Updated 4d ago
by SnailSploit
Claude-Red
claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.
7.5k GitHub stars (7,539)
+580 in 20 days
| Period | New stars |
|---|---|
| Sep 27 | +6 |
| Sep 28 | +40 |
| Sep 29 | +76 |
| Sep 30 | +48 |
| Oct 1 | +5 |
| Oct 2 | +41 |
| Oct 3 | +26 |
| Oct 4 | +27 |
| Oct 5 | +31 |
| Oct 6 | +30 |
| Oct 7 | +29 |
| Oct 8 | +21 |
| Oct 9 | +14 |
| Oct 10 | +18 |
| Oct 11 | +26 |
| Oct 12 | +31 |
| Oct 13 | +27 |
| Oct 14 | +28 |
| Oct 15 | +27 |
| Oct 16 | +29 |
- 30 skills (30 skills found in its SKILL.md files)
- 982 forks (982 forks)
- 4d ago last update (Last updated 4d ago)
Install
Skills CLI
npx skills add SnailSploit/Claude-Red
Asks which skills and agents to install. Just one: npx skills add SnailSploit/Claude-Red --skill offensive-active-directory — add -g for every project.
Claude Code
git clone https://github.com/SnailSploit/Claude-Redcp -r "Claude-Red/Skills/active-directory/offensive-active-directory" ~/.claude/skills/
Copies the offensive-active-directory skill into ~/.claude/skills/ for every project (use .claude/skills/ for one project). Repeat for the other skills listed below.
Plugin
/plugin marketplace add SnailSploit/Claude-Red
Run inside Claude Code if the repository ships a plugin marketplace, then pick plugins from /plugin.
Skills can run code on your machine — read the SKILL.md first.
What it does
In the author's own words, from each skill's SKILL.md — showing the first 30 of 79 files.
-
offensive-active-directory
Active Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential abuse (Kerberoasting, ASREProasting, NTLM relay, LLMNR/NBT-NS poisoning), privilege escalation (ACL abuse, GPO abuse, unconstrained/constrained delegation), lateral movement (Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, WMI/WinRM/PsExec), persi…
Skills/active-directory/offensive-active-directory/SKILL.md on GitHub (opens in a new tab) -
offensive-netexec
Use this skill whenever the user asks about NetExec (nxc) — a network exploitation and post-exploitation tool for Active Directory environments. Triggers include: any mention of 'nxc', 'netexec', 'crackmapexec' successor questions, AD enumeration, SMB/LDAP/WinRM/MSSQL/SSH/RDP/VNC/WMI/FTP/NFS protocol attacks, password spraying, credential dumping (SAM, NTDS, LSASS, DPAPI), Kerberoasting, ASREPRoa…
Skills/active-directory/offensive-netexec/SKILL.md on GitHub (opens in a new tab) -
offensive-ai-security
No description in the SKILL.md.
Skills/ai/offensive-ai-security/SKILL.md on GitHub (opens in a new tab) -
offensive-api-abuse
Advanced API exploitation methodology focused on business logic abuse and sophisticated attack patterns that bypass traditional security controls. Covers business logic bypass through API call chaining and workflow manipulation. Addresses GraphQL-specific attacks including batching for credential brute-force, query depth exploitation, and introspection abuse. Includes pagination exploitation for…
Skills/api/offensive-api-abuse/SKILL.md on GitHub (opens in a new tab) -
offensive-api-security
Comprehensive API security testing methodology covering REST, gRPC, and WebSocket attack surfaces. Addresses the full OWASP API Security Top 10 2023 including BOLA/IDOR, broken authentication, excessive data exposure, rate limiting bypass, BFLA, mass assignment, SSRF, and security misconfiguration. Includes REST-specific attacks such as HTTP verb tampering, content-type switching, and parameter p…
Skills/api/offensive-api-security/SKILL.md on GitHub (opens in a new tab) -
offensive-jwt
JWT attack methodology for penetration testers. Covers algorithm confusion (alg:none, RS256→HS256), weak HMAC secret brute force, kid parameter injection (SQLi, path traversal), jku/x5u/jwk header injection, JWKS cache poisoning, JWS/JWE confusion, timing attacks, and mobile JWT storage extraction. Use when testing JWT-based authentication, hunting auth bypass via token manipulation, or evaluatin…
Skills/auth/offensive-jwt/SKILL.md on GitHub (opens in a new tab) -
offensive-oauth
No description in the SKILL.md.
Skills/auth/offensive-oauth/SKILL.md on GitHub (opens in a new tab) -
offensive-cicd-pipeline
Comprehensive CI/CD pipeline exploitation methodology covering GitHub Actions injection vectors (expression injection via PR titles and issue bodies, workflow_run event abuse, GITHUB_TOKEN over-scoping, composite action supply chain compromise), Jenkins attack paths (Groovy sandbox escapes, script console remote code execution, Java remoting deserialization, credential store dumping, shared libra…
Skills/cicd/offensive-cicd-pipeline/SKILL.md on GitHub (opens in a new tab) -
offensive-cicd-secrets
Comprehensive secrets extraction methodology targeting CI/CD environments across all major platforms. Covers environment variable extraction from build contexts, exploitation of vault and secrets-manager misconfigurations (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager), runner and agent token abuse for lateral movement, OIDC federation attacks exploiting trust relation…
Skills/cicd/offensive-cicd-secrets/SKILL.md on GitHub (opens in a new tab) -
offensive-cloud
Cloud security attack methodology covering AWS, Azure, and GCP. Includes credential harvesting (IMDS, ~/.aws, env vars, leaked CI secrets, instance roles), enumeration with cloud-specific tools (pacu, ScoutSuite, Prowler, ROADtools, gcp_enum), privilege escalation paths (IAM PassRole, AssumeRole chains, Lambda/Functions privilege flips, Azure Owner-on-self, GCP serviceAccountTokenCreator), persis…
Skills/cloud/offensive-cloud/SKILL.md on GitHub (opens in a new tab) -
offensive-container-escape
Container escape and breakout techniques targeting Docker, containerd, and Podman runtimes. Covers privileged container breakout via host filesystem mount and nsenter, Docker socket abuse through /var/run/docker.sock, Linux capability exploitation including CAP_SYS_ADMIN, CAP_SYS_PTRACE, and CAP_NET_ADMIN, cgroup v1 notify_on_release escape, runc CVEs such as CVE-2019-5736 and CVE-2024-21626 Leak…
Skills/container/offensive-container-escape/SKILL.md on GitHub (opens in a new tab) -
offensive-k8s-attacks
Kubernetes cluster attack techniques covering the full attack lifecycle from initial foothold in a pod to cluster-wide compromise. Covers service account token theft and impersonation, RBAC misconfiguration exploitation including wildcard permissions and privilege escalation via role binding, direct etcd access for secret extraction, kubelet API abuse on port 10250 and read-only port 10255, pod e…
Skills/container/offensive-k8s-attacks/SKILL.md on GitHub (opens in a new tab) -
offensive-crypto-attacks
Systematic methodology for identifying and exploiting cryptographic implementation weaknesses in real-world applications. Covers padding oracle attacks against CBC-mode ciphers with PKCS7 padding (Vaudenay's original attack through modern padbuster automation), ECB mode exploitation including block cut-and-paste and byte-at-a-time decryption, hash length extension attacks against SHA1/SHA256/MD5-…
Skills/crypto/offensive-crypto-attacks/SKILL.md on GitHub (opens in a new tab) -
offensive-tls-attacks
Comprehensive methodology for auditing and exploiting TLS/SSL implementations and misconfigurations across network services and mobile applications. Covers protocol downgrade attacks including POODLE (CVE-2014-3566) against SSLv3 CBC padding, DROWN (CVE-2016-0800) cross-protocol attack leveraging SSLv2 export ciphers to decrypt TLS sessions, and FREAK (CVE-2015-0204) forcing RSA export-grade key…
Skills/crypto/offensive-tls-attacks/SKILL.md on GitHub (opens in a new tab) -
offensive-basic-exploitation
No description in the SKILL.md.
Skills/exploit-dev/offensive-basic-exploitation/SKILL.md on GitHub (opens in a new tab) -
offensive-crash-analysis
No description in the SKILL.md.
Skills/exploit-dev/offensive-crash-analysis/SKILL.md on GitHub (opens in a new tab) -
offensive-exploit-dev-course
No description in the SKILL.md.
Skills/exploit-dev/offensive-exploit-dev-course/SKILL.md on GitHub (opens in a new tab) -
offensive-exploit-development
No description in the SKILL.md.
Skills/exploit-dev/offensive-exploit-development/SKILL.md on GitHub (opens in a new tab) -
offensive-mitigations
No description in the SKILL.md.
Skills/exploit-dev/offensive-mitigations/SKILL.md on GitHub (opens in a new tab) -
offensive-toctou
Time-of-Check / Time-of-Use (TOCTOU) race condition exploitation methodology across binary, kernel, filesystem, web, and container layers. Covers symbolic-link races (open/access/stat split), file-descriptor races, fopen/realpath traversal races, /proc and procfs races, FUSE-backed slow-fs races to widen the window, ptrace and signal races, kernel double-fetch / userspace pointer races, container…
Skills/exploit-dev/offensive-toctou/SKILL.md on GitHub (opens in a new tab) -
offensive-anti-forensics
Anti-forensics and evidence destruction techniques for red team operators conducting authorized engagements. Covers log clearing on Windows (wevtutil, Clear-EventLog, ETW provider patching) and Linux (journal truncation, utmp/wtmp binary editing, syslog manipulation), timestamp manipulation via Timestomp and SetMACE to defeat timeline analysis, filesystem-level anti-forensics including NTFS Alter…
Skills/forensics/offensive-anti-forensics/SKILL.md on GitHub (opens in a new tab) -
offensive-c2-frameworks
Command and Control framework deployment, configuration, and operational tradecraft for red team engagements. Covers Cobalt Strike (malleable C2 profiles, Beacon types HTTP/HTTPS/DNS/SMB, Beacon Object Files for in-memory execution, sleep and jitter tuning, named pipe pivoting), Sliver (implant generation across mTLS/WireGuard/DNS transport, operator multiplayer mode, armory extensions), Mythic (…
Skills/forensics/offensive-c2-frameworks/SKILL.md on GitHub (opens in a new tab) -
offensive-bug-identification
No description in the SKILL.md.
Skills/fuzzing/offensive-bug-identification/SKILL.md on GitHub (opens in a new tab) -
offensive-fuzzing-course
No description in the SKILL.md.
Skills/fuzzing/offensive-fuzzing-course/SKILL.md on GitHub (opens in a new tab) -
offensive-fuzzing
Practical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness writing, corpus curation, mutation strategies, coverage measurement, and crash triage. Use when setting up or running fuzz campaigns against any target: file parsers, network protocols, kernel drivers, EDR engines, embedded firmware, or language runti…
Skills/fuzzing/offensive-fuzzing/SKILL.md on GitHub (opens in a new tab) -
offensive-vuln-classes
No description in the SKILL.md.
Skills/fuzzing/offensive-vuln-classes/SKILL.md on GitHub (opens in a new tab) -
offensive-advanced-redteam
Comprehensive red team operations methodology covering full engagement lifecycle from planning through reporting. Addresses engagement scoping and rules of engagement negotiation, multi-tier C2 infrastructure design with redirectors and domain fronting, malleable traffic profiles and beacon tradecraft, OPSEC discipline including attribution avoidance and indicator management, EDR and AMSI evasion…
Skills/infrastructure/offensive-advanced-redteam/SKILL.md on GitHub (opens in a new tab) -
offensive-edr-evasion
No description in the SKILL.md.
Skills/infrastructure/offensive-edr-evasion/SKILL.md on GitHub (opens in a new tab) -
offensive-initial-access
No description in the SKILL.md.
Skills/infrastructure/offensive-initial-access/SKILL.md on GitHub (opens in a new tab) -
offensive-keylogger-arch
No description in the SKILL.md.
Skills/infrastructure/offensive-keylogger-arch/SKILL.md on GitHub (opens in a new tab)
No skill matches that filter.
Review before you install
A skill is a set of instructions and scripts your agent will follow, and it can run code on your machine. Read the SKILL.md and any scripts first — this listing is not a security review.
Similar skills
-
Skill_Seekersby yusufkaraaslan Convert documentation websites, GitHub repositories, and PDFs into Claude AI skills with automatic conflict detection
-
prompt-masterby nidhinjs A Claude skill that writes the accurate prompts for any AI tool. Zero tokens or credits wasted. Full context and memory retention
-
agent-skillsby addyosmani Production-grade engineering skills for AI coding agents.
-
Understand-Anythingby Egonex-AI Graphs that teach > graphs that impress. Turn any code into an interactive knowledge graph you can explore, search, and ask questions about…
-
archifyby tt-a1i Turn any idea, plan, or codebase into a beautiful interactive diagram. An agent skill for Claude Code, Codex, and more.
-
oh-my-openagentby code-yeongyu OmO: Just type "mass ulw" keyword with your prompt. Now you are the master of graph engineering.