offensive-claude

In the author's own words, from each skill's SKILL.md — showing the first 30 of 38 files.

• active-directory-attack

  Use when attacking a Windows Active Directory domain — Kerberos roasting/delegation, coercion + NTLM/Kerberos relay (CVE-2025-33073), ADCS ESC1-16 (EKUwu), ticket forgery & DCSync, dMSA BadSuccessor (CVE-2025-53779), BloodHound attack-path enumeration, domain dominance

  skills/active-directory-attack/SKILL.md on GitHub (opens in a new tab)

• advanced-redteam

  No description in the SKILL.md.

  skills/advanced-redteam/SKILL.md on GitHub (opens in a new tab)

• ai-agent-redteam

  Use when red-teaming an agentic AI / LLM application — indirect & zero-click prompt injection, MCP tool poisoning, persistent memory poisoning, excessive-agency tool abuse, multi-turn jailbreaks, PyRIT/Garak/Promptfoo harnesses

  skills/ai-agent-redteam/SKILL.md on GitHub (opens in a new tab)

• ai-security

  Use when attacking an AI/ML system or model — prompt injection & jailbreaks (Crescendo, Skeleton Key, Best-of-N), RAG/vector poisoning, agentic/MCP exploitation (CVE-2025-54136), ML supply-chain RCE (pickle CVE-2025-32434), model extraction / membership inference / adversarial suffixes (GCG)

  skills/ai-security/SKILL.md on GitHub (opens in a new tab)

• browser-exploitation

  Use when building a client-side browser exploit — V8/JSC JIT type confusion to renderer R/W, V8 heap-sandbox escape, renderer-to-browser sandbox escape (Mojo IPC, GPU/Dawn/ANGLE), Electron/webview IPC abuse, 1-click RCE chains

  skills/browser-exploitation/SKILL.md on GitHub (opens in a new tab)

• cicd-supply-chain

  Use when attacking or auditing a CI/CD pipeline or software supply chain — pwn requests, poisoned pipeline execution, compromised/mutable-tag actions, dependency confusion, registry worms, runner backdoors, OIDC trust abuse, SLSA/provenance

  skills/cicd-supply-chain/SKILL.md on GitHub (opens in a new tab)

• cloud-security

  Use when attacking AWS/Azure/GCP cloud — IAM/identity privilege escalation, IMDS/metadata SSRF, Entra device-code & PRT theft, GCP impersonation chains, Kubernetes/container escape, IaC/CI-CD federation abuse

  skills/cloud-security/SKILL.md on GitHub (opens in a new tab)

• coding-mastery

  Use when writing security tooling, exploits, scanners, or C2 in Python/C/Go/Rust/ASM — systems & network programming, automation, cryptography implementation

  skills/coding-mastery/SKILL.md on GitHub (opens in a new tab)

• container-k8s-escape

  Use when breaking out of a container or escalating inside Kubernetes — runc/BuildKit CVEs, privileged/capability/cgroup misconfig escapes, NVIDIA GPU toolkit escape, K8s RBAC abuse, kubelet RCE, ingress/admission-controller RCE, node-to-cluster pivot

  skills/container-k8s-escape/SKILL.md on GitHub (opens in a new tab)

• crypto-analysis

  Use when assessing cryptography — TLS/PKI auditing, RSA/ECC key attacks, ECDSA nonce lattice recovery, symmetric/AEAD misuse, JWT/JOSE forgery, hash cracking, post-quantum migration review

  skills/crypto-analysis/SKILL.md on GitHub (opens in a new tab)

• edr-evasion

  Use when bypassing EDR/AV to run a payload — hook unhooking, direct/indirect syscalls, PPID spoofing, process injection, AMSI bypass, ETW patching, memory/sleep encryption, behavioral evasion

  skills/edr-evasion/SKILL.md on GitHub (opens in a new tab)

• engagement-flow

  Use when starting, planning, or running a multi-phase pentest or red-team engagement — to sequence the Cyber Kill Chain phases with quality gates instead of jumping straight to exploitation

  skills/engagement-flow/SKILL.md on GitHub (opens in a new tab)

• engagement-memory

  Use when recalling prior techniques at recon/weaponize, or recording a confirmed finding at report — cross-engagement pattern memory ranked by impact

  skills/engagement-memory/SKILL.md on GitHub (opens in a new tab)

• exploit-development

  Use when turning a memory-corruption bug into a working PoC — stack/ROP, glibc heap & FSOP, format strings, browser/JIT type confusion & UAF, Linux/Windows kernel LPE against ASLR/DEP/CFG/CET/V8-Sandbox

  skills/exploit-development/SKILL.md on GitHub (opens in a new tab)

• finding-discipline

  Use when about to record, claim, rate the severity of, or report any security finding — before marking anything [CONFIRMED] or writing it into the report

  skills/finding-discipline/SKILL.md on GitHub (opens in a new tab)

• incident-response

  Use when responding to or forensically investigating an incident — triage acquisition (Velociraptor/KAPE), Volatility 3 memory forensics, Chainsaw/Hayabusa EVTX timelining, anti-forensics detection, cloud IR, ransomware/ESXi response

  skills/incident-response/SKILL.md on GitHub (opens in a new tab)

• initial-access

  Use when gaining initial access to a target — phishing, payload delivery, HTML smuggling, ISO/IMG/MOTW bypass, supply-chain, credential stuffing, exposed-service exploitation

  skills/initial-access/SKILL.md on GitHub (opens in a new tab)

• keylogger-arch

  No description in the SKILL.md.

  skills/keylogger-arch/SKILL.md on GitHub (opens in a new tab)

• malware-analysis

  Use when reverse-engineering or detecting malware — static triage + capa/YARA-X, emulation/DBI/.NET unpacking, dynamic/fileless/Volatility 3 memory analysis, C2 config extraction (Cobalt Strike/CAPE), C2 traffic detection (JA4+, beaconing)

  skills/malware-analysis/SKILL.md on GitHub (opens in a new tab)

• mobile-pentest

  Use when pentesting an Android/iOS app — Frida 17 instrumentation, SSL-pinning & root/jailbreak bypass, Android 14/15 CA injection, exported-component/content-provider abuse, deep-link/WebView chains, biometric bypass, Flutter/React-Native RE

  skills/mobile-pentest/SKILL.md on GitHub (opens in a new tab)

• network-attack

  Use when attacking a network or moving laterally — L2/L3 poisoning (LLMNR/mDNS, ARP/DHCP, mitm6), coercion + NTLM relay (CVE-2025-33073), TUN pivoting (Ligolo-ng/Chisel), MitM, network-service RCE (CVE-2024-38077), WPA2/WPA3 wireless

  skills/network-attack/SKILL.md on GitHub (opens in a new tab)

• opsec-discipline

  Use when about to take any outward or offensive action (request, payload, persistence, lateral movement, exfil, or feeding captured traffic to the model) — to decide detection footprint, cleanup, and secret redaction first

  skills/opsec-discipline/SKILL.md on GitHub (opens in a new tab)

• privesc-linux

  Use when escalating privileges on a Linux host — SUID/SGID & GTFOBins, sudo LPE (CVE-2025-32462/32463), capabilities & LD_PRELOAD, kernel LPE (CVE-2024-1086, Dirty Pipe, GameOver(lay)), service misconfig (PwnKit, Looney Tunables), container/namespace escape

  skills/privesc-linux/SKILL.md on GitHub (opens in a new tab)

• privesc-windows

  Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting

  skills/privesc-windows/SKILL.md on GitHub (opens in a new tab)

• recon-osint

  Use when mapping a target's external attack surface or gathering OSINT — subdomain enumeration, attack-surface mapping (httpx/katana/JS secrets), subdomain takeover, multi-cloud/Azure tenant recon, GitHub secret dorking, breach/infostealer credential intel, CVE prioritization (EPSS/KEV)

  skills/recon-osint/SKILL.md on GitHub (opens in a new tab)

• red-team-ops

  Use when running a full red-team engagement end-to-end — initial access, persistence, privilege escalation, defense evasion, C2 infrastructure, EDR bypass, living-off-the-land

  skills/red-team-ops/SKILL.md on GitHub (opens in a new tab)

• reverse-engineering

  Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days

  skills/reverse-engineering/SKILL.md on GitHub (opens in a new tab)

• scope-discipline

  Use when about to send a request to, scan, enumerate, exploit, or otherwise interact with any host, IP, URL, or asset — before the first packet reaches a target

  skills/scope-discipline/SKILL.md on GitHub (opens in a new tab)

• shellcode-dev

  Use when writing position-independent shellcode or a loader — PEB walking, API hashing, null-byte avoidance, encoders, loaders, PE-to-shellcode conversion, cross-platform shellcode

  skills/shellcode-dev/SKILL.md on GitHub (opens in a new tab)

• threat-hunting

  Use when hunting threats or engineering detections — ATT&CK Detection-Strategies, Sigma + correlation with Detection-as-Code CI, Windows endpoint hunting (Sysmon/ETW/LSASS/LOLBins), network C2 hunting (JA4+, beaconing, DNS tunneling), cloud-identity hunting, Atomic Red Team purple-team validation

  skills/threat-hunting/SKILL.md on GitHub (opens in a new tab)

No skill matches that filter.

Similar skills

• awesome-agent-skillsby VoltAgent A curated collection of 1000+ agent skills from official dev teams and the community, compatible with Claude Code, Codex, Gemini CLI, Curso… 35.8k stars
• planning-with-filesby OthmanAdi Persistent file-based planning for AI coding agents and long-running tasks. Crash-proof markdown plans, session recovery after /clear and c… 27.5k stars · 6 skills
• video-shotcraftby Vincentwei1021 AI video skill for Claude Code & Codex — cinematic product videos with Remotion: 152 shot recipe cards, 209 motion previews, a production-r… 12.1k stars · 1 skill
• skillsby browser-act Browser automation CLI built for AI agents. Break through anti-bot walls, hand off to humans across platforms when stuck. Parallel multi-ta… 6.2k stars · 30 skills
• Continuous-Claude-v3by parcadei Context management for Claude Code. Hooks maintain state via ledgers and handoffs. MCP execution without context pollution. Agent orchestra… 3.9k stars · 30 skills
• ctf-skillsby ljagiello Agent skills for solving CTF challenges - web exploitation, binary pwn, crypto, reverse engineering, forensics, OSINT, and more 3.5k stars · 11 skills