claude-red
Библиотека скиллов по наступательной безопасности для системы Claude Skills: методология по десяткам направлений red team
Высокий риск
Высокий уровень ставим, когда инструмент пишет во внешние системы, работает с деньгами, рабочими базами или секретами либо выполняет произвольные команды. CLI поставит его только после вашего согласия.
Почему такой уровень
- Направляет наступательные действия против систем
- Применение без разрешения владельца цели незаконно
- Рассчитан на подготовленного специалиста
Установка
В терминале, через SkillFoxx CLI
npx skillfoxx add skills/claude-redОпределит агенты на машине, проверит риск и зафиксирует версию.
Другие способы установки
Собрано автоматически, проверьте перед установкой.
Выполните в терминале в папке проекта
npx skills add snailsploit/claude-red --skill offensive-active-directory offensive-ai-security offensive-api-abuse offensive-api-security offensive-jwt offensive-oauth offensive-cicd-pipeline offensive-cicd-secrets offensive-cloud offensive-container-escape offensive-k8s-attacks offensive-crypto-attacks offensive-tls-attacks offensive-basic-exploitation offensive-crash-analysis offensive-exploit-dev-course offensive-exploit-development offensive-mitigations offensive-toctou offensive-anti-forensics offensive-c2-frameworks offensive-bug-identification offensive-fuzzing-course offensive-fuzzing offensive-vuln-classes offensive-advanced-redteam offensive-edr-evasion offensive-initial-access offensive-keylogger-arch offensive-shellcode offensive-windows-boundaries offensive-windows-mitigations offensive-iot offensive-mobile offensive-network-attacks offensive-data-exfiltration offensive-lateral-movement offensive-persistence offensive-linux-privesc offensive-windows-privesc offensive-osint-methodology offensive-osint offensive-phishing offensive-social-engineering offensive-dependency-confusion offensive-supply-chain offensive-wifi offensive-wifi-recon offensive-wpa2-psk offensive-wpa3-sae offensive-wpa-enterprise offensive-wps offensive-evil-twin offensive-krack-fragattacks offensive-deauth-disassoc offensive-bluetooth-ble offensive-bluetooth-classic offensive-zigbee-thread-matter offensive-z-wave offensive-lorawan-sub-ghz offensive-fast-checking offensive-reporting offensive-sqli offensive-xss offensive-ssrf offensive-ssti offensive-xxe offensive-idor offensive-file-upload offensive-rce offensive-deserialization offensive-race-condition offensive-request-smuggling offensive-open-redirect offensive-parameter-pollution offensive-graphql offensive-waf-bypass offensive-business-logic -a claude-code -yУтилита skills ставит текущую версию из репозитория. Чтобы скилл работал во всех проектах, добавьте флаг -g.
Выполните в терминале в папке проекта
npx skills add snailsploit/claude-red --skill offensive-active-directory offensive-ai-security offensive-api-abuse offensive-api-security offensive-jwt offensive-oauth offensive-cicd-pipeline offensive-cicd-secrets offensive-cloud offensive-container-escape offensive-k8s-attacks offensive-crypto-attacks offensive-tls-attacks offensive-basic-exploitation offensive-crash-analysis offensive-exploit-dev-course offensive-exploit-development offensive-mitigations offensive-toctou offensive-anti-forensics offensive-c2-frameworks offensive-bug-identification offensive-fuzzing-course offensive-fuzzing offensive-vuln-classes offensive-advanced-redteam offensive-edr-evasion offensive-initial-access offensive-keylogger-arch offensive-shellcode offensive-windows-boundaries offensive-windows-mitigations offensive-iot offensive-mobile offensive-network-attacks offensive-data-exfiltration offensive-lateral-movement offensive-persistence offensive-linux-privesc offensive-windows-privesc offensive-osint-methodology offensive-osint offensive-phishing offensive-social-engineering offensive-dependency-confusion offensive-supply-chain offensive-wifi offensive-wifi-recon offensive-wpa2-psk offensive-wpa3-sae offensive-wpa-enterprise offensive-wps offensive-evil-twin offensive-krack-fragattacks offensive-deauth-disassoc offensive-bluetooth-ble offensive-bluetooth-classic offensive-zigbee-thread-matter offensive-z-wave offensive-lorawan-sub-ghz offensive-fast-checking offensive-reporting offensive-sqli offensive-xss offensive-ssrf offensive-ssti offensive-xxe offensive-idor offensive-file-upload offensive-rce offensive-deserialization offensive-race-condition offensive-request-smuggling offensive-open-redirect offensive-parameter-pollution offensive-graphql offensive-waf-bypass offensive-business-logic -a cursor -yУтилита skills ставит текущую версию из репозитория. Чтобы скилл работал во всех проектах, добавьте флаг -g.
Выполните в терминале в папке проекта
npx skills add snailsploit/claude-red --skill offensive-active-directory offensive-ai-security offensive-api-abuse offensive-api-security offensive-jwt offensive-oauth offensive-cicd-pipeline offensive-cicd-secrets offensive-cloud offensive-container-escape offensive-k8s-attacks offensive-crypto-attacks offensive-tls-attacks offensive-basic-exploitation offensive-crash-analysis offensive-exploit-dev-course offensive-exploit-development offensive-mitigations offensive-toctou offensive-anti-forensics offensive-c2-frameworks offensive-bug-identification offensive-fuzzing-course offensive-fuzzing offensive-vuln-classes offensive-advanced-redteam offensive-edr-evasion offensive-initial-access offensive-keylogger-arch offensive-shellcode offensive-windows-boundaries offensive-windows-mitigations offensive-iot offensive-mobile offensive-network-attacks offensive-data-exfiltration offensive-lateral-movement offensive-persistence offensive-linux-privesc offensive-windows-privesc offensive-osint-methodology offensive-osint offensive-phishing offensive-social-engineering offensive-dependency-confusion offensive-supply-chain offensive-wifi offensive-wifi-recon offensive-wpa2-psk offensive-wpa3-sae offensive-wpa-enterprise offensive-wps offensive-evil-twin offensive-krack-fragattacks offensive-deauth-disassoc offensive-bluetooth-ble offensive-bluetooth-classic offensive-zigbee-thread-matter offensive-z-wave offensive-lorawan-sub-ghz offensive-fast-checking offensive-reporting offensive-sqli offensive-xss offensive-ssrf offensive-ssti offensive-xxe offensive-idor offensive-file-upload offensive-rce offensive-deserialization offensive-race-condition offensive-request-smuggling offensive-open-redirect offensive-parameter-pollution offensive-graphql offensive-waf-bypass offensive-business-logic -a github-copilot -yУтилита skills ставит текущую версию из репозитория. Чтобы скилл работал во всех проектах, добавьте флаг -g.
Выполните в терминале в папке проекта
npx skills add snailsploit/claude-red --skill offensive-active-directory offensive-ai-security offensive-api-abuse offensive-api-security offensive-jwt offensive-oauth offensive-cicd-pipeline offensive-cicd-secrets offensive-cloud offensive-container-escape offensive-k8s-attacks offensive-crypto-attacks offensive-tls-attacks offensive-basic-exploitation offensive-crash-analysis offensive-exploit-dev-course offensive-exploit-development offensive-mitigations offensive-toctou offensive-anti-forensics offensive-c2-frameworks offensive-bug-identification offensive-fuzzing-course offensive-fuzzing offensive-vuln-classes offensive-advanced-redteam offensive-edr-evasion offensive-initial-access offensive-keylogger-arch offensive-shellcode offensive-windows-boundaries offensive-windows-mitigations offensive-iot offensive-mobile offensive-network-attacks offensive-data-exfiltration offensive-lateral-movement offensive-persistence offensive-linux-privesc offensive-windows-privesc offensive-osint-methodology offensive-osint offensive-phishing offensive-social-engineering offensive-dependency-confusion offensive-supply-chain offensive-wifi offensive-wifi-recon offensive-wpa2-psk offensive-wpa3-sae offensive-wpa-enterprise offensive-wps offensive-evil-twin offensive-krack-fragattacks offensive-deauth-disassoc offensive-bluetooth-ble offensive-bluetooth-classic offensive-zigbee-thread-matter offensive-z-wave offensive-lorawan-sub-ghz offensive-fast-checking offensive-reporting offensive-sqli offensive-xss offensive-ssrf offensive-ssti offensive-xxe offensive-idor offensive-file-upload offensive-rce offensive-deserialization offensive-race-condition offensive-request-smuggling offensive-open-redirect offensive-parameter-pollution offensive-graphql offensive-waf-bypass offensive-business-logic -a codex -yУтилита skills ставит текущую версию из репозитория. Чтобы скилл работал во всех проектах, добавьте флаг -g.
Выполните в терминале в папке проекта
npx skills add snailsploit/claude-red --skill offensive-active-directory offensive-ai-security offensive-api-abuse offensive-api-security offensive-jwt offensive-oauth offensive-cicd-pipeline offensive-cicd-secrets offensive-cloud offensive-container-escape offensive-k8s-attacks offensive-crypto-attacks offensive-tls-attacks offensive-basic-exploitation offensive-crash-analysis offensive-exploit-dev-course offensive-exploit-development offensive-mitigations offensive-toctou offensive-anti-forensics offensive-c2-frameworks offensive-bug-identification offensive-fuzzing-course offensive-fuzzing offensive-vuln-classes offensive-advanced-redteam offensive-edr-evasion offensive-initial-access offensive-keylogger-arch offensive-shellcode offensive-windows-boundaries offensive-windows-mitigations offensive-iot offensive-mobile offensive-network-attacks offensive-data-exfiltration offensive-lateral-movement offensive-persistence offensive-linux-privesc offensive-windows-privesc offensive-osint-methodology offensive-osint offensive-phishing offensive-social-engineering offensive-dependency-confusion offensive-supply-chain offensive-wifi offensive-wifi-recon offensive-wpa2-psk offensive-wpa3-sae offensive-wpa-enterprise offensive-wps offensive-evil-twin offensive-krack-fragattacks offensive-deauth-disassoc offensive-bluetooth-ble offensive-bluetooth-classic offensive-zigbee-thread-matter offensive-z-wave offensive-lorawan-sub-ghz offensive-fast-checking offensive-reporting offensive-sqli offensive-xss offensive-ssrf offensive-ssti offensive-xxe offensive-idor offensive-file-upload offensive-rce offensive-deserialization offensive-race-condition offensive-request-smuggling offensive-open-redirect offensive-parameter-pollution offensive-graphql offensive-waf-bypass offensive-business-logic -a gemini-cli -yУтилита skills ставит текущую версию из репозитория. Чтобы скилл работал во всех проектах, добавьте флаг -g.
Выполните в терминале в папке проекта
npx skills add snailsploit/claude-red --skill offensive-active-directory offensive-ai-security offensive-api-abuse offensive-api-security offensive-jwt offensive-oauth offensive-cicd-pipeline offensive-cicd-secrets offensive-cloud offensive-container-escape offensive-k8s-attacks offensive-crypto-attacks offensive-tls-attacks offensive-basic-exploitation offensive-crash-analysis offensive-exploit-dev-course offensive-exploit-development offensive-mitigations offensive-toctou offensive-anti-forensics offensive-c2-frameworks offensive-bug-identification offensive-fuzzing-course offensive-fuzzing offensive-vuln-classes offensive-advanced-redteam offensive-edr-evasion offensive-initial-access offensive-keylogger-arch offensive-shellcode offensive-windows-boundaries offensive-windows-mitigations offensive-iot offensive-mobile offensive-network-attacks offensive-data-exfiltration offensive-lateral-movement offensive-persistence offensive-linux-privesc offensive-windows-privesc offensive-osint-methodology offensive-osint offensive-phishing offensive-social-engineering offensive-dependency-confusion offensive-supply-chain offensive-wifi offensive-wifi-recon offensive-wpa2-psk offensive-wpa3-sae offensive-wpa-enterprise offensive-wps offensive-evil-twin offensive-krack-fragattacks offensive-deauth-disassoc offensive-bluetooth-ble offensive-bluetooth-classic offensive-zigbee-thread-matter offensive-z-wave offensive-lorawan-sub-ghz offensive-fast-checking offensive-reporting offensive-sqli offensive-xss offensive-ssrf offensive-ssti offensive-xxe offensive-idor offensive-file-upload offensive-rce offensive-deserialization offensive-race-condition offensive-request-smuggling offensive-open-redirect offensive-parameter-pollution offensive-graphql offensive-waf-bypass offensive-business-logic -a cline -yУтилита skills ставит текущую версию из репозитория. Чтобы скилл работал во всех проектах, добавьте флаг -g.
Выполните в терминале в папке проекта
npx skills add snailsploit/claude-red --skill offensive-active-directory offensive-ai-security offensive-api-abuse offensive-api-security offensive-jwt offensive-oauth offensive-cicd-pipeline offensive-cicd-secrets offensive-cloud offensive-container-escape offensive-k8s-attacks offensive-crypto-attacks offensive-tls-attacks offensive-basic-exploitation offensive-crash-analysis offensive-exploit-dev-course offensive-exploit-development offensive-mitigations offensive-toctou offensive-anti-forensics offensive-c2-frameworks offensive-bug-identification offensive-fuzzing-course offensive-fuzzing offensive-vuln-classes offensive-advanced-redteam offensive-edr-evasion offensive-initial-access offensive-keylogger-arch offensive-shellcode offensive-windows-boundaries offensive-windows-mitigations offensive-iot offensive-mobile offensive-network-attacks offensive-data-exfiltration offensive-lateral-movement offensive-persistence offensive-linux-privesc offensive-windows-privesc offensive-osint-methodology offensive-osint offensive-phishing offensive-social-engineering offensive-dependency-confusion offensive-supply-chain offensive-wifi offensive-wifi-recon offensive-wpa2-psk offensive-wpa3-sae offensive-wpa-enterprise offensive-wps offensive-evil-twin offensive-krack-fragattacks offensive-deauth-disassoc offensive-bluetooth-ble offensive-bluetooth-classic offensive-zigbee-thread-matter offensive-z-wave offensive-lorawan-sub-ghz offensive-fast-checking offensive-reporting offensive-sqli offensive-xss offensive-ssrf offensive-ssti offensive-xxe offensive-idor offensive-file-upload offensive-rce offensive-deserialization offensive-race-condition offensive-request-smuggling offensive-open-redirect offensive-parameter-pollution offensive-graphql offensive-waf-bypass offensive-business-logic -a roo -yУтилита skills ставит текущую версию из репозитория. Чтобы скилл работал во всех проектах, добавьте флаг -g.
Форк Roo Code, папки .roo те же.
Выполните в терминале в папке проекта
npx skills add snailsploit/claude-red --skill offensive-active-directory offensive-ai-security offensive-api-abuse offensive-api-security offensive-jwt offensive-oauth offensive-cicd-pipeline offensive-cicd-secrets offensive-cloud offensive-container-escape offensive-k8s-attacks offensive-crypto-attacks offensive-tls-attacks offensive-basic-exploitation offensive-crash-analysis offensive-exploit-dev-course offensive-exploit-development offensive-mitigations offensive-toctou offensive-anti-forensics offensive-c2-frameworks offensive-bug-identification offensive-fuzzing-course offensive-fuzzing offensive-vuln-classes offensive-advanced-redteam offensive-edr-evasion offensive-initial-access offensive-keylogger-arch offensive-shellcode offensive-windows-boundaries offensive-windows-mitigations offensive-iot offensive-mobile offensive-network-attacks offensive-data-exfiltration offensive-lateral-movement offensive-persistence offensive-linux-privesc offensive-windows-privesc offensive-osint-methodology offensive-osint offensive-phishing offensive-social-engineering offensive-dependency-confusion offensive-supply-chain offensive-wifi offensive-wifi-recon offensive-wpa2-psk offensive-wpa3-sae offensive-wpa-enterprise offensive-wps offensive-evil-twin offensive-krack-fragattacks offensive-deauth-disassoc offensive-bluetooth-ble offensive-bluetooth-classic offensive-zigbee-thread-matter offensive-z-wave offensive-lorawan-sub-ghz offensive-fast-checking offensive-reporting offensive-sqli offensive-xss offensive-ssrf offensive-ssti offensive-xxe offensive-idor offensive-file-upload offensive-rce offensive-deserialization offensive-race-condition offensive-request-smuggling offensive-open-redirect offensive-parameter-pollution offensive-graphql offensive-waf-bypass offensive-business-logic -a opencode -yУтилита skills ставит текущую версию из репозитория. Чтобы скилл работал во всех проектах, добавьте флаг -g.
Склонируй репозиторий в каталог скиллов: git clone https://github.com/SnailSploit/claude-red ~/.claude/skills/claude-red. Нужные категории можно поставить скриптом ./install.sh --category web.
Другие способы из описания автора
git clone https://github.com/SnailSploit/claude-red ~/.claude/skills/claude-redСкиллы подхватываются по триггерам в диалоге. Для части направлений используйте разреженное клонирование.
Это чужой код. Посмотрите файлы в репозитории перед установкой.
Что делает
claude-red это набор структурированных файлов SKILL.md, каждый из которых задает агенту экспертную методологию по одной области наступательной безопасности: веб-уязвимости, активный каталог, облако, контейнеры и Kubernetes, разработка эксплойтов, фаззинг, обход EDR, работа с C2 и другие. Скиллы подхватываются по триггерам в диалоге, поэтому контекст расходуется только на нужную тему. По задумке авторов это инструмент для авторизованных red team проектов, разбора находок bug bounty, исследований безопасности, подготовки к CTF и обучения. Скиллы содержат методологию и подсказки по инструментам, а не готовые вредоносные программы.
Для кого. Для специалистов по наступательной безопасности и участников bug bounty, которые работают в рамках разрешенных проектов.
Подходит, если
- Нужна экспертная методология по конкретной поверхности атаки в разрешенном проекте
- Нужна подготовка к CTF или обучение операторов
- Нужно систематически разобрать находки bug bounty
Не подходит, если
- Нет разрешения владельца системы на тестирование
- Нужна защита и харденинг, а не методология атаки
Пример запроса к агенту
Помоги составить план проверки веб-приложения на SQL-инъекции в рамках разрешенного тестаОграничения
Скиллы дают методологию и направляют работу, но не выполняют атаки сами и не заменяют разрешение на тестирование. Применение техник против чужих систем без согласия владельца незаконно. Материал на английском и рассчитан на подготовленного специалиста.
Как отключить. Удалите папку claude-red из каталога скиллов, например ~/.claude/skills/claude-red.
Проверка безопасности
- Направляет наступательные действия против систем
- Применение без разрешения владельца цели незаконно
- Рассчитан на подготовленного специалиста
Коротко о README
README описывает claude-red как курируемую библиотеку скиллов по наступательной безопасности для системы Claude Skills. Каждый скилл это файл SKILL.md, который задает методологию по одной поверхности атаки и загружается по триггерам в диалоге. Названы сценарии: авторизованные red team проекты, bug bounty, исследования, CTF и обучение. Установка: клон в каталог скиллов, разреженное клонирование отдельных категорий, скрипт install.sh или вставка содержимого в системный промпт. Лицензия MIT.
Частые вопросы
Скиллы запускают атаки сами?
Нет. Это файлы SKILL.md с методологией и подсказками по инструментам, действия выполняет специалист в рамках разрешенного проекта.
Как поставить только часть?
Через разреженное клонирование или install.sh с флагом категории, тогда встанут только выбранные направления.
Похожие
Скилл аудита безопасности кода от Cloudflare: агент проходит разведку, охоту по покрытию и независимую проверку находок и выдает структурированный отчет
Открытый стек NVIDIA для запуска OpenClaw, Hermes и LangChain Deep Agents в песочницах OpenShell с сетевыми политиками и управляемым инференсом
Сканер безопасности для скиллов и MCP агентов: ищет промпт-инъекции, утечки данных и риски цепочки поставок до установки
Статический анализ кода по правилам, похожим на сам код, со встроенным MCP-сервером для AI-агентов