generated: '2026-08-01'
method: searched
source: https://github.com/NordStellar/nordstellar-mcp/tree/main/skills
provenance: >-
  These are NOT generated by API Evangelist. All sixteen SKILL.md files are published by NordStellar in
  its own open-source MCP repository (GPL-3.0) and are saved here verbatim. NordStellar distributes them
  three ways: a prebuilt ZIP for Claude Desktop
  (releases/download/skills-latest/nordstellar.zip), `npx skills add
  https://github.com/NordStellar/nordstellar-mcp` for generic MCP clients, and per-skill installs from
  the skills/ subtree.
api: https://platform-mcp.nordstellar.com/mcp
grounding: >-
  Every skill is grounded in the NordStellar GraphQL schema executed through the MCP tools
  `graphql_query`, `graphql_batch`, `search_types` and `get_type_definition` — not in the REST OpenAPI
  estate. Concrete GraphQL queries are embedded in the skill bodies.
install:
  claude_desktop: https://github.com/NordStellar/nordstellar-mcp/releases/download/skills-latest/nordstellar.zip
  cli: npx skills add https://github.com/NordStellar/nordstellar-mcp
  docs: https://docs.nordstellar.com/platform/mcp/skills
skills:
- file: nord-security-nordstellar-general.md
  name: nordstellar
  category: entrypoint
  description: >-
    Router skill for any task involving the NordStellar threat intelligence platform via MCP — leaked
    data, attack surface, dark web search, domain squatting, project review and report generation.
    Instructs the agent to load it before writing any GraphQL.
  tools: [graphql_query]
- file: nord-security-dark-web-search.md
  name: dark-web-search
  category: dark-web
  description: Ad-hoc dark web search across forums, Telegram, ransomware blogs and marketplaces.
  tools: [graphql_query, graphql_batch]
- file: nord-security-asset-dark-web-research.md
  name: asset-dark-web-research
  category: dark-web
  description: >-
    Asset-driven dark web research — inventory project assets, collapse emails/subdomains/IPs into
    efficient Lucene search terms, and run the searches.
  tools: [graphql_query]
- file: nord-security-malware-infection-analysis.md
  name: malware-infection-analysis
  category: leaked-data
  description: >-
    Discover infostealer infections, fetch leaked cookies and credentials, and assess session-hijack
    exposure.
  tools: [graphql_query]
- file: nord-security-attack-surface-management.md
  name: attack-surface-management
  category: attack-surface
  description: >-
    ASM across vulnerabilities, scans, DNS/domains, IPs, web apps, network services, technologies and
    SSL certificates.
  tools: [graphql_query, search_types, get_type_definition]
- file: nord-security-externally-exposed-network-overview.md
  name: externally-exposed-network-overview
  category: attack-surface
  description: >-
    Internet-facing IPs, providers, countries, ASNs, open ports, network services and web exposure.
  tools: [graphql_query]
- file: nord-security-web-application-review.md
  name: web-application-review
  category: attack-surface
  description: >-
    Review externally exposed web applications — hosts, ports, status codes, CNAMEs, IPs, technologies
    and response headers.
  tools: [graphql_query]
- file: nord-security-data-center-compliance-review.md
  name: data-center-compliance-review
  category: attack-surface
  description: >-
    Data centre and hosting compliance review — providers, ASNs, countries, internet-facing services,
    certificates and DNS posture.
  tools: [graphql_query]
- file: nord-security-domain-squatting.md
  name: domain-squatting
  category: brand-protection
  description: >-
    Typosquat / look-alike brand abuse — permutation inventory, WHOIS and redirect chains, content and
    visual similarity.
  tools: [graphql_query]
- file: nord-security-company-compliance-review.md
  name: company-compliance-review
  category: compliance
  description: >-
    Orchestrates a full compliance review for a company or project by delegating to the framework and
    evidence skills below.
  tools: [graphql_query]
- file: nord-security-iso-27001-audit.md
  name: iso-27001-audit
  category: compliance
  description: ISO/IEC 27001:2022 evidence collection mapped to Annex A controls.
  tools: [graphql_query]
- file: nord-security-soc-2-audit.md
  name: soc-2-audit
  category: compliance
  description: SOC 2 Trust Services Criteria evidence collection (Security common criteria, partial Availability).
  tools: [graphql_query]
- file: nord-security-pci-dss-audit.md
  name: pci-dss-audit
  category: compliance
  description: PCI DSS v4.0.1 evidence collection across network security, secure configuration and vulnerability requirements.
  tools: [graphql_query]
- file: nord-security-nist-800-53-audit.md
  name: nist-800-53-audit
  category: compliance
  description: NIST SP 800-53 Rev. 5 evidence collection across the RA, CA, SI, IR, AU, CM, SC, AC and SR families.
  tools: [graphql_query]
- file: nord-security-nist-csf-audit.md
  name: nist-csf-audit
  category: compliance
  description: NIST Cybersecurity Framework 2.0 evidence collection across Govern, Identify, Protect, Detect and Respond.
  tools: [graphql_query]
- file: nord-security-cis-controls-audit.md
  name: cis-controls-audit
  category: compliance
  description: >-
    CIS Controls v8/v8.1 evidence collection across inventory, vulnerability management and audit log
    management.
  tools: [graphql_query]
x-evidence:
  fetched: '2026-08-01'
  files_fetched: 16
  base: https://raw.githubusercontent.com/NordStellar/nordstellar-mcp/main/skills/
  http_status: 200
  license: GPL-3.0