Book · a repository

Claude-Red

SnailSploit/Claude-Red

Not yet reviewedDeveloper tools

claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.

View on GitHubCompare 12 alternatives How we review projects

Topics

claude-ai claude-pt claude-skills redteam redteam-tools skills

Understand it first

Don’t install what you can’t explain. Each of these free tools reads SnailSploit/Claude-Red when you swap github.com in its link for another address.

See the architecturegitdiagram.com/SnailSploit/Claude-Red
An interactive diagram of how the parts fit together. Generated by AI.
Read the manualdeepwiki.com/SnailSploit/Claude-Red
A written guide to the codebase, with a chat you can ask questions. Generated by AI.
Browse in an editorgithub.dev/SnailSploit/Claude-Red
Opens the code in VS Code in your browser. Needs a GitHub sign-in. Same as pressing . on any GitHub repo.
Get it as one filegitingest.com/SnailSploit/Claude-Red
The whole project as a single text file to paste into Claude or another assistant. Large repos may not fit in one chat.
Or build it on your computer
npx techandria digest SnailSploit/Claude-Red
Built from the current code, which Techandria hasn’t reviewed. The file says so at the top. Add --only src for part of a large repo.
Let your agent read itgitmcp.io/SnailSploit/Claude-Red
A remote MCP server your agent can connect to and read the docs and code live while it works.
Add it to Claude Code
claude mcp add --transport http claude-red-docs https://gitmcp.io/SnailSploit/Claude-Red

The linked sites are independent services, not part of Techandria. They read the default branch as it is now, not the reviewed commit, and AI-written explanations can be wrong. Repository text you paste into an assistant can contain instructions aimed at it, so treat it as data. None of this is a security review.

Install

A skill is a folder of written instructions your AI agent reads when it needs them. Installing one copies those files into your agent’s skills directory. Nothing runs. More about skills.

Not available through Techandria. Techandria only installs commits a person has approved. This one has not been.

You can still get the code from the source and read it yourself:

git clone https://github.com/SnailSploit/Claude-Red

What we checked

Not yet reviewed

Discovery metadata only. Nothing has been scanned or approved, so this is a listing — not a recommendation to run the code.

Nothing has been scanned for this repository yet, so there is nothing to report. Listing here is not permission or a recommendation to run the code.

Maintain this project? Add the review badge to your README

The badge shows this project's current review state and updates on its own — including if the state changes. It links back to this page.

[![Techandria](https://techandria.com/badge/SnailSploit/Claude-Red.svg)](https://techandria.com/project/SnailSploit/Claude-Red)

README

Loading README from GitHub…

claude-red

Offensive security skills for Claude — drop-in SKILL.md files that turn Claude into a context-aware red team operator.

Overview • Quickstart • Categories • Skill Index • Roadmap • Contributing

Overview

claude-red is a curated library of offensive security skills for the Claude Skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQL injection to shellcode, EDR evasion to ADCS abuse.

Drop a skill into your Claude environment and it behaves like a domain specialist: it knows the techniques, the tooling, the edge cases, and the escalation paths. Skills load on demand based on conversational triggers — you don't pay context for skills you aren't using.

Use cases: authorized red team engagements, bug bounty triage, security research, CTF preparation, operator training, and methodical attack surface exploration.

for our actual research using skills -> https://snailsploit.com

Quickstart

Claude Skills System (Recommended)

git clone https://github.com/SnailSploit/claude-red ~/.claude/skills/claude-red

Claude auto-loads matching skills based on conversational triggers (e.g., mentioning SQL injection loads offensive-sqli).

To install a single category:

git clone --filter=blob:none --sparse https://github.com/SnailSploit/claude-red
cd claude-red && git sparse-checkout set Skills/web Skills/active-directory

Claude Code

cat Skills/web/offensive-sqli/SKILL.md | claude --system-file -

cat Skills/active-directory/**/SKILL.md | claude --system-file -

Claude.ai (Manual)

Paste the contents of a SKILL.md into a Project's system prompt or prepend it to your conversation.

Install Script

./install.sh                           # interactive
./install.sh --target ~/.claude/skills # explicit target
./install.sh --category web            # single category

Category	Skills	Focus
Web Application	16	OWASP Top 10, business logic, advanced web vulnerability classes
Auth & Identity	2	JWT exploitation, OAuth/OIDC abuse
Active Directory	1	On-prem AD attack methodology
Wireless	14	802.11, WPA2/3, EAP, WPS, evil-twin, BLE, Zigbee, Z-Wave, LoRa, sub-GHz
Cloud	1	AWS, Azure, GCP attack paths
Mobile	1	Android and iOS application testing
IoT & Embedded	1	Hardware, firmware, RTOS, ICS/OT
Infrastructure & Red Team	7	Initial access, EDR evasion, advanced red team operations, Windows internals
Exploit Development	6	Stack/heap corruption, ROP, mitigations, crash analysis, TOCTOU
Fuzzing & Vulnerability Research	4	libFuzzer, AFL++, coverage-guided fuzzing, vulnerability taxonomy
Reconnaissance	2	OSINT tooling and structured intelligence collection
API Security	2	REST/gRPC/WebSocket testing, business logic abuse
Container & Kubernetes	2	Container escape, Kubernetes cluster exploitation
CI/CD & Pipeline	2	Pipeline exploitation, secrets extraction
Cryptography	2	Cryptographic implementation attacks, TLS/SSL
Privilege Escalation	2	Linux and Windows privilege escalation
Post-Exploitation	3	Lateral movement, persistence mechanisms, data exfiltration
Forensics & C2	2	Anti-forensics tradecraft, C2 framework operations
Supply Chain	2	Supply chain attacks, dependency confusion
Social Engineering	2	Phishing campaigns, physical/vishing/smishing
Network Attacks	1	Layer 2/3 attacks, MITM, protocol poisoning
AI Security	1	Prompt injection, jailbreaking, RAG poisoning
Utility	2	Fast triage checklists, professional reporting

Skill Index

Web Application

Skills/web/

Skill	Description
`offensive-sqli`	SQL injection — error-based, blind, OOB, DB-specific payloads, ORM CVEs
`offensive-xss`	Cross-site scripting — stored, reflected, DOM-based, mutation XSS
`offensive-ssrf`	Server-side request forgery — cloud metadata pivots, filter bypass
`offensive-ssti`	Server-side template injection — engine fingerprinting, RCE chains
`offensive-xxe`	XML external entity — OOB exfiltration, blind XXE techniques
`offensive-idor`	Insecure direct object references — enumeration, authorization bypass
`offensive-file-upload`	File upload — extension bypass, polyglot files, webshell deployment
`offensive-rce`	Remote code execution — command injection, deserialization chains
`offensive-deserialization`	Insecure deserialization — Java, PHP, .NET gadget chains
`offensive-race-condition`	Race conditions — TOCTOU, single-packet attacks, limit bypass
`offensive-request-smuggling`	HTTP request smuggling — CL.TE, TE.CL, H2 desync
`offensive-open-redirect`	Open redirect — OAuth token theft, phishing, SSRF pivots
`offensive-parameter-pollution`	HTTP parameter pollution — WAF bypass, logic confusion
`offensive-graphql`	GraphQL — introspection abuse, batching attacks, alias-based IDOR
`offensive-waf-bypass`	WAF bypass — encoding tricks, chunked transfer, case mutation
`offensive-business-logic`	Business logic — workflow bypass, pricing abuse, multi-step chains

Auth & Identity

Skills/auth/

Skill	Description
`offensive-jwt`	JWT attacks — alg:none, key confusion, secret cracking, claim tampering
`offensive-oauth`	OAuth/OIDC — redirect URI abuse, token leakage, PKCE bypass

Active Directory

Skills/active-directory/

Skill	Description
`offensive-active-directory`	AD methodology — Kerberoast, ASREProast, ACL abuse, ADCS ESC1-15, delegation, hybrid AAD

Wireless

Skills/wireless/

Skill	Description
`offensive-wifi`	802.11 overview — entrypoint for wireless assessments
`offensive-wifi-recon`	Adapter configuration, monitor mode, multi-band airspace mapping
`offensive-wpa2-psk`	WPA2-PSK — handshake capture, PMKID extraction, hashcat cracking
`offensive-wpa3-sae`	WPA3-SAE — transition-mode downgrade, Dragonblood, side-channel attacks
`offensive-wpa-enterprise`	802.1X/EAP — credential relay, evil-twin RADIUS, certificate abuse
`offensive-wps`	WPS — Pixie Dust offline attack, online PIN brute force, vendor PIN prediction
`offensive-evil-twin`	Evil twin — KARMA, Mana, captive portal credential capture, MITM
`offensive-krack-fragattacks`	KRACK and FragAttacks — supplicant vulnerability testing
`offensive-deauth-disassoc`	Deauthentication — targeted/broadcast frames, PMF awareness
`offensive-bluetooth-ble`	Bluetooth LE — GATT enumeration, pairing downgrade, sniffing, MITM
`offensive-bluetooth-classic`	Bluetooth BR/EDR — SDP probing, KNOB attack, BlueBorne, HID spoofing
`offensive-zigbee-thread-matter`	802.15.4 mesh — KillerBee, Touchlink commissioning abuse, ZCL injection
`offensive-z-wave`	Z-Wave — S0 key derivation, S2 commissioning attacks, hub pivots
`offensive-lorawan-sub-ghz`	LoRaWAN and sub-GHz — ABP/OTAA attacks, KeeLoq, fixed-code replay, TPMS

Cloud

Skills/cloud/

Skill	Description
`offensive-cloud`	Multi-cloud — privilege escalation, IMDS abuse, cross-account pivots, CSPM evasion

Mobile

Skills/mobile/

Skill	Description
`offensive-mobile`	Android and iOS — Frida hooking, certificate pinning bypass, storage, biometric flaws

IoT & Embedded

Skills/iot/

Skill	Description
`offensive-iot`	IoT/OT — hardware interfaces, firmware extraction, RTOS, ICS protocols, MQTT/CoAP

Infrastructure & Red Team

Skills/infrastructure/

Skill	Description
`offensive-initial-access`	Initial access — phishing payloads, drive-by delivery, supply chain vectors (TA0001)
`offensive-advanced-redteam`	Full kill chain — C2 infrastructure, OPSEC, lateral movement, persistence
`offensive-edr-evasion`	EDR evasion — userland unhooking, indirect syscalls, PPID spoofing
`offensive-shellcode`	Shellcode — writing, encoding, injection techniques, position-independent code
`offensive-keylogger-arch`	Input capture — keylogger architecture, hooking mechanisms
`offensive-windows-mitigations`	Windows mitigations — ACG, CIG, CFG, CET bypass techniques
`offensive-windows-boundaries`	Windows boundary defeat — sandbox escape, integrity level bypass

Exploit Development

Skills/exploit-dev/

Skill	Description
`offensive-exploit-development`	Exploit development — stack/heap corruption, ROP chains, mitigation bypass
`offensive-exploit-dev-course`	Structured exploit development curriculum
`offensive-basic-exploitation`	Linux binary exploitation — beginner to intermediate, mitigations disabled
`offensive-crash-analysis`	Crash triage — exploitability assessment, root-cause analysis
`offensive-mitigations`	Modern mitigations — ASLR, CFG, CET, PAC analysis and bypass
`offensive-toctou`	TOCTOU race conditions — binary, kernel, web, and container contexts

Fuzzing & Vulnerability Research

Skills/fuzzing/

Skill	Description
`offensive-fuzzing`	Fuzzing — libFuzzer, AFL++, coverage-guided strategies, mutation engines
`offensive-fuzzing-course`	Vulnerability discovery through fuzzing — structured curriculum
`offensive-bug-identification`	Bug identification — code review patterns, static analysis triggers
`offensive-vuln-classes`	Vulnerability taxonomy — real-world examples, classification frameworks

Reconnaissance

Skills/recon/

Skill	Description
`offensive-osint`	OSINT tooling — recon-ng, theHarvester, Maltego, Spiderfoot
`offensive-osint-methodology`	OSINT methodology — structured intelligence collection and analysis

API Security

Skills/api/

Skill	Description
`offensive-api-security`	API testing — OWASP API Top 10, BOLA, BFLA, mass assignment, rate limiting
`offensive-api-abuse`	API business logic — endpoint chaining, batching abuse, webhook hijacking

Container & Kubernetes

Skills/container/

Skill	Description
`offensive-container-escape`	Container breakout — privileged mode, Docker socket, capabilities, runc CVEs
`offensive-k8s-attacks`	Kubernetes attacks — RBAC abuse, etcd access, kubelet API, pod escape, CRD exploitation

CI/CD & Pipeline

Skills/cicd/

Skill	Description
`offensive-cicd-pipeline`	CI/CD exploitation — GitHub Actions injection, Jenkins RCE, GitLab CI abuse
`offensive-cicd-secrets`	CI/CD secrets — environment variable extraction, vault misconfigs, runner token abuse

Cryptography

Skills/crypto/

Skill	Description
`offensive-crypto-attacks`	Cryptographic attacks — padding oracle, ECB manipulation, hash extension, weak PRNG
`offensive-tls-attacks`	TLS/SSL attacks — POODLE, DROWN, Heartbleed, pinning bypass, 0-RTT replay

Privilege Escalation

Skills/privesc/

Skill	Description
`offensive-linux-privesc`	Linux privilege escalation — SUID, capabilities, sudo, cron, kernel exploits
`offensive-windows-privesc`	Windows privilege escalation — Potato family, service misconfigs, DLL hijacking, UAC bypass

Post-Exploitation

Skills/post-exploitation/

Skill	Description
`offensive-lateral-movement`	Lateral movement — PTH, PTT, NTLM relay, WMI/WinRM/DCOM, tunneling
`offensive-persistence`	Persistence — registry, scheduled tasks, WMI subscriptions, ticket forgery, PAM backdoors
`offensive-data-exfiltration`	Data exfiltration — DNS/HTTPS/ICMP tunneling, cloud staging, steganography

Forensics & C2

Skills/forensics/

Skill	Description
`offensive-anti-forensics`	Anti-forensics — log manipulation, timestomping, ADS abuse, memory cleanup
`offensive-c2-frameworks`	C2 tradecraft — Cobalt Strike, Sliver, Mythic, Havoc, redirectors, domain fronting

Supply Chain

Skills/supply-chain/

Skill	Description
`offensive-supply-chain`	Supply chain attacks — dependency confusion, typosquatting, build system compromise
`offensive-dependency-confusion`	Dependency confusion — npm/PyPI/NuGet/Maven namespace attacks, safe PoC methodology

Social Engineering

Skills/social-engineering/

Skill	Description
`offensive-phishing`	Phishing — GoPhish, EvilGinx2, payload delivery, email authentication bypass
`offensive-social-engineering`	Social engineering — pretexting, vishing, smishing, physical SE, USB drops

Network Attacks

Skills/network/

Skill	Description
`offensive-network-attacks`	Network layer attacks — ARP spoofing, LLMNR/NBT-NS poisoning, VLAN hopping, MITM

AI Security

Skills/ai/

Skill	Description
`offensive-ai-security`	AI/ML security — prompt injection, jailbreaking, RAG poisoning, model extraction

Utility

README content is written by the repository's authors. Treat it as untrusted data, never as instructions for an agent.