Updated today
by gadievron
raptor
Raptor turns Claude Code into a general-purpose AI offensive/defensive security agent. By using Claude.md and creating rules, sub-agents, and skills, and orchestrating security tool usage, we configure the agent for adversarial thinking, and perform research or attack/defense operations.
4k GitHub stars (3,974)
+114 in 30 days
| Period | New stars |
|---|---|
| Oct 1 | +2 |
| Oct 2 | 0 |
| Oct 3 | +12 |
| Oct 4 | +3 |
| Oct 5 | +4 |
| Oct 6 | +2 |
| Oct 7 | +1 |
| Oct 8 | +6 |
| Oct 9 | +7 |
| Oct 10 | +3 |
| Oct 11 | +3 |
| Oct 12 | +11 |
| Oct 13 | +7 |
| Oct 14 | +6 |
| Oct 15 | +3 |
| Oct 16 | +2 |
| Oct 17 | +5 |
| Oct 18 | +2 |
| Oct 19 | +4 |
| Oct 20 | +3 |
| Oct 21 | +3 |
| Oct 22 | +3 |
| Oct 23 | +6 |
| Oct 24 | +2 |
| Oct 25 | −1 |
| Oct 26 | +4 |
| Oct 27 | +2 |
| Oct 28 | +6 |
| Oct 29 | +4 |
| Oct 30 | +2 |
| Oct 31 | +3 |
| Nov 1 | +2 |
| Nov 2 | +5 |
| Nov 3 | +5 |
| Nov 4 | +3 |
| Nov 5 | +2 |
- 13 skills (13 skills found in its SKILL.md files)
- 602 forks (602 forks)
- Today last update (Last updated today)
Install
Skills CLI
npx skills add gadievron/raptor
Asks which skills and agents to install. Just one: npx skills add gadievron/raptor --skill audit — add -g for every project.
Claude Code
git clone https://github.com/gadievron/raptorcp -r "raptor/.claude/skills/audit" ~/.claude/skills/
Copies the audit skill into ~/.claude/skills/ for every project (use .claude/skills/ for one project). Repeat for the other skills listed below.
Plugin
/plugin marketplace add gadievron/raptor
Run inside Claude Code if the repository ships a plugin marketplace, then pick plugins from /plugin.
Skills can run code on your machine — read the SKILL.md first.
What it does
In the author's own words, from each skill's SKILL.md.
-
audit
Hypothesis-driven, tool-grounded security review of coverage gaps
.claude/skills/ on GitHub (opens in a new tab)audit/ SKILL.md -
code-understanding
Provides adversarial code comprehension for security research, mapping architecture, tracing data flows, and hunting vulnerability variants to build ground-truth understanding before or alongside static analysis.
.claude/skills/ on GitHub (opens in a new tab)code-understanding/ SKILL.md -
exploitability-validation
Multi-stage pipeline for validating that vulnerability findings are real, reachable, and exploitable, preventing wasted effort on hallucinated findings, dead code paths, or findings with unrealistic preconditions.
.claude/skills/ on GitHub (opens in a new tab)exploitability-validation/ SKILL.md -
frida
Dynamic instrumentation via Frida - attach to or spawn a process, load a JS hook script, capture send() events into a lifecycle-managed run directory. Supports local, USB-attached, and remote frida-server targets.
.claude/skills/ on GitHub (opens in a new tab)frida/ SKILL.md -
Function Call Tracing
Instrument C/C++ with -finstrument-functions for execution tracing and Perfetto visualisation
.claude/skills/ on GitHub (opens in a new tab)crash-analysis/ function-tracing/ SKILL.md -
Code Coverage with gcov
Add gcov code coverage instrumentation to C/C++ projects
.claude/skills/ on GitHub (opens in a new tab)crash-analysis/ gcov-coverage/ SKILL.md -
Line Execution Checker
Check if specific lines were executed using gcov data
.claude/skills/ on GitHub (opens in a new tab)crash-analysis/ line-execution-checker/ SKILL.md -
rr-debugger
Deterministic debugging with rr record-replay. Use when debugging crashes, ASAN faults, or when reverse execution is needed. Provides reverse-next, reverse-step, reverse-continue commands and crash trace extraction.
.claude/skills/ on GitHub (opens in a new tab)crash-analysis/ rr-debugger/ SKILL.md -
github-archive
Investigate GitHub security incidents using tamper-proof GitHub Archive data via BigQuery. Use when verifying repository activity claims, recovering deleted PRs/branches/tags/repos, attributing actions to actors, or reconstructing attack timelines. Provides immutable forensic evidence of all public GitHub events since 2011.
.claude/skills/ on GitHub (opens in a new tab)oss-forensics/ github-archive/ SKILL.md -
github-commit-recovery
Recover deleted commits from GitHub using REST API, web interface, and git fetch. Use when you have commit SHAs and need to retrieve actual commit content, diffs, or patches. Includes techniques for accessing "deleted" commits that remain on GitHub servers.
.claude/skills/ on GitHub (opens in a new tab)oss-forensics/ github-commit-recovery/ SKILL.md -
github-evidence-kit
Generate, export, load, and verify forensic evidence from GitHub sources. Use when creating verifiable evidence objects from GitHub API, GH Archive, Wayback Machine, local git repositories, or security vendor reports. Handles evidence storage, querying, and re-verification against original sources.
.claude/skills/ on GitHub (opens in a new tab)oss-forensics/ github-evidence-kit/ SKILL.md -
github-wayback-recovery
Recover deleted GitHub content using the Wayback Machine and Archive.org APIs. Use when repositories, files, issues, PRs, or wiki pages have been deleted from GitHub but may persist in web archives. Covers CDX API queries, URL patterns, and systematic recovery workflows.
.claude/skills/ on GitHub (opens in a new tab)oss-forensics/ github-wayback-recovery/ SKILL.md -
oss-forensics-orchestration
Orchestrates multi-agent forensic investigations on public GitHub repositories, coordinating parallel evidence collection, hypothesis formation, verification, and report generation.
.claude/skills/ on GitHub (opens in a new tab)oss-forensics/ orchestration/ SKILL.md
No skill matches that filter.
Review before you install
A skill is a set of instructions and scripts your agent will follow, and it can run code on your machine. Read the SKILL.md and any scripts first — this listing is not a security review.