Sophos says Claude Code, Cursor, and Codex triggered Windows endpoint rules for credential access, LOLBin downloads, and ...
claude-code-minoan/ ├── skills/ # 97 custom skills across 5 categories │ ├── core-development/ # Architecture, task tracking, code search │ ├── integration-automation/ # Local ML, RAG, browser, ...