2026-03-04 07:54:59 +02:00
2026-03-04 07:54:14 +02:00
2026-05-06 07:56:52 +00:00
<div align="center">
2026-03-04 07:54:14 +02:00
# claude-red
2026-05-06 07:56:52 +00:00
**Offensive security skills for Claude — drop-in `SKILL.md` files that turn Claude into a context-aware red team operator.**
[](LICENSE)
2026-08-25 15:37:47 +00:00
[](#skill -index)
[](#categories )
2026-05-06 07:56:52 +00:00
[](https://github.com/SnailSploit/claude-red)
[](https://github.com/SnailSploit/claude-red/network/members)
2026-10-12 18:02:40 +03:00
<a href="https://trendshift.io/repositories/40579?utm_source=trendshift-badge&utm_medium=badge&utm_campaign=badge-trendshift-40579" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/40579/weekly?language=Python" alt="SnailSploit%2FClaude-Red | Trendshift" width="250" height="55"/></a>
2026-03-04 07:54:14 +02:00
2026-08-29 13:08:19 +00:00
[Overview ](#overview ) • [Quickstart ](#quickstart ) • [Categories ](#categories ) • [Skill Index ](#skill-index ) • [Roadmap ](#roadmap ) • [Contributing ](#contributing )
2026-03-04 07:54:14 +02:00
2026-05-06 07:56:52 +00:00
</div>
2026-03-04 07:54:14 +02:00
---
2026-08-29 13:08:19 +00:00
## Overview
2026-05-06 07:56:52 +00:00
2026-08-29 13:08:19 +00:00
`claude-red` is a curated library of offensive security skills for the [Claude Skills system ](https://docs.claude.com ). Each skill is a structured `SKILL.md` file that primes Claude with expert-level methodology for a specific attack surface — from SQL injection to shellcode, EDR evasion to ADCS abuse.
2026-05-06 07:56:52 +00:00
2026-08-29 13:08:19 +00:00
Drop a skill into your Claude environment and it behaves like a domain specialist: it knows the techniques, the tooling, the edge cases, and the escalation paths. Skills load on demand based on conversational triggers — you don't pay context for skills you aren't using.
2026-05-06 07:56:52 +00:00
2026-08-29 13:08:19 +00:00
**Use cases:** authorized red team engagements, bug bounty triage, security research, CTF preparation, operator training, and methodical attack surface exploration.
2026-03-04 07:54:14 +02:00
2026-09-20 02:46:22 +03:00
**for our actual research using skills -> https://snailsploit.com**
2026-03-04 07:54:14 +02:00
---
2026-05-06 07:56:52 +00:00
## Quickstart
2026-08-29 13:08:19 +00:00
### Claude Skills System (Recommended)
2026-05-06 07:56:52 +00:00
```bash
git clone https://github.com/SnailSploit/claude-red ~/.claude/skills/claude-red
2026-08-29 13:08:19 +00:00
```
Claude auto-loads matching skills based on conversational triggers (e.g., mentioning SQL injection loads `offensive-sqli` ).
To install a single category:
2026-03-04 07:54:14 +02:00
2026-08-29 13:08:19 +00:00
```bash
2026-05-06 07:56:52 +00:00
git clone --filter= blob:none --sparse https://github.com/SnailSploit/claude-red
cd claude-red && git sparse-checkout set Skills/web Skills/active-directory
2026-03-04 07:54:14 +02:00
```
2026-05-06 07:56:52 +00:00
### Claude Code
```bash
cat Skills/web/offensive-sqli/SKILL.md | claude --system-file -
cat Skills/active-directory/**/SKILL.md | claude --system-file -
```
### Claude.ai (Manual)
2026-08-29 13:08:19 +00:00
Paste the contents of a `SKILL.md` into a Project's system prompt or prepend it to your conversation.
2026-05-06 07:56:52 +00:00
### Install Script
```bash
./install.sh # interactive
./install.sh --target ~/.claude/skills # explicit target
2026-08-29 13:08:19 +00:00
./install.sh --category web # single category
2026-03-04 07:54:14 +02:00
```
2026-05-06 07:56:52 +00:00
---
## Categories
| Category | Skills | Focus |
|---|---:|---|
2026-08-29 13:08:19 +00:00
| [Web Application ](#web-application ) | 16 | OWASP Top 10, business logic, advanced web vulnerability classes |
| [Auth & Identity ](#auth--identity ) | 2 | JWT exploitation, OAuth/OIDC abuse |
| [Active Directory ](#active-directory ) | 1 | On-prem AD attack methodology |
| [Wireless ](#wireless ) | 14 | 802.11, WPA2/3, EAP, WPS, evil-twin, BLE, Zigbee, Z-Wave, LoRa, sub-GHz |
| [Cloud ](#cloud ) | 1 | AWS, Azure, GCP attack paths |
| [Mobile ](#mobile ) | 1 | Android and iOS application testing |
| [IoT & Embedded ](#iot--embedded ) | 1 | Hardware, firmware, RTOS, ICS/OT |
| [Infrastructure & Red Team ](#infrastructure--red-team ) | 7 | Initial access, EDR evasion, advanced red team operations, Windows internals |
| [Exploit Development ](#exploit-development ) | 6 | Stack/heap corruption, ROP, mitigations, crash analysis, TOCTOU |
| [Fuzzing & Vulnerability Research ](#fuzzing--vulnerability-research ) | 4 | libFuzzer, AFL++, coverage-guided fuzzing, vulnerability taxonomy |
| [Reconnaissance ](#reconnaissance ) | 2 | OSINT tooling and structured intelligence collection |
2026-08-25 15:37:47 +00:00
| [API Security ](#api-security ) | 2 | REST/gRPC/WebSocket testing, business logic abuse |
2026-08-29 13:08:19 +00:00
| [Container & Kubernetes ](#container--kubernetes ) | 2 | Container escape, Kubernetes cluster exploitation |
2026-08-25 15:37:47 +00:00
| [CI/CD & Pipeline ](#cicd--pipeline ) | 2 | Pipeline exploitation, secrets extraction |
2026-08-29 13:08:19 +00:00
| [Cryptography ](#cryptography ) | 2 | Cryptographic implementation attacks, TLS/SSL |
| [Privilege Escalation ](#privilege-escalation ) | 2 | Linux and Windows privilege escalation |
| [Post-Exploitation ](#post-exploitation ) | 3 | Lateral movement, persistence mechanisms, data exfiltration |
| [Forensics & C2 ](#forensics--c2 ) | 2 | Anti-forensics tradecraft, C2 framework operations |
2026-08-25 15:37:47 +00:00
| [Supply Chain ](#supply-chain ) | 2 | Supply chain attacks, dependency confusion |
| [Social Engineering ](#social-engineering ) | 2 | Phishing campaigns, physical/vishing/smishing |
2026-08-29 13:08:19 +00:00
| [Network Attacks ](#network-attacks ) | 1 | Layer 2/3 attacks, MITM, protocol poisoning |
| [AI Security ](#ai-security ) | 1 | Prompt injection, jailbreaking, RAG poisoning |
| [Utility ](#utility ) | 2 | Fast triage checklists, professional reporting |
2026-03-04 07:54:14 +02:00
---
## Skill Index
### Web Application
2026-05-06 07:56:52 +00:00
`Skills/web/`
2026-03-04 07:54:14 +02:00
| Skill | Description |
|---|---|
2026-08-29 13:08:19 +00:00
| [`offensive-sqli` ](Skills/web/offensive-sqli/SKILL.md ) | SQL injection — error-based, blind, OOB, DB-specific payloads, ORM CVEs |
| [`offensive-xss` ](Skills/web/offensive-xss/SKILL.md ) | Cross-site scripting — stored, reflected, DOM-based, mutation XSS |
| [`offensive-ssrf` ](Skills/web/offensive-ssrf/SKILL.md ) | Server-side request forgery — cloud metadata pivots, filter bypass |
| [`offensive-ssti` ](Skills/web/offensive-ssti/SKILL.md ) | Server-side template injection — engine fingerprinting, RCE chains |
| [`offensive-xxe` ](Skills/web/offensive-xxe/SKILL.md ) | XML external entity — OOB exfiltration, blind XXE techniques |
| [`offensive-idor` ](Skills/web/offensive-idor/SKILL.md ) | Insecure direct object references — enumeration, authorization bypass |
| [`offensive-file-upload` ](Skills/web/offensive-file-upload/SKILL.md ) | File upload — extension bypass, polyglot files, webshell deployment |
| [`offensive-rce` ](Skills/web/offensive-rce/SKILL.md ) | Remote code execution — command injection, deserialization chains |
| [`offensive-deserialization` ](Skills/web/offensive-deserialization/SKILL.md ) | Insecure deserialization — Java, PHP, .NET gadget chains |
| [`offensive-race-condition` ](Skills/web/offensive-race-condition/SKILL.md ) | Race conditions — TOCTOU, single-packet attacks, limit bypass |
| [`offensive-request-smuggling` ](Skills/web/offensive-request-smuggling/SKILL.md ) | HTTP request smuggling — CL.TE, TE.CL, H2 desync |
| [`offensive-open-redirect` ](Skills/web/offensive-open-redirect/SKILL.md ) | Open redirect — OAuth token theft, phishing, SSRF pivots |
2026-05-06 07:56:52 +00:00
| [`offensive-parameter-pollution` ](Skills/web/offensive-parameter-pollution/SKILL.md ) | HTTP parameter pollution — WAF bypass, logic confusion |
2026-08-29 13:08:19 +00:00
| [`offensive-graphql` ](Skills/web/offensive-graphql/SKILL.md ) | GraphQL — introspection abuse, batching attacks, alias-based IDOR |
| [`offensive-waf-bypass` ](Skills/web/offensive-waf-bypass/SKILL.md ) | WAF bypass — encoding tricks, chunked transfer, case mutation |
| [`offensive-business-logic` ](Skills/web/offensive-business-logic/SKILL.md ) | Business logic — workflow bypass, pricing abuse, multi-step chains |
2026-03-04 07:54:14 +02:00
### Auth & Identity
2026-05-06 07:56:52 +00:00
`Skills/auth/`
| Skill | Description |
|---|---|
2026-08-29 13:08:19 +00:00
| [`offensive-jwt` ](Skills/auth/offensive-jwt/SKILL.md ) | JWT attacks — alg:none, key confusion, secret cracking, claim tampering |
| [`offensive-oauth` ](Skills/auth/offensive-oauth/SKILL.md ) | OAuth/OIDC — redirect URI abuse, token leakage, PKCE bypass |
2026-05-06 07:56:52 +00:00
### Active Directory
`Skills/active-directory/`
| Skill | Description |
|---|---|
2026-08-29 13:08:19 +00:00
| [`offensive-active-directory` ](Skills/active-directory/offensive-active-directory/SKILL.md ) | AD methodology — Kerberoast, ASREProast, ACL abuse, ADCS ESC1-15, delegation, hybrid AAD |
2026-05-06 07:56:52 +00:00
### Wireless
`Skills/wireless/`
2026-03-04 07:54:14 +02:00
| Skill | Description |
|---|---|
2026-08-29 13:08:19 +00:00
| [`offensive-wifi` ](Skills/wireless/offensive-wifi/SKILL.md ) | 802.11 overview — entrypoint for wireless assessments |
| [`offensive-wifi-recon` ](Skills/wireless/offensive-wifi-recon/SKILL.md ) | Adapter configuration, monitor mode, multi-band airspace mapping |
| [`offensive-wpa2-psk` ](Skills/wireless/offensive-wpa2-psk/SKILL.md ) | WPA2-PSK — handshake capture, PMKID extraction, hashcat cracking |
| [`offensive-wpa3-sae` ](Skills/wireless/offensive-wpa3-sae/SKILL.md ) | WPA3-SAE — transition-mode downgrade, Dragonblood, side-channel attacks |
| [`offensive-wpa-enterprise` ](Skills/wireless/offensive-wpa-enterprise/SKILL.md ) | 802.1X/EAP — credential relay, evil-twin RADIUS, certificate abuse |
| [`offensive-wps` ](Skills/wireless/offensive-wps/SKILL.md ) | WPS — Pixie Dust offline attack, online PIN brute force, vendor PIN prediction |
| [`offensive-evil-twin` ](Skills/wireless/offensive-evil-twin/SKILL.md ) | Evil twin — KARMA, Mana, captive portal credential capture, MITM |
| [`offensive-krack-fragattacks` ](Skills/wireless/offensive-krack-fragattacks/SKILL.md ) | KRACK and FragAttacks — supplicant vulnerability testing |
| [`offensive-deauth-disassoc` ](Skills/wireless/offensive-deauth-disassoc/SKILL.md ) | Deauthentication — targeted/broadcast frames, PMF awareness |
| [`offensive-bluetooth-ble` ](Skills/wireless/offensive-bluetooth-ble/SKILL.md ) | Bluetooth LE — GATT enumeration, pairing downgrade, sniffing, MITM |
| [`offensive-bluetooth-classic` ](Skills/wireless/offensive-bluetooth-classic/SKILL.md ) | Bluetooth BR/EDR — SDP probing, KNOB attack, BlueBorne, HID spoofing |
| [`offensive-zigbee-thread-matter` ](Skills/wireless/offensive-zigbee-thread-matter/SKILL.md ) | 802.15.4 mesh — KillerBee, Touchlink commissioning abuse, ZCL injection |
| [`offensive-z-wave` ](Skills/wireless/offensive-z-wave/SKILL.md ) | Z-Wave — S0 key derivation, S2 commissioning attacks, hub pivots |
| [`offensive-lorawan-sub-ghz` ](Skills/wireless/offensive-lorawan-sub-ghz/SKILL.md ) | LoRaWAN and sub-GHz — ABP/OTAA attacks, KeeLoq, fixed-code replay, TPMS |
2026-05-06 07:56:52 +00:00
### Cloud
`Skills/cloud/`
| Skill | Description |
|---|---|
2026-08-29 13:08:19 +00:00
| [`offensive-cloud` ](Skills/cloud/offensive-cloud/SKILL.md ) | Multi-cloud — privilege escalation, IMDS abuse, cross-account pivots, CSPM evasion |
2026-05-06 07:56:52 +00:00
### Mobile
`Skills/mobile/`
| Skill | Description |
|---|---|
2026-08-29 13:08:19 +00:00
| [`offensive-mobile` ](Skills/mobile/offensive-mobile/SKILL.md ) | Android and iOS — Frida hooking, certificate pinning bypass, storage, biometric flaws |
2026-05-06 07:56:52 +00:00
### IoT & Embedded
`Skills/iot/`
| Skill | Description |
|---|---|
2026-08-29 13:08:19 +00:00
| [`offensive-iot` ](Skills/iot/offensive-iot/SKILL.md ) | IoT/OT — hardware interfaces, firmware extraction, RTOS, ICS protocols, MQTT/CoAP |
2026-05-06 07:56:52 +00:00
### Infrastructure & Red Team
`Skills/infrastructure/`
2026-03-04 07:54:14 +02:00
| Skill | Description |
|---|---|
2026-08-29 13:08:19 +00:00
| [`offensive-initial-access` ](Skills/infrastructure/offensive-initial-access/SKILL.md ) | Initial access — phishing payloads, drive-by delivery, supply chain vectors (TA0001) |
| [`offensive-advanced-redteam` ](Skills/infrastructure/offensive-advanced-redteam/SKILL.md ) | Full kill chain — C2 infrastructure, OPSEC, lateral movement, persistence |
| [`offensive-edr-evasion` ](Skills/infrastructure/offensive-edr-evasion/SKILL.md ) | EDR evasion — userland unhooking, indirect syscalls, PPID spoofing |
| [`offensive-shellcode` ](Skills/infrastructure/offensive-shellcode/SKILL.md ) | Shellcode — writing, encoding, injection techniques, position-independent code |
| [`offensive-keylogger-arch` ](Skills/infrastructure/offensive-keylogger-arch/SKILL.md ) | Input capture — keylogger architecture, hooking mechanisms |
| [`offensive-windows-mitigations` ](Skills/infrastructure/offensive-windows-mitigations/SKILL.md ) | Windows mitigations — ACG, CIG, CFG, CET bypass techniques |
| [`offensive-windows-boundaries` ](Skills/infrastructure/offensive-windows-boundaries/SKILL.md ) | Windows boundary defeat — sandbox escape, integrity level bypass |
2026-05-06 07:56:52 +00:00
### Exploit Development
`Skills/exploit-dev/`
2026-03-04 07:54:14 +02:00
| Skill | Description |
|---|---|
2026-08-29 13:08:19 +00:00
| [`offensive-exploit-development` ](Skills/exploit-dev/offensive-exploit-development/SKILL.md ) | Exploit development — stack/heap corruption, ROP chains, mitigation bypass |
| [`offensive-exploit-dev-course` ](Skills/exploit-dev/offensive-exploit-dev-course/SKILL.md ) | Structured exploit development curriculum |
| [`offensive-basic-exploitation` ](Skills/exploit-dev/offensive-basic-exploitation/SKILL.md ) | Linux binary exploitation — beginner to intermediate, mitigations disabled |
| [`offensive-crash-analysis` ](Skills/exploit-dev/offensive-crash-analysis/SKILL.md ) | Crash triage — exploitability assessment, root-cause analysis |
| [`offensive-mitigations` ](Skills/exploit-dev/offensive-mitigations/SKILL.md ) | Modern mitigations — ASLR, CFG, CET, PAC analysis and bypass |
| [`offensive-toctou` ](Skills/exploit-dev/offensive-toctou/SKILL.md ) | TOCTOU race conditions — binary, kernel, web, and container contexts |
2026-03-04 07:54:14 +02:00
### Fuzzing & Vulnerability Research
2026-05-06 07:56:52 +00:00
`Skills/fuzzing/`
| Skill | Description |
|---|---|
2026-08-29 13:08:19 +00:00
| [`offensive-fuzzing` ](Skills/fuzzing/offensive-fuzzing/SKILL.md ) | Fuzzing — libFuzzer, AFL++, coverage-guided strategies, mutation engines |
| [`offensive-fuzzing-course` ](Skills/fuzzing/offensive-fuzzing-course/SKILL.md ) | Vulnerability discovery through fuzzing — structured curriculum |
| [`offensive-bug-identification` ](Skills/fuzzing/offensive-bug-identification/SKILL.md ) | Bug identification — code review patterns, static analysis triggers |
| [`offensive-vuln-classes` ](Skills/fuzzing/offensive-vuln-classes/SKILL.md ) | Vulnerability taxonomy — real-world examples, classification frameworks |
2026-05-06 07:56:52 +00:00
### Reconnaissance
`Skills/recon/`
2026-03-04 07:54:14 +02:00
| Skill | Description |
|---|---|
2026-08-29 13:08:19 +00:00
| [`offensive-osint` ](Skills/recon/offensive-osint/SKILL.md ) | OSINT tooling — recon-ng, theHarvester, Maltego, Spiderfoot |
| [`offensive-osint-methodology` ](Skills/recon/offensive-osint-methodology/SKILL.md ) | OSINT methodology — structured intelligence collection and analysis |
2026-03-04 07:54:14 +02:00
2026-08-25 15:37:47 +00:00
### API Security
`Skills/api/`
| Skill | Description |
|---|---|
2026-08-29 13:08:19 +00:00
| [`offensive-api-security` ](Skills/api/offensive-api-security/SKILL.md ) | API testing — OWASP API Top 10, BOLA, BFLA, mass assignment, rate limiting |
| [`offensive-api-abuse` ](Skills/api/offensive-api-abuse/SKILL.md ) | API business logic — endpoint chaining, batching abuse, webhook hijacking |
2026-08-25 15:37:47 +00:00
### Container & Kubernetes
`Skills/container/`
| Skill | Description |
|---|---|
2026-08-29 13:08:19 +00:00
| [`offensive-container-escape` ](Skills/container/offensive-container-escape/SKILL.md ) | Container breakout — privileged mode, Docker socket, capabilities, runc CVEs |
| [`offensive-k8s-attacks` ](Skills/container/offensive-k8s-attacks/SKILL.md ) | Kubernetes attacks — RBAC abuse, etcd access, kubelet API, pod escape, CRD exploitation |
2026-08-25 15:37:47 +00:00
### CI/CD & Pipeline
`Skills/cicd/`
| Skill | Description |
|---|---|
2026-08-29 13:08:19 +00:00
| [`offensive-cicd-pipeline` ](Skills/cicd/offensive-cicd-pipeline/SKILL.md ) | CI/CD exploitation — GitHub Actions injection, Jenkins RCE, GitLab CI abuse |
| [`offensive-cicd-secrets` ](Skills/cicd/offensive-cicd-secrets/SKILL.md ) | CI/CD secrets — environment variable extraction, vault misconfigs, runner token abuse |
2026-08-25 15:37:47 +00:00
### Cryptography
`Skills/crypto/`
| Skill | Description |
|---|---|
2026-08-29 13:08:19 +00:00
| [`offensive-crypto-attacks` ](Skills/crypto/offensive-crypto-attacks/SKILL.md ) | Cryptographic attacks — padding oracle, ECB manipulation, hash extension, weak PRNG |
| [`offensive-tls-attacks` ](Skills/crypto/offensive-tls-attacks/SKILL.md ) | TLS/SSL attacks — POODLE, DROWN, Heartbleed, pinning bypass, 0-RTT replay |
2026-08-25 15:37:47 +00:00
### Privilege Escalation
`Skills/privesc/`
| Skill | Description |
|---|---|
2026-08-29 13:08:19 +00:00
| [`offensive-linux-privesc` ](Skills/privesc/offensive-linux-privesc/SKILL.md ) | Linux privilege escalation — SUID, capabilities, sudo, cron, kernel exploits |
| [`offensive-windows-privesc` ](Skills/privesc/offensive-windows-privesc/SKILL.md ) | Windows privilege escalation — Potato family, service misconfigs, DLL hijacking, UAC bypass |
2026-08-25 15:37:47 +00:00
### Post-Exploitation
`Skills/post-exploitation/`
| Skill | Description |
|---|---|
2026-08-29 13:08:19 +00:00
| [`offensive-lateral-movement` ](Skills/post-exploitation/offensive-lateral-movement/SKILL.md ) | Lateral movement — PTH, PTT, NTLM relay, WMI/WinRM/DCOM, tunneling |
| [`offensive-persistence` ](Skills/post-exploitation/offensive-persistence/SKILL.md ) | Persistence — registry, scheduled tasks, WMI subscriptions, ticket forgery, PAM backdoors |
| [`offensive-data-exfiltration` ](Skills/post-exploitation/offensive-data-exfiltration/SKILL.md ) | Data exfiltration — DNS/HTTPS/ICMP tunneling, cloud staging, steganography |
2026-08-25 15:37:47 +00:00
### Forensics & C2
`Skills/forensics/`
| Skill | Description |
|---|---|
2026-08-29 13:08:19 +00:00
| [`offensive-anti-forensics` ](Skills/forensics/offensive-anti-forensics/SKILL.md ) | Anti-forensics — log manipulation, timestomping, ADS abuse, memory cleanup |
| [`offensive-c2-frameworks` ](Skills/forensics/offensive-c2-frameworks/SKILL.md ) | C2 tradecraft — Cobalt Strike, Sliver, Mythic, Havoc, redirectors, domain fronting |
2026-08-25 15:37:47 +00:00
### Supply Chain
`Skills/supply-chain/`
| Skill | Description |
|---|---|
2026-08-29 13:08:19 +00:00
| [`offensive-supply-chain` ](Skills/supply-chain/offensive-supply-chain/SKILL.md ) | Supply chain attacks — dependency confusion, typosquatting, build system compromise |
| [`offensive-dependency-confusion` ](Skills/supply-chain/offensive-dependency-confusion/SKILL.md ) | Dependency confusion — npm/PyPI/NuGet/Maven namespace attacks, safe PoC methodology |
2026-08-25 15:37:47 +00:00
### Social Engineering
`Skills/social-engineering/`
| Skill | Description |
|---|---|
2026-08-29 13:08:19 +00:00
| [`offensive-phishing` ](Skills/social-engineering/offensive-phishing/SKILL.md ) | Phishing — GoPhish, EvilGinx2, payload delivery, email authentication bypass |
| [`offensive-social-engineering` ](Skills/social-engineering/offensive-social-engineering/SKILL.md ) | Social engineering — pretexting, vishing, smishing, physical SE, USB drops |
2026-08-25 15:37:47 +00:00
### Network Attacks
`Skills/network/`
| Skill | Description |
|---|---|
2026-08-29 13:08:19 +00:00
| [`offensive-network-attacks` ](Skills/network/offensive-network-attacks/SKILL.md ) | Network layer attacks — ARP spoofing, LLMNR/NBT-NS poisoning, VLAN hopping, MITM |
2026-08-25 15:37:47 +00:00
2026-03-04 07:54:14 +02:00
### AI Security
2026-05-06 07:56:52 +00:00
`Skills/ai/`
2026-03-04 07:54:14 +02:00
| Skill | Description |
|---|---|
2026-08-29 13:08:19 +00:00
| [`offensive-ai-security` ](Skills/ai/offensive-ai-security/SKILL.md ) | AI/ML security — prompt injection, jailbreaking, RAG poisoning, model extraction |
2026-03-04 07:54:14 +02:00
### Utility
2026-05-06 07:56:52 +00:00
`Skills/utility/`
2026-03-04 07:54:14 +02:00
| Skill | Description |
|---|---|
2026-08-29 13:08:19 +00:00
| [`offensive-fast-checking` ](Skills/utility/offensive-fast-checking/SKILL.md ) | Fast triage — quick-win identification checklists |
| [`offensive-reporting` ](Skills/utility/offensive-reporting/SKILL.md ) | Professional reporting — CVSS scoring, evidence standards, executive summaries |
2026-03-04 07:54:14 +02:00
---
2026-05-06 07:56:52 +00:00
## Roadmap
2026-03-04 07:54:14 +02:00
2026-08-29 13:08:19 +00:00
The library is being expanded across multiple phases. See [CHANGELOG.md ](CHANGELOG.md ) for release history.
2026-03-04 07:54:14 +02:00
2026-08-29 13:08:19 +00:00
| Phase | Focus | Skills | Status |
2026-05-06 07:56:52 +00:00
|---|---|---:|---|
2026-08-29 13:08:19 +00:00
| 1 | Internal AD/Windows — split into focused skills | +16 | Planned |
| 2 | Cloud Identity — Entra, ADFS, Okta, M365 | +10 | Planned |
| 3 | Wireless — WPA2/3, EAP, BLE, Zigbee, Z-Wave, LoRa, sub-GHz | +12 | Complete |
| 4 | IoT — UART/JTAG, flash extraction, fault injection, RTOS, ICS | +10 | Planned |
| 5 | Web Fundamentals — recon, auth bypass, access control, CSRF, CORS | +8 | Planned |
| 6 | Web Advanced — proto pollution, SAML, OIDC, WebSocket, SSI/ESI | +10 | Planned |
| 7 | Documentation and tooling polish | — | Complete |
| 8 | New categories — 10 new domains with 20 skills | +20 | Complete |
| 9 | Deep rewrites — deserialization, GraphQL, advanced red team, SSTI | — | Complete |
Target: ~130 skills across 23+ categories.
2026-03-04 07:54:14 +02:00
---
2026-05-06 07:56:52 +00:00
## Contributing
Contributions welcome. See [CONTRIBUTING.md ](CONTRIBUTING.md ) for the skill template, frontmatter standard, and review process. Focused, single-surface skills are preferred over monolithic overviews.
2026-03-04 07:54:14 +02:00
2026-05-06 07:56:52 +00:00
## License
2026-03-04 07:54:14 +02:00
2026-05-06 07:56:52 +00:00
[MIT ](LICENSE ) — use freely, attribution appreciated.
## Acknowledgements
2026-08-29 13:08:19 +00:00
- **Author:** [Kai Aizen ](https://snailsploit.com ) (SnailSploit) — GenAI security research
- **Original Checklists:** [Sahar Shlichov ](https://github.com/sahar042/offensive-checklist ) — the offensive checklist collection that many of these skills build on
- **Community:** Pull requests and feedback that keep the library aligned with the evolving threat landscape
2026-03-04 07:54:14 +02:00
---
2026-05-06 07:56:52 +00:00
<div align="center">
2026-08-29 13:08:19 +00:00
*Give Claude the right skill and it stops being a chatbot — it becomes an operator.*
2026-05-06 07:56:52 +00:00
2026-08-29 13:08:19 +00:00
[snailsploit.com ](https://snailsploit.com ) • [GitHub ](https://github.com/SnailSploit ) • [Research ](https://snailsploit.com/research ) • [X ](https://x.com/SnailSploit )
2026-05-08 19:05:21 +03:00
2026-08-29 13:08:19 +00:00
</div>
