Claude-Red
SnailSploit · SnailSploit/Claude-Red
A curated library of offensive security skills for Claude, equipping agents with expert methodologies for various attack surfaces like SQLi and shellcode.
claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.
Preview
What you can do with it
- Conduct an authorized SQL injection vulnerability assessment using Claude's enhanced offensive security knowledge.
- Prepare for a Capture The Flag (CTF) competition by leveraging Claude's understanding of exploit development.
- Research and understand EDR evasion techniques with the agent acting as a domain specialist.
Safety check
Usable, but read the notes first.
- ●Contains phrases used in prompt-injection attacks (may just be documentation about them). Read the file before installing.
Skills/ai/offensive-ai-security/SKILL.md - ●Sends environment variables or tokens over the network.
Skills/api/offensive-api-abuse/SKILL.md
Automated scan of the repo files. Always review code you run.
From the README
claude-red
Offensive security skills for Claude — drop-in SKILL.md files that turn Claude into a context-aware red team operator.
Overview • Quickstart • Categories • Skill Index • Roadmap • Contributing
Overview
claude-red is a curated library of offensive security skills for the Claude Skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQL injection to shellcode, EDR evasion to ADCS abuse.
Drop a skill into your Claude environment and it behaves like a domain specialist: it knows the techniques, the tooling, the edge cases, and the escalation paths. Skills load on demand based on conversational triggers — you don't pay context for skills you aren't using.
Use cases: authorized red team engagements, bug bounty triage, security research, CTF preparation, operator training, and methodical attack surface exploration.
for our actual research using skills -> https://snailsploit.com
Quickstart
Claude Skills System (Recommended)
git clone https://github.com/SnailSploit/claude-red ~/.claude/skills/claude-red
Claude auto-loads matching skills based on conversational triggers (e.g., mentioning SQL injection loads offensive-sqli).
To install a single category:
git clone --filter=blob:none --sparse https://github.com/SnailSploit/claude-red
cd claude-red && git sparse-checkout set Skills/web Skills/active-directory
Claude Code
cat Skills/web/offensive-sqli/SKILL.md | claude --system-file -
cat Skills/active-directory/**/SKILL.md | claude --system-file -
Claude.ai (Manual)
Paste the contents of a SKILL.md into a Project's system prompt or prepend it to your conversation.
Install Script
./install.sh # interactive
./install.sh --target ~/.claude/skills # explicit target
./install.sh --category web # single category
Categories
| Category | Skills | Focus |
|---|---|---|
| Web Application | 16 | OWASP Top 10, business logic, advanced web vulnerability classes |
| Auth & Identity | 2 | JWT exploitation, OAuth/OIDC abuse |
| Active Directory | 1 | On-prem AD attack methodology |
| Wireless | 14 | 802.11, WPA2/3, EAP, WPS, evil-twin, BLE, Zigbee, Z-Wave, LoRa, sub-GHz |
| Cloud | 1 | AWS, Azure, GCP attack paths |
| Mobile | 1 | Android and iOS application testing |
| IoT & Embedded | 1 | Hardware, firmware, RTOS, ICS/OT |
| Infrastructure & Red Team | 7 | Initial access, EDR evasion, advanced red team operations, Windows internals |
| Exploit Development | 6 | Stack/heap corruption, ROP, mitigations, crash analysis, TOCTOU |
| Fuzzing & Vulnerability Research | 4 | libFuzzer, AFL++, coverage-guided fuzzing, vulnerability taxonomy |
| Reconnaissance | 2 | OSINT tooling and structured intelligence collection |
| API Security | 2 | REST/gRPC/WebSocket testing, business logic abuse |
| Container & Kubernetes | 2 | Container escape, Kubernetes cluster exploitation |
| CI/CD & Pipeline | 2 | Pipeline exploitation, secrets extraction |
| Cryptography | 2 | Cryptographic implementation attacks, TLS/SSL |
| Privilege Escalation | 2 | Linux and Windows privilege escalation |
| Post-Exploitation | 3 | Lateral movement, persistence mechanisms, data exfiltration |
| Forensics & C2 | 2 | Anti-forensics tradecraft, C2 framework operations |
| Supply Chain | 2 | Supply chain attacks, dependency confusion |
| Social Engineering | 2 | Phishing campaigns, physical/vishing/smishing |
| Network Attacks | 1 | Layer 2/3 attacks, MITM, protocol poisoning |
| AI Security | 1 | Prompt injection, jailbreaking, RAG poisoning |
| Utility | 2 | Fast triage checklists, professional reporting |
Skill Index
Web Application
Skills/web/
| Skill | Description |
|---|---|
offensive-sqli | SQL injection — error-based, blind, OOB, DB-specific payloads, ORM CVEs |
offensive-xss | Cross-site scripting — stored, reflected, DOM-based, mutation XSS |
offensive-ssrf | Server-side request forgery — cloud metadata pivots, filter bypass |
offensive-ssti | Server-side template injection — engine fingerprinting, RCE chains |
offensive-xxe | XML external entity — OOB exfiltration, blind XXE techniques |
offensive-idor | Insecure direct object references — enumeration, authorization bypass |
offensive-file-upload | File upload — extension bypass, polyglot files, webshell deployment |
offensive-rce | Remote code execution — command injection, deserialization chains |
offensive-deserialization | Insecure deserialization — Java, PHP, .NET gadget chains |
offensive-race-condition | Race conditions — TOCTOU, single-packet attacks, limit bypass |
offensive-request-smuggling | HTTP request smuggling — CL.TE, TE.CL, H2 desync |
offensive-open-redirect | Open redirect — |