output as a starting point, not a finished tool. The skill itself states it must not replace safety systems (SIS).
- Do not run the device scan against live controllers without expert approval
- Review all generated code before execution
- Keep the skill away from process safety decisions
Tips for better results
Give the agent a clear scope. A capture from one segment with one protocol gives cleaner baselines than a mixed capture. If you need signature detection of known exploits, the skill points to a different skill, detecting-attacks-on-scada-systems.
- Scope each run to one network segment and protocol set
- Use the reference table of Modbus function codes to explain risk levels to colleagues
- Check the common ICS ports list when a capture uses unexpected ports
What people use it for
- Building a behavior-based baseline for an OT network that has no intrusion detection
- Triaging a Nozomi Guardian or Dragos Platform alert that needs deeper Modbus or DNP3 analysis
- Flagging new communication pairs between a historian and PLCs after a configuration change
- Prototyping Python tooling that baselines SCADA polling intervals
Frequently asked questions
Is the ICS Anomaly Detection skill free?
The skill is published under the Apache-2.0 licence, as listed on this page. Check the licence file in the downloaded ZIP for the full terms.
What do I need to run the ICS anomaly detection skill?
You need Python 3.9 or newer, scikit-learn, numpy, pandas and requests. pymodbus is optional for the device scan script. You also need passive sensors on SPAN or TAP ports and 2 to 4 weeks of baseline capture.
Where do I install an agent skill?
Place the unzipped folder in ~/.claude/skills/ for personal use or in a project's .claude/skills/ folder. You can also upload it in the Claude apps under Settings → Capabilities → Skills.
Can this skill detect known exploits or signature-based attacks?
No. The skill is for behavior-based detection. The source directs signature-based detection of known exploits to the detecting-attacks-on-scada-systems skill.
Is it safe to run the Modbus device scan on a live plant?
Not without expert review. The script attempts to query Modbus devices directly, and active scanning of live control devices can disrupt processes.
Does this skill replace my Nozomi or Dragos monitoring?
No. The skill is meant to help analyze or triage alerts from those platforms and to add deeper protocol analysis, not to replace them. It also does not replace safety systems (SIS).
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are an OT security engineer or analyst who needs behavior-based monitoring on a network without intrusion detection, or a developer building baselining tools. Pick something else if you need signature-based detection, an IT-only anomaly tool, or a finished production product, since the included code is incomplete and the device scan can disrupt live control systems.
Download the skill