Directory · #68 trending skills repo · ↗ +410 stars this week
Claude-Red
SnailSploit/Claude-Red
claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.
- Stars
- 10k
- This week
- +410
- Forks
- 1.4k
- Open issues
- 37
- Skills inside
- 79
Get started
Install the skills
npx skills add SnailSploit/Claude-RedInstalls into Claude Code, Codex, Cursor, OpenCode and the other agents it finds on your machine.
git clone --depth 1 https://github.com/SnailSploit/Claude-Red.git /tmp/claude-red
cp -r /tmp/claude-red ~/.claude/skills/claude-redClaude Code reads ~/.claude/skills/ (or .claude/skills/ in a project). Other agents read the same SKILL.md format from their own skills folder.
Inside this repo
48 of 79 skills
offensive-active-directoryActive Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential abuse (Kerberoasting, ASREProasting, NTLM relay, LLMNR/NBT-NS poisoning), privilege escalation (ACL abuse, GPO abuse, unconstrained/constrained delegat
Skills/active-directory/offensive-active-directoryoffensive-netexecUse this skill whenever the user asks about NetExec (nxc) — a network exploitation and post-exploitation tool for Active Directory environments. Triggers include: any mention of 'nxc', 'netexec', 'crackmapexec' successor questions, AD enumeration, SMB/LDAP/WinRM/MSSQL/SSH/RDP/VNC/WMI/FTP/NFS protocoSkills/active-directory/offensive-netexecoffensive-ai-securitySkills/ai/offensive-ai-securityoffensive-api-abuseAdvanced API exploitation methodology focused on business logic abuse and sophisticated attack patterns that bypass traditional security controls. Covers business logic bypass through API call chaining and workflow manipulation. Addresses GraphQL-specific attacks including batching for credential brSkills/api/offensive-api-abuseoffensive-api-securityComprehensive API security testing methodology covering REST, gRPC, and WebSocket attack surfaces. Addresses the full OWASP API Security Top 10 2023 including BOLA/IDOR, broken authentication, excessive data exposure, rate limiting bypass, BFLA, mass assignment, SSRF, and security misconfiguration. Skills/api/offensive-api-securityoffensive-jwtJWT attack methodology for penetration testers. Covers algorithm confusion (alg:none, RS256→HS256), weak HMAC secret brute force, kid parameter injection (SQLi, path traversal), jku/x5u/jwk header injection, JWKS cache poisoning, JWS/JWE confusion, timing attacks, and mobile JWT storage extraction. Skills/auth/offensive-jwtoffensive-oauthSkills/auth/offensive-oauthoffensive-cicd-pipelineComprehensive CI/CD pipeline exploitation methodology covering GitHub Actions injection vectors (expression injection via PR titles and issue bodies, workflow_run event abuse, GITHUB_TOKEN over-scoping, composite action supply chain compromise), Jenkins attack paths (Groovy sandbox escapes, script cSkills/cicd/offensive-cicd-pipelineoffensive-cicd-secretsComprehensive secrets extraction methodology targeting CI/CD environments across all major platforms. Covers environment variable extraction from build contexts, exploitation of vault and secrets-manager misconfigurations (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager), rSkills/cicd/offensive-cicd-secretsoffensive-cloudCloud security attack methodology covering AWS, Azure, and GCP. Includes credential harvesting (IMDS, ~/.aws, env vars, leaked CI secrets, instance roles), enumeration with cloud-specific tools (pacu, ScoutSuite, Prowler, ROADtools, gcp_enum), privilege escalation paths (IAM PassRole, AssumeRole chaSkills/cloud/offensive-cloudoffensive-container-escapeContainer escape and breakout techniques targeting Docker, containerd, and Podman runtimes. Covers privileged container breakout via host filesystem mount and nsenter, Docker socket abuse through /var/run/docker.sock, Linux capability exploitation including CAP_SYS_ADMIN, CAP_SYS_PTRACE, and CAP_NETSkills/container/offensive-container-escapeoffensive-k8s-attacksKubernetes cluster attack techniques covering the full attack lifecycle from initial foothold in a pod to cluster-wide compromise. Covers service account token theft and impersonation, RBAC misconfiguration exploitation including wildcard permissions and privilege escalation via role binding, directSkills/container/offensive-k8s-attacksoffensive-crypto-attacksSystematic methodology for identifying and exploiting cryptographic implementation weaknesses in real-world applications. Covers padding oracle attacks against CBC-mode ciphers with PKCS7 padding (Vaudenay's original attack through modern padbuster automation), ECB mode exploitation including block Skills/crypto/offensive-crypto-attacksoffensive-tls-attacksComprehensive methodology for auditing and exploiting TLS/SSL implementations and misconfigurations across network services and mobile applications. Covers protocol downgrade attacks including POODLE (CVE-2014-3566) against SSLv3 CBC padding, DROWN (CVE-2016-0800) cross-protocol attack leveraging SSSkills/crypto/offensive-tls-attacksoffensive-basic-exploitationSkills/exploit-dev/offensive-basic-exploitationoffensive-crash-analysisSkills/exploit-dev/offensive-crash-analysisoffensive-exploit-dev-courseSkills/exploit-dev/offensive-exploit-dev-courseoffensive-exploit-developmentSkills/exploit-dev/offensive-exploit-developmentoffensive-mitigationsSkills/exploit-dev/offensive-mitigationsoffensive-toctouTime-of-Check / Time-of-Use (TOCTOU) race condition exploitation methodology across binary, kernel, filesystem, web, and container layers. Covers symbolic-link races (open/access/stat split), file-descriptor races, fopen/realpath traversal races, /proc and procfs races, FUSE-backed slow-fs races to Skills/exploit-dev/offensive-toctouoffensive-anti-forensicsAnti-forensics and evidence destruction techniques for red team operators conducting authorized engagements. Covers log clearing on Windows (wevtutil, Clear-EventLog, ETW provider patching) and Linux (journal truncation, utmp/wtmp binary editing, syslog manipulation), timestamp manipulation via TimeSkills/forensics/offensive-anti-forensicsoffensive-c2-frameworksCommand and Control framework deployment, configuration, and operational tradecraft for red team engagements. Covers Cobalt Strike (malleable C2 profiles, Beacon types HTTP/HTTPS/DNS/SMB, Beacon Object Files for in-memory execution, sleep and jitter tuning, named pipe pivoting), Sliver (implant geneSkills/forensics/offensive-c2-frameworksoffensive-bug-identificationSkills/fuzzing/offensive-bug-identificationoffensive-fuzzing-courseSkills/fuzzing/offensive-fuzzing-courseoffensive-fuzzingPractical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness writing, corpus curation, mutation strategies, coverage measurement, and crash triage. Use when setting up or running fuzz campaigns against any target:Skills/fuzzing/offensive-fuzzingoffensive-vuln-classesSkills/fuzzing/offensive-vuln-classesoffensive-advanced-redteamComprehensive red team operations methodology covering full engagement lifecycle from planning through reporting. Addresses engagement scoping and rules of engagement negotiation, multi-tier C2 infrastructure design with redirectors and domain fronting, malleable traffic profiles and beacon tradecraSkills/infrastructure/offensive-advanced-redteamoffensive-edr-evasionSkills/infrastructure/offensive-edr-evasionoffensive-initial-accessSkills/infrastructure/offensive-initial-accessoffensive-keylogger-archSkills/infrastructure/offensive-keylogger-archoffensive-shellcodeShellcode development reference for offensive security engagements. Use when writing custom x86/x64 shellcode, implementing position-independent code (PIC), building shellcode loaders, evading AV/EDR detection, or converting PE files to shellcode. Covers null byte avoidance, API hashing, encoder/decSkills/infrastructure/offensive-shellcodeoffensive-windows-boundariesSkills/infrastructure/offensive-windows-boundariesoffensive-windows-mitigationsSkills/infrastructure/offensive-windows-mitigationsoffensive-iotIoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware acquisition (vendor portals, OTA capture, flash dump, binwalk extraction), firmware analysis (filesystem mounting, binary triage, hardcoded secrets, Skills/iot/offensive-iotoffensive-mobileMobile (Android + iOS) application penetration testing methodology. Covers static analysis (apktool/jadx for Android, class-dump/Hopper/IDA for iOS), dynamic instrumentation with Frida and Objection, SSL pinning bypass strategies, root/jailbreak detection bypass, deep-link / URL-scheme abuse, exportSkills/mobile/offensive-mobileoffensive-network-attacksDense description covering ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, DNS poisoning, MITM attacks, VLAN hopping, DHCP attacks, 802.1X/NAC bypass, IPv6 attacks. Tools: Bettercap, Responder, mitm6, Ettercap, Wireshark. MITRE T1557, T1040. Use when conducting internal network assessments or testing LaySkills/network/offensive-network-attacksoffensive-data-exfiltrationDense methodology covering DNS exfiltration (dnscat2, iodine, dns2tcp), HTTPS tunneling (domain fronting, CDN abuse, legitimate service channels), ICMP tunneling (icmpsh, ptunnel-ng), cloud storage dead drops (S3 presigned URLs, Azure Blob SAS tokens, GCS signed URLs), email-based exfil (SMTP, EWS, Skills/post-exploitation/offensive-data-exfiltrationoffensive-lateral-movementComprehensive lateral movement tradecraft for authorized red team engagements covering credential-based movement (pass-the-hash, pass-the-ticket, overpass-the-hash), NTLM relay attacks (ntlmrelayx with PetitPotam, DFSCoerce, PrinterBug coercion), remote execution protocols (WMI, WinRM, DCOM, PsExec Skills/post-exploitation/offensive-lateral-movementoffensive-persistenceComprehensive persistence tradecraft for authorized red team engagements covering Windows and Linux mechanisms. Windows techniques include registry Run/RunOnce keys, scheduled tasks, WMI event subscriptions, DLL search order hijacking, COM object hijacking, Startup folder drops, service creation, SeSkills/post-exploitation/offensive-persistenceoffensive-linux-privescComprehensive Linux privilege escalation methodology for offensive security engagements. Covers the full attack surface from a low-privilege shell to root: SUID/SGID binary abuse via GTFOBins, Linux capabilities exploitation (cap_setuid, cap_dac_override, cap_dac_read_search), sudo misconfigurationsSkills/privesc/offensive-linux-privescoffensive-windows-privescComprehensive Windows privilege escalation methodology for offensive security engagements. Covers the full attack surface from a standard user shell to NT AUTHORITY\\SYSTEM: token impersonation via SeImpersonate and SeAssignPrimaryToken privileges using JuicyPotato, PrintSpoofer, GodPotato, SweetPotSkills/privesc/offensive-windows-privescoffensive-osint-methodologySkills/recon/offensive-osint-methodologyoffensive-osintComprehensive OSINT methodology skill for offensive security, red team intelligence gathering, and bug bounty reconnaissance. Covers domain recon, email harvesting, social media profiling, GitHub/code leaks, Shodan/Censys enumeration, breach data lookup, employee profiling, infrastructure mapping, cSkills/recon/offensive-osintoffensive-phishingPhishing campaign execution methodology for authorized red team engagements. Covers end-to-end campaign lifecycle: infrastructure provisioning (GoPhish, SMTP relay configuration, domain acquisition and aging, SPF/DKIM/DMARC alignment), payload delivery vectors (Office macro weaponization, HTA droppeSkills/social-engineering/offensive-phishingoffensive-social-engineeringSocial engineering attack techniques beyond email phishing for authorized red team and physical penetration testing engagements. Covers pretexting methodology (persona creation, authority and urgency psychological triggers, rapport building), vishing (voice phishing via caller ID spoofing, IVR systeSkills/social-engineering/offensive-social-engineeringoffensive-dependency-confusionDeep-dive offensive methodology for dependency confusion and namespace attacks across all major package ecosystems. Covers npm scope confusion exploiting the gap between public and private scoped packages and .npmrc misconfigurations where registry mappings fail to pin internal scopes exclusively. ASkills/supply-chain/offensive-dependency-confusionoffensive-supply-chainComprehensive offensive methodology for software supply chain attacks covering the full kill chain from reconnaissance through exploitation. Addresses dependency confusion across npm, PyPI, and NuGet ecosystems where internal registry override allows an attacker to inject malicious packages that shaSkills/supply-chain/offensive-supply-chainoffensive-fast-checkingSkills/utility/offensive-fast-checkingDocumentation
README
claude-red
Offensive security skills for Claude — drop-in SKILL.md files that turn Claude into a context-aware red team operator.
Overview • Quickstart • Categories • Skill Index • Roadmap • Contributing
Overview
claude-red is a curated library of offensive security skills for the Claude Skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQL injection to shellcode, EDR evasion to ADCS abuse.
Drop a skill into your Claude environment and it behaves like a domain specialist: it knows the techniques, the tooling, the edge cases, and the escalation paths. Skills load on demand based on conversational triggers — you don't pay context for skills you aren't using.
Use cases: authorized red team engagements, bug bounty triage, security research, CTF preparation, operator training, and methodical attack surface exploration.
for our actual research using skills -> https://snailsploit.com
Quickstart
Claude Skills System (Recommended)
git clone https://github.com/SnailSploit/claude-red ~/.claude/skills/claude-red
Claude auto-loads matching skills based on conversational triggers (e.g., mentioning SQL injection loads offensive-sqli).
To install a single category:
git clone --filter=blob:none --sparse https://github.com/SnailSploit/claude-red
cd claude-red && git sparse-checkout set Skills/web Skills/active-directory
Claude Code
cat Skills/web/offensive-sqli/SKILL.md | claude --system-file -
cat Skills/active-directory/**/SKILL.md | claude --system-file -
Claude.ai (Manual)
Paste the contents of a SKILL.md into a Project's system prompt or prepend it to your conversation.
Install Script
./install.sh # interactive
./install.sh --target ~/.claude/skills # explicit target
./install.sh --category web # single category
Categories
| Category | Skills | Focus |
|---|---|---|
| Web Application | 16 | OWASP Top 10, business logic, advanced web vulnerability classes |
| Auth & Identity | 2 | JWT exploitation, OAuth/OIDC abuse |
| Active Directory | 1 | On-prem AD attack methodology |
| Wireless | 14 | 802.11, WPA2/3, EAP, WPS, evil-twin, BLE, Zigbee, Z-Wave, LoRa, sub-GHz |
| Cloud | 1 | AWS, Azure, GCP attack paths |
| Mobile | 1 | Android and iOS application testing |
| IoT & Embedded | 1 | Hardware, firmware, RTOS, ICS/OT |
| Infrastructure & Red Team | 7 | Initial access, EDR evasion, advanced red team operations, Windows internals |
| Exploit Development | 6 | Stack/heap corruption, ROP, mitigations, crash analysis, TOCTOU |
| Fuzzing & Vulnerability Research | 4 | libFuzzer, AFL++, coverage-guided fuzzing, vulnerability taxonomy |
| Reconnaissance | 2 | OSINT tooling and structured intelligence collection |
| API Security | 2 | REST/gRPC/WebSocket testing, business logic abuse |
| Container & Kubernetes | 2 | Container escape, Kubernetes cluster exploitation |
| CI/CD & Pipeline | 2 | Pipeline exploitation, secrets extraction |
| Cryptography | 2 | Cryptographic implementation attacks, TLS/SSL |
| Privilege Escalation | 2 | Linux and Windows privilege escalation |
| Post-Exploitation | 3 | Lateral movement, persistence mechanisms, data exfiltration |
| Forensics & C2 | 2 | Anti-forensics tradecraft, C2 framework operations |
| Supply Chain | 2 | Supply chain attacks, dependency confusion |
| Social Engineering | 2 | Phishing campaigns, physical/vishing/smishing |
| Network Attacks | 1 | Layer 2/3 attacks, MITM, protocol poisoning |
| AI Security | 1 | Prompt injection, jailbreaking, RAG poisoning |
| Utility | 2 | Fast triage checklists, professional reporting |
Skill Index
Web Application
Skills/web/
| Skill | Description |
|---|---|
offensive-sqli |
SQL injection — error-based, blind, OOB, DB-specific payloads, ORM CVEs |
offensive-xss |
Cross-site scripting — stored, reflected, DOM-based, mutation XSS |
offensive-ssrf |
Server-side request forgery — cloud metadata pivots, filter bypass |
offensive-ssti |
Server-side template injection — engine fingerprinting, RCE chains |
offensive-xxe |
XML external entity — OOB exfiltration, blind XXE techniques |
offensive-idor |
Insecure direct object references — enumeration, authorization bypass |
offensive-file-upload |
File upload — extension bypass, polyglot files, webshell deployment |
offensive-rce |
Remote code execution — command injection, deserialization chains |
offensive-deserialization |
Insecure deserialization — Java, PHP, .NET gadget chains |
offensive-race-condition |
Race conditions — TOCTOU, single-packet attacks, limit bypass |
offensive-request-smuggling |
HTTP request smuggling — CL.TE, TE.CL, H2 desync |
offensive-open-redirect |
Open redirect — OAuth token theft, phishing, SSRF pivots |
offensive-parameter-pollution |
HTTP parameter pollution — WAF bypass, logic confusion |
offensive-graphql |
GraphQL — introspection abuse, batching attacks, alias-based IDOR |
offensive-waf-bypass |
WAF bypass — encoding tricks, chunked transfer, case mutation |
offensive-business-logic |
Business logic — workflow bypass, pricing abuse, multi-step chains |
Auth & Identity
Skills/auth/
| Skill | Description |
|---|---|
offensive-jwt |
JWT attacks — alg:none, key confusion, secret cracking, claim tampering |
offensive-oauth |
OAuth/OIDC — redirect URI abuse, token leakage, PKCE bypass |
Active Directory
Skills/active-directory/
| Skill | Description |
|---|---|
offensive-active-directory |
AD methodology — Kerberoast, ASREProast, ACL abuse, ADCS ESC1-15, delegation, hybrid AAD |
Wireless
Skills/wireless/
| Skill | Description |
|---|---|
offensive-wifi |
802.11 overview — entrypoint for wireless assessments |
offensive-wifi-recon |
Adapter configuration, monitor mode, multi-band airspace mapping |
offensive-wpa2-psk |
WPA2-PSK — handshake capture, PMKID extraction, hashcat cracking |
offensive-wpa3-sae |
WPA3-SAE — transition-mode downgrade, Dragonblood, side-channel attacks |
offensive-wpa-enterprise |
802.1X/EAP — credential relay, evil-twin RADIUS, certificate abuse |
offensive-wps |
WPS — Pixie Dust offline attack, online PIN brute force, vendor PIN prediction |
offensive-evil-twin |
Evil twin — KARMA, Mana, captive portal credential capture, MITM |
offensive-krack-fragattacks |
KRACK and FragAttacks — supplicant vulnerability testing |
offensive-deauth-disassoc |
Deauthentication — targeted/broadcast frames, PMF awareness |
offensive-bluetooth-ble |
Bluetooth LE — GATT enumeration, pairing downgrade, sniffing, MITM |
offensive-bluetooth-classic |
Bluetooth BR/EDR — SDP probing, KNOB attack, BlueBorne, HID spoofing |
offensive-zigbee-thread-matter |
802.15.4 mesh — KillerBee, Touchlink commissioning abuse, ZCL injection |
offensive-z-wave |
Z-Wave — S0 key derivation, S2 commissioning attacks, hub pivots |
offensive-lorawan-sub-ghz |
LoRaWAN and sub-GHz — ABP/OTAA attacks, KeeLoq, fixed-code replay, TPMS |
Cloud
Skills/cloud/
| Skill | Description |
|---|---|
offensive-cloud |
Multi-cloud — privilege escalation, IMDS abuse, cross-account pivots, CSPM evasion |
Mobile
Skills/mobile/
| Skill | Description |
|---|---|
offensive-mobile |
Android and iOS — Frida hooking, certificate pinning bypass, storage, biometric flaws |
IoT & Embedded
Skills/iot/
| Skill | Description |
|---|---|
offensive-iot |
IoT/OT — hardware interfaces, firmware extraction, RTOS, ICS protocols, MQTT/CoAP |
Infrastructure & Red Team
Skills/infrastructure/
| Skill | Description |
|---|---|
offensive-initial-access |
Initial access — phishing payloads, drive-by delivery, supply chain vectors (TA0001) |
offensive-advanced-redteam |
Full kill chain — C2 infrastructure, OPSEC, lateral movement, persistence |
offensive-edr-evasion |
EDR evasion — userland unhooking, indirect syscalls, PPID spoofing |
offensive-shellcode |
Shellcode — writing, encoding, injection techniques, position-independent code |
offensive-keylogger-arch |
Input capture — keylogger architecture, hooking mechanisms |
offensive-windows-mitigations |
Windows mitigations — ACG, CIG, CFG, CET bypass techniques |
offensive-windows-boundaries |
Windows boundary defeat — sandbox escape, integrity level bypass |
Exploit Development
Skills/exploit-dev/
| Skill | Description |
|---|---|
offensive-exploit-development |
Exploit development — stack/heap corruption, ROP chains, mitigation bypass |
offensive-exploit-dev-course |
Structured exploit development curriculum |
offensive-basic-exploitation |
Linux binary exploitation — beginner to intermediate, mitigations disabled |
offensive-crash-analysis |
Crash triage — exploitability assessment, root-cause analysis |
offensive-mitigations |
Modern mitigations — ASLR, CFG, CET, PAC analysis and bypass |
offensive-toctou |
TOCTOU race conditions — binary, kernel, web, and container contexts |
Fuzzing & Vulnerability Research
Skills/fuzzing/
| Skill | Description |
|---|---|
offensive-fuzzing |
Fuzzing — libFuzzer, AFL++, coverage-guided strategies, mutation engines |
offensive-fuzzing-course |
Vulnerability discovery through fuzzing — structured curriculum |
offensive-bug-identification |
Bug identification — code review patterns, static analysis triggers |
offensive-vuln-classes |
Vulnerability taxonomy — real-world examples, classification frameworks |
Reconnaissance
Skills/recon/
| Skill | Description |
|---|---|
offensive-osint |
OSINT tooling — recon-ng, theHarvester, Maltego, Spiderfoot |
offensive-osint-methodology |
OSINT methodology — structured intelligence collection and analysis |
API Security
Skills/api/
| Skill | Description |
|---|---|
offensive-api-security |
API testing — OWASP API Top 10, BOLA, BFLA, mass assignment, rate limiting |
offensive-api-abuse |
API business logic — endpoint chaining, batching abuse, webhook hijacking |
Container & Kubernetes
Skills/container/
| Skill | Description |
|---|---|
offensive-container-escape |
Container breakout — privileged mode, Docker socket, capabilities, runc CVEs |
offensive-k8s-attacks |
Kubernetes attacks — RBAC abuse, etcd access, kubelet API, pod escape, CRD exploitation |
CI/CD & Pipeline
Skills/cicd/
| Skill | Description |
|---|---|
offensive-cicd-pipeline |
CI/CD exploitation — GitHub Actions injection, Jenkins RCE, GitLab CI abuse |
offensive-cicd-secrets |
CI/CD secrets — environment variable extraction, vault misconfigs, runner token abuse |
Cryptography
Skills/crypto/
| Skill | Description |
|---|---|
offensive-crypto-attacks |
Cryptographic attacks — padding oracle, ECB manipulation, hash extension, weak PRNG |
offensive-tls-attacks |
TLS/SSL attacks — POODLE, DROWN, Heartbleed, pinning bypass, 0-RTT replay |
Privilege Escalation
Skills/privesc/
| Skill | Description |
|---|---|
offensive-linux-privesc |
Linux privilege escalation — SUID, capabilities, sudo, cron, kernel exploits |
offensive-windows-privesc |
Windows privilege escalation — Potato family, service misconfigs, DLL hijacking, UAC bypass |
Post-Exploitation
Skills/post-exploitation/
| Skill | Description |
|---|---|
offensive-lateral-movement |
Lateral movement — PTH, PTT, NTLM relay, WMI/WinRM/DCOM, tunneling |
offensive-persistence |
Persistence — registry, scheduled tasks, WMI subscriptions, ticket forgery, PAM backdoors |
offensive-data-exfiltration |
Data exfiltration — DNS/HTTPS/ICMP tunneling, cloud staging, steganography |
Forensics & C2
Skills/forensics/
| Skill | Description |
|---|---|
offensive-anti-forensics |
Anti-forensics — log manipulation, timestomping, ADS abuse, memory cleanup |
offensive-c2-frameworks |
C2 tradecraft — Cobalt Strike, Sliver, Mythic, Havoc, redirectors, domain fronting |
Supply Chain
Skills/supply-chain/
| Skill | Description |
|---|---|
offensive-supply-chain |
Supply chain attacks — dependency confusion, typosquatting, build system compromise |
offensive-dependency-confusion |
Dependency confusion — npm/PyPI/NuGet/Maven namespace attacks, safe PoC methodology |
Social Engineering
Skills/social-engineering/
| Skill | Description |
|---|---|
offensive-phishing |
Phishing — GoPhish, EvilGinx2, payload delivery, email authentication bypass |
offensive-social-engineering |
Social engineering — pretexting, vishing, smishing, physical SE, USB drops |
Network Attacks
Skills/network/
| Skill | Description |
|---|---|
offensive-network-attacks |
Network layer attacks — ARP spoofing, LLMNR/NBT-NS poisoning, VLAN hopping, MITM |
AI Security
Skills/ai/
| Skill | Description |
|---|---|
offensive-ai-security |
AI/ML security — prompt injection, jailbreaking, RAG poisoning, model extraction |
Utility
Skills/utility/
| Skill | Description |
|---|---|
offensive-fast-checking |
Fast triage — quick-win identification checklists |
offensive-reporting |
Professional reporting — CVSS scoring, evidence standards, executive summaries |
Roadmap
The library is being expanded across multiple phases. See CHANGELOG.md for release history.
| Phase | Focus | Skills | Status |
|---|---|---|---|
| 1 | Internal AD/Windows — split into focused skills | +16 | Planned |
| 2 | Cloud Identity — Entra, ADFS, Okta, M365 | +10 | Planned |
| 3 | Wireless — WPA2/3, EAP, BLE, Zigbee, Z-Wave, LoRa, sub-GHz | +12 | Complete |
| 4 | IoT — UART/JTAG, flash extraction, fault injection, RTOS, ICS | +10 | Planned |
| 5 | Web Fundamentals — recon, auth bypass, access control, CSRF, CORS | +8 | Planned |
| 6 | Web Advanced — proto pollution, SAML, OIDC, WebSocket, SSI/ESI | +10 | Planned |
| 7 | Documentation and tooling polish | — | Complete |
| 8 | New categories — 10 new domains with 20 skills | +20 | Complete |
| 9 | Deep rewrites — deserialization, GraphQL, advanced red team, SSTI | — | Complete |
Target: ~130 skills across 23+ categories.
Contributing
Contributions welcome. See CONTRIBUTING.md for the skill template, frontmatter standard, and review process. Focused, single-surface skills are preferred over monolithic overviews.
License
MIT — use freely, attribution appreciated.
Acknowledgements
- Author: Kai Aizen (SnailSploit) — GenAI security research
- Original Checklists: Sahar Shlichov — the offensive checklist collection that many of these skills build on
- Community: Pull requests and feedback that keep the library aligned with the evolving threat landscape
Give Claude the right skill and it stops being a chatbot — it becomes an operator.
snailsploit.com • GitHub • Research • X
Releases