Follow For years, SOC Prime has focused on one core problem: curating behavioral detection rules that cover both the threats that never go away and the new ones that emerge every day. As agentic AI changes how security teams work, we see the same opportunity opening up in a new area — and we’re expanding our curation approach to meet it. Meet the Agentic Skills Marketplace, available inside Prime Architect’s Agentic Threat Research.
The Problem: Capability Isn’t the Bar
Agentic AI is giving security teams more skills and agents to choose from than ever. But in cybersecurity, capability alone was never the bar. Before a skill earns a place in a SOC workflow, teams need to know what it does, what it can access, how it operates, and whether it can be trusted. That’s the gap the Agentic Skills Marketplace is built to close — curation, applied to a new kind of asset.
Built on Infrastructure We Already Trust
This isn’t a new direction so much as the next step on one SOC Prime is already on. Prime Architect’s Agentic Threat Research already lets analysts take a raw threat report and, with one click, turn it into structured, actionable intelligence and environment-tuned detections — without the data ever leaving SOC Prime infrastructure.
That capability is backed by ongoing R&D across bare-metal and cloud architectures, using multiple open-weight models deployed on infrastructure SOC Prime owns. Owning that infrastructure means control over data sovereignty and performance, and it reflects a broader belief: when the people building the AI are also the security experts, security becomes a design principle from the start, not a feature bolted on later. The Agentic Skills Marketplace is built on that same thinking.
What’s Inside the Marketplace
The marketplace launches with more than 1,000 open-source skills, organized around the functions defined in the NIST Cybersecurity Framework (CSF) 2.0 — Govern, Identify, Protect, Detect, Respond, Recover — so teams explore skills in the context of the work they’re already doing, rather than starting from scratch.
That means real, ready-to-use skills for the workflows that eat up analyst time:
- Detection engineering — Turn raw log samples, detection ideas, or descriptions of attacker behavior into detection content. Skills can guide the agent through analyzing relevant fields and producing detection logic tailored to the target environment.
- CTI analysis — Process unstructured threat reports and extract useful intelligence, including hashes, domains, IP addresses, URLs, malware names, techniques, and affected technologies. An extraction pipeline can define what to look for and how to organize the results.
- Threat hunting — Turn a hunting hypothesis into a query designed for a specific data plane and its available data sources. Skills provide the workflow needed to move from what to investigate to a runnable hunt.
- Adversary emulation — Structure attacker behavior for emulation and testing. Skills can help identify relevant techniques, translate adversary behavior into actionable steps, and support workflows based on mapping techniques within MITRE ATT&CK and MITRE Attack Flow.
These are exactly the kinds of repeatable, judgment-heavy workflows Agentic Skills is built for. Instead of a one-off prompt that may or may not capture the nuance of the task, you get a curated, reviewed, versioned instruction set the agent follows every time — built by the SOC Prime team, by trusted publishers, or by you.
And if a workflow is unique to your team, you’re not limited to what’s in the marketplace — you can create your own personal skills from scratch, with your own instructions, and use them exactly like any marketplace skill.
Know Exactly What Skills You’re Using
Before installing any skill, its details page gives you everything you need to evaluate it — no black box, no guesswork:
- Security score — an at-a-glance indication of the skill’s overall safety
- Vetting details — how the skill was assessed before being listed
- Operation flow chart — a visual walkthrough of what the skill does and how it works
- Use cases — real examples of where the skill applies
- Prerequisites — what needs to be in place before you run it
- Compatibility — which environments, agents, and tools it works with
Putting Skills into Practice
- Discover. Go to Prime Architect > Agentic Threat Research > Agentic Skills.
Browse the library by NIST Cybersecurity Framework, or check “For You” and “New” for recommendations and recent releases.
- Evaluate. Open a skill’s details page for its flow diagram, when-to-use guidance, prerequisites, a worked example, security score, and compatibility.
Not ready to use? Bookmark it for later.
- Install. One click adds it to your skills, ready to use in your workflow. Installed skills auto-update, so you always run the latest, most accurate version with zero manual maintenance.
Take it with you. Generate a ZIP package containing the skill’s SKILL.md file — useful for storing it locally or running it with a compatible external agent or platform.
- Use it. In Prime Architect chat, add the installed skill to your message any of three ways:
- Click the + icon and select Add Skills, then pick a skill
- Type / to search by skill name or description and select the skill from the list
- Click the Agentic Skills button above the chat input, then pick a skill
Pair it with your own prompt, a file, or a detection for context, then send — the agent follows the skill’s instructions to produce the output.
The marketplace doesn’t sit in isolation — it’s also connected directly to Active Threats in Prime Core. When you’re exploring a specific threat, relevant agentic skills surface automatically, right alongside the investigation. Instead of leaving your threat research to go hunt for the right skill, the skill finds you at the moment you need it — keeping analysis and action in the same flow.
Experience the Marketplace
This isn’t meant to be another catalog layered onto an already crowded security stack. It’s built to make it easier to find useful skills, understand what they actually do before adopting them, and bring them into existing workflows with real confidence instead of guesswork.
