claude-red is a library of structured skills that give Claude specialized offensive-security methods for areas such as web vulnerabilities, shellcode, exploit development, and identity systems. It is intended for authorized red-team work, bug-bounty triage, security research, CTF preparation, and operator training. Its catalogue contains the project's skills for loading these security specializations into Claude.
Getting it into your agent
There is no command for this one: it runs only inside a plugin, and the catalogue could not identify which plugin ships it. The source is linked below.
Wrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/snailsploit/claude-red/offensive-fuzzing-course)<a href="https://agentmods.dev/skills/snailsploit/claude-red/offensive-fuzzing-course"><img src="https://agentmods.dev/badge/skills/snailsploit/claude-red/offensive-fuzzing-course.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.22254 |
| Opus 5 | $0.00000 | $0.11127 |
| Sonnet 5 | $0.00000 | $0.04451 |
| Haiku 4.5 | $0.00000 | $0.02225 |
Grade C, and why
offensive-fuzzing-course scanned grade C with 4 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootlowPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
sudo apt update Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Downloads and executes remote codemediumSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl --proto '=https' --tlsv1.2 -sSf "https://sh.rustup.rs" | sh Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Unrestricted tool accesslowExcessive agency
A wildcard tool grant or "run any command" leaves no least-privilege boundary at all.
- Execute arbitrary code Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
ninja-build cmake git wget python3.12-venv meson How it starts
The opening of the file, as written. The whole thing — 2,104 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SKILL: Week 2: Finding Vulnerabilities Through Fuzzing
Metadata
- Skill Name: fuzzing-course
- Folder: offensive-fuzzing-course
- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/2-fuzzing.md
Description
Week 2 of the exploit development curriculum. Covers fuzzing methodology: target selection, corpus generation, coverage-guided fuzzing with AFL++/libFuzzer, structured fuzzing, and triage/deduplication. Use when setting up fuzz campaigns, selecting harness strategies, or triaging fuzzer output.
Trigger Phrases
Use this skill when the conversation involves any of:
fuzzing curriculum, AFL++, libFuzzer, coverage-guided fuzzing, corpus generation, harness, fuzz target, mutation, triage, crash dedup, week 2, exploit dev course
Instructions for Claude
When this skill is active:
- Load and apply the full methodology below as your operational checklist
- Follow steps in order unless the user specifies otherwise
- For each technique, consider applicability to the current target/context
- Track which checklist items have been completed
- Suggest next steps based on findings
Full Methodology
Week 2: Finding Vulnerabilities Through Fuzzing
Overview
created by AnotherOne from @Pwn3rzs Telegram channel.
This document is Week 2 of a multi‑week exploit development course, focusing on discovering vulnerabilities through fuzzing techniques and analyzing the crashes to determine exploitability.
Last week we studied vulnerability classes through real-world examples. This week we'll learn to find these vulnerabilities ourselves using fuzzing - the automated technique that has discovered thousands of critical security bugs in production software.
Fuzzing can feel a bit front‑loaded: you may spend time wiring harnesses and running campaigns without immediately finding exciting new bugs, especially on hardened or well‑tested targets. That’s normal, and it's one reason the next week on patch diffing often feels more directly "practical" — many companies already run large fuzzing setups and need people who can understand and exploit the bugs those systems uncover. Still, working through this week is important: it teaches you how fuzzers actually discover real vulnerabilities, so when you later triage crashes or study patches, you'll have a solid intuition for how those bugs were found and how to reproduce them.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 2,104 lines · 0 tokens per session scan C 1094410fb2a8
offensive-fuzzing-course is a skill published in the GitHub repository SnailSploit/Claude-Red (3,040 stars, last pushed 8d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 22,254 tokens. A static security scan graded it C with 4 findings (asks for root, downloads and executes remote code, unrestricted tool access). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
verification-contract
Internal contract: one compact frozen ACCEPTANCE.md per delivery unit, its validation ladder, anti-weakening rules, and blob-bound execution receipt. Consumed by planners, execute-phase, and review-change.
smoke-test
Launch the app and hands-on verify that it works by interacting with it. Falls back to an existing integration test suite when there is no interactive surface in scope. Use when the user asks to "smoke test", "test it manually", "verify it works", "try it out", "run a smoke test", "check it in the browser", or "does…
exploratory-test
Execute multi-level exploratory testing of the app covering basic functionality, complex operations, adversarial testing, and cross-cutting scenarios, plus usability observations through a UX lens reported separately from defects. Deeper than /smoke-test. Use when the user asks to "exploratory test", "test…
create-test-plan
Analyze what changed and generate a structured test plan at .turbo/test-plans/ .md covering four escalating levels: basic functionality, complex operations, adversarial testing, and cross-cutting scenarios. Use when the user asks to "create a test plan", "plan tests", "what should I test", "generate test scenarios"…
quick-finalize
Close out a change without the deep review loop: stage, simplify code and docs, run the project's checks, smoke test, update the changelog, self-improve, and ship. Use when the user asks to "quick finalize", "quickly finalize", "finalize quickly", "light finalize", "wrap this up quickly", "close this out without the…
run-checks
Run the project's full verification gate: every check the project defines as a pass/fail condition, built from its CI config, check scripts, and configured tools, or from a formatter-linter-test baseline when it declares none. Use when the user asks to "run checks", "run the verification gate", "run lint and tests"…