claude-red skill
A library of offensive security skills for the Claude Skills system: red team methodology across dozens of areas
- 10,635 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- Guides offensive actions against systems
- Use without the target owner's authorization is illegal
- Assumes a trained professional
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/claude-redDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Guides offensive actions against systems
- Use without the target owner's authorization is illegal
- Assumes a trained professional
This is third-party code. Review the repository files before installing.
What it does
claude-red is a set of structured SKILL.md files, each priming the agent with expert methodology for one offensive security area: web vulnerabilities, Active Directory, cloud, containers and Kubernetes, exploit development, fuzzing, EDR evasion, C2 work and more. Skills load on conversational triggers, so context is spent only on the topic in use. The authors frame it for authorized red team engagements, bug bounty triage, security research, CTF preparation and operator training. The skills carry methodology and tooling guidance rather than ready-made malware.
Who it is for. For offensive security professionals and bug bounty participants working within authorized engagements.
Good fit when
- You need expert methodology for a specific attack surface in an authorized engagement
- You are preparing for a CTF or training operators
- You want to triage bug bounty findings methodically
Not a fit when
- You have no authorization from the system owner to test
- You need defense and hardening rather than attack methodology
Example request
Help me plan an SQL injection assessment of a web app within an authorized testLimitations
The skills provide methodology and guidance but do not run attacks themselves and do not replace authorization to test. Using the techniques against systems you do not own without the owner's consent is illegal. The material is in English and assumes a trained professional.
How to disable. Remove the claude-red folder from the skills directory, for example ~/.claude/skills/claude-red.
FAQ
Do the skills run attacks themselves?
No. They are SKILL.md files with methodology and tooling guidance; a professional performs the actions within an authorized engagement.
How do I install only part?
Use sparse checkout or install.sh with a category flag to install only the areas you choose.
Discussion
No questions or reviews yet.
Related
SkillsClaude Code CyberSecurity Skills
Claude Code CyberSecurity Skill Collection
A set of 22 cybersecurity skills for Claude Code: recon, vulnerability assessment, incident response, red and blue team, malware analysis
Cybersecurity Skills
Cybersecurity Skills for AI Agents
42 security skills for Claude Code, Cursor and Codex: code and cloud audits, authorization-gated pentesting and incident response
A cybersecurity skill library: forensics, incident response, pentesting, cloud and malware analysis mapped to MITRE ATT&CK and NIST
A skill and command bundle for authorized bug bounty and external red-team work in Claude Code: methodology, chain templates and reports
Delivery-chain threat framework with three Claude skills that turn an attack report into a technique map and control gaps.
A practical security skills base for agents: web, API, privilege escalation, Active Directory, mobile, binaries and crypto
README in short
The README describes claude-red as a curated library of offensive security skills for the Claude Skills system. Each skill is a SKILL.md file that sets methodology for one attack surface and loads on conversational triggers. It names use cases: authorized red team engagements, bug bounty, research, CTF and training. Setup: clone into the skills directory, sparse-checkout specific categories, the install.sh script or pasting the content into a system prompt. MIT licensed.