Skip to content
Get packs

Configuring HSM Key Storage

Guides an agent through storing and using cryptographic keys in hardware security modules via PKCS#11.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
7 files

What it does

When installed, the agent can walk you through setting up a Hardware Security Module (a tamper-resistant device, or a software test stand-in called SoftHSM2) so cryptographic keys are generated and used inside it rather than sitting in files or memory. It covers creating AES and RSA keys, signing, encrypting, and listing stored keys through the standard PKCS#11 interface. It also includes helper scripts that can list AWS CloudHSM clusters and run the PKCS#11 operations.

Great for

  • Developers building key management or signing workflows who need keys to stay inside an HSM
  • Security engineers setting up a SoftHSM2 test environment before moving to physical or cloud HSMs
  • Teams reviewing whether their key storage matches FIPS 140-2 level expectations

Skip it if

  • Production key ceremonies or CA root key handling: the skill is educational and the scripts are demonstrations, so a qualified security professional should review any real deployment
  • Running against live production HSMs or cloud accounts without authorization, since the scripts can read cloud infrastructure details and perform key operations

Try asking

  • “Set up a SoftHSM2 token with a user PIN and SO PIN, then generate an AES key inside it”
  • “Generate an RSA key pair in the HSM and show me how to sign a file with it”
  • “Verify that my PKCS#11 keys are created as non-extractable”
  • “List all AWS CloudHSM clusters in my account and their HSM states”
Step-by-step guide: how to use Configuring HSM Key StorageInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.

    configuring-hsm-for-key-storage.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip configuring-hsm-for-key-storage.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip configuring-hsm-for-key-storage.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Start with SoftHSM2 in a lab environment so you can learn the workflow without touching real keys
  • Ask the agent to confirm keys are non-extractable (CKA_EXTRACTABLE=False) before relying on them
  • Review the scripts before running them, especially agent.py, since it calls AWS APIs using your credentials

What's inside

  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.