claude-red is a library of structured skills that give Claude specialized offensive-security methods for areas such as web vulnerabilities, shellcode, exploit development, and identity systems. It is intended for authorized red-team work, bug-bounty triage, security research, CTF preparation, and operator training. Its catalogue contains the project's skills for loading these security specializations into Claude.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add SnailSploit/Claude-Red --skill offensive-initial-accessgit clone --depth 1 https://github.com/SnailSploit/Claude-RedWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/snailsploit/claude-red/offensive-initial-access)<a href="https://agentmods.dev/skills/snailsploit/claude-red/offensive-initial-access"><img src="https://agentmods.dev/badge/skills/snailsploit/claude-red/offensive-initial-access/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/snailsploit/claude-red/offensive-initial-access"><img src="https://agentmods.dev/badge/skills/snailsploit/claude-red/offensive-initial-access.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 13 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Supply Chain · line 71 Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.Fix: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS.
- high Anti-Refusal · line 177 Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.Fix: Remove jailbreak framing that nullifies safety policies or restrictions. Skill content must not instruct the agent to ignore its guidelines or operate without guardrails.
- high YARA Match · line 769 YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).Fix: Remove offensive tool references and exploit code. Legitimate agent skills should not contain penetration testing tools, exploit frameworks, or reconnaissance utilities.
- high Prompt Injection · line 842 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Prompt Injection · line 846 This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.Fix: Remove or rewrite any text that instructs the agent to ignore prompts, override safety rules, or trust unverified content. Ensure skill content cannot be injected to alter agent behavior.
- high Prompt Injection · line 866 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Privilege Escalation · line 1219 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 1219 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 1219 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- medium Excessive Agency · line 309 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Rogue Agent · line 388 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 390 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Excessive Agency · line 826 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.15502 |
| Opus 5.5 | $0.00000 | $0.06201 |
| Sonnet 5.5 | $0.00000 | $0.03100 |
| Haiku 4.5 | $0.00000 | $0.01550 |
Grade A, and why
offensive-initial-access scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 1,527 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SKILL: Modern Initial Access
Metadata
- Skill Name: initial-access
- Folder: offensive-initial-access
- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/initial-access.md
Description
Initial access techniques checklist: phishing (spear/smishing), credential stuffing, exposed service exploitation, supply chain attacks, watering hole, VPN/RDP brute force, public-facing application exploitation. Maps to MITRE ATT&CK TA0001. Use when planning initial access phases of red team engagements.
Trigger Phrases
Use this skill when the conversation involves any of:
initial access, phishing, spear phishing, credential stuffing, exposed service, supply chain, watering hole, VPN brute force, RDP attack, MITRE TA0001, initial foothold
Instructions for Claude
When this skill is active:
- Load and apply the full methodology below as your operational checklist
- Follow steps in order unless the user specifies otherwise
- For each technique, consider applicability to the current target/context
- Track which checklist items have been completed
- Suggest next steps based on findings
Full Methodology
Modern Initial Access
Introduction
Typical Initial Access Vectors
- Email with malware attached/linked
- Most attacks using attached malware won't work
- Out of the box protection may not cover
PDF, ISO, IMG, HTML, SVG, PPTM, PPSM, ACCDE - Most URL-based attacks do work
- domain's reputation, age, category should be sound
- domain should use https
- limit number of GET elements and their names
- use HTML Smuggling to evade
- get your domain warmed up (send some legitimate emails first with no attachment and links)
- Advanced attacks may involve delivering backdoored trusted applications (e.g., older Electron apps with V8 exploits) via phishing to bypass application control like WDAC.
- Spear-phishing/ phishing / stealing valid credentials
- Check your mail with Phishious before sending it to your victim
- use decode-spam-headers to analyze returned SMTP headers
- Be aware that default Microsoft Office settings now block macros in files downloaded from the internet (marked with
MOTW). Success often requires significant social engineering to convince users to bypass these protections or using alternative delivery methods (e.g., containers that don't propagateMOTW, signed add-ins). - images and link increase spam score, be wary of it
- don't use
no-replylike usernames - send through
GoPhis -> AWS SOCAT :587 -> smtp.gmail.com -> @target.com - link to websites on trusted domains, like cloud-facing resources
- make sure your webserver blocks automated bots
- Deep‑fake voice or video social‑engineering calls (help‑desk or executive impersonation) to obtain password resets or approve MFA prompts. Generative‑AI tools make cloning voices trivial.
- Business Email Compromise (BEC) / OAuth consent phishing that targets finance or vendor‑portal users, yielding cloud‑token access even where MFA is enabled.
- Malicious OneNote
.oneattachments and OneDrive "Add to Shortcut" abuse: embedded HTA/JS payloads bypass Office macro blocking and spread via cloud sync. - Excel blocks untrusted Internet-origin XLL add-ins by default (M365, 2023+). Smuggled XLLs inside containers may still be blocked once MOTW propagates.
- Malicious browser extensions (Chrome, Edge, Firefox) delivered through fake Web Store listings; hijack session cookies or inject scripts into authenticated SaaS sessions.
- attackers register malicious cloud apps and trick users into granting scopes, giving token-based access that bypasses MFA
- Reusing stolen credentials against external single factor VPN, gateways, etc
- Password Spraying against Office365, custom login pages, VPN gateways
- Exposed RDP with weak credentials and lacking controls
- Unpatched known vulnerable perimeter device, application bugs, default credentials, etc
- Rarely HID-emulating USB sticks
- WiFi Evil Twin -> Route WPA2 Enterprise -> NetNTLMv2 hash cracking -> authenticated network access -> Responder
- Plugging into on-premises LAN -> Responder/mitm6/Ldaprelayx
- SEO poisoning / paid‑search malvertising (e.g., fake PuTTY & WinSCP ads, dominant loader delivery 2024–25) and "quishing" PDFs whose QR codes redirect victims to mobile OAuth login pages
- Consent‑/token‑phishing and Adversary‑in‑the‑Middle (AiTM) proxy kits that steal OAuth session cookies or proxy MFA (e.g., EvilProxy, Tycoon, Dadsec). These vectors bypass MFA by tricking users into granting access to rogue Azure AD / Google Workspace apps.
- Supply‑chain compromise of developer ecosystems:
- malicious NPM / PyPI typosquat packages
- poisoned GitHub Actions or CI/CD secrets exfiltration
- container‑registry deception (imageless Docker Hub repos or
curl | bashinstallers). - First contact often occurs on developer workstations.
- Mass‑exploited perimeter and edge‑device zero‑days (e.g., Ivanti Connect Secure (such as CVE-2023-46805, CVE-2024-21887), MOVEit Transfer (such as CVE-2023-34362), Citrix Bleed) enabling unauthenticated remote code execution before credentials come into play. Maintain a live "current CVEs exploited‑in‑the‑wild" table and apply virtual patching/WAF rules where upgrades lag.
- Cloud & Kubernetes misconfigurations:
- exposed S3 buckets allowing upload‑then‑execute objects
- SSRF into EC2 IMDSv1 or GCP metadata to steal instance credentials
- open Kubernetes API/Argo CD dashboards, and leaked Azure SAS tokens that grant cross‑tenant data extraction.
- OIDC Workload Identity Federation exposed: stolen GKE/EKS service‑account tokens grant cross‑cluster privilege escalation.
- AWS STS credentials embedded in shareable URLs (
GetFederationToken, presigned S3, etc.) leak temporary keys to attackers.
- Mobile initial‑access vectors:
- smishing or WhatsApp/Telegram lures
- QR‑code invoice/resumé phishing that lands on mobile browsers
- rogue Mobile Device Management (MDM) enrolment profiles granting full device admin.
- Passkey/WebAuthn phishing pages that spoof the biometric prompt to hijack FIDO sessions.
- Sideload invitations via fake Apple TestFlight or Test Fairy links deliver malicious iOS/Android apps outside official store review.
- Collaboration‑app abuse:
- malicious Microsoft Teams/Slack/Discord apps with overbroad OAuth scopes
- slash‑command token vacuum
- SharePoint Framework (SPFx) app sideloading
- Discord/Telegram CDN links hosting first‑stage binaries.
- If WinRM over HTTPS (WinRMS, port 5986) is enabled (it's not by default) and its Channel Binding setting remains at the default "Relaxed", it becomes vulnerable to NTLM relay attacks. Relayed credentials (e.g., from coerced HTTP/SMB/LDAP) can grant RCE. Ironically, enabling WinRMS to "harden" a system by disabling HTTP WinRM (port 5985, which is relay-resistant due to internal encryption) can introduce this vulnerability. Key technical details:
- Standard WinRM (port 5985) uses HTTP with SPNEGO; channel binding is enabled by default, so NTLM relay fails unless the attacker controls TLS.
- WinRMS (port 5986) runs over HTTPS; if
CbtHardeningLevelis not set to Strict, credentials can still be relayed despite TLS. - Channel Binding (CBT) can be set to None (disabled), Relaxed (optional), or Strict (required)
- Mitigation:
winrm set winrm/config/service/auth '@{CbtHardeningLevel="Strict"}' - Prefer Kerberos or certificate-based auth for WinRM; monitor and reduce NTLM usage.
- Exploiting misconfigured Power Platform services (e.g., Power Apps with overly permissive shared connections or abusing Power Query for native SQL execution against on-prem data gateways).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 1,527 lines · 0 tokens per session scan F f7752f0940b2
offensive-initial-access is a skill published in the GitHub repository SnailSploit/Claude-Red (7,581 stars, last pushed 5d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 15,502 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
app-store-opportunity-research
Full-pipeline iOS App Store opportunity research. Discovers underserved niches, analyzes competitor gaps, estimates revenue, produces scored top-3 opportunity reports, and writes MVP PRDs — all through browser and web research. Use when the user wants to find profitable iOS app ideas, research App Store charts…
ghost-writer
Produce first drafts that match a writer's authentic voice using their Voice DNA Document. Consumes DNA documents from writing-dna-discovery skill. Generates 2 meaningfully different drafts with headlines, confidence assessment, decision notes, and DNA refinement suggestions. Collaborative partner that evaluates…
dhh-writing
This skill should be used when writing in the distinctive style of David Heinemeier Hansson (DHH). It applies when creating blog posts, technical articles, business content, manifestos, or any prose requiring a clear, punchy, opinionated style.
voice-capture
This skill should be used when extracting voice profiles from sample text, creating voice documentation, or matching a specific writing style. It applies when users provide sample text and want to capture the voice for future use.
writing-orchestration
This skill should be used when orchestrating complex writing workflows with multiple phases. It provides two-agent orchestration patterns, the two-gate content readiness assessment, 10 baseline writing strategies, 20+ situational strategies, and quality checkpoints. Inspired by the Spiral Writing System.
brainstorm
Collaborative brainstorming partner for multi-session ideation projects. Use when the user wants to brainstorm, ideate, explore ideas, or think through problems—whether for SaaS products, software tools, book ideas, newsletter content, business strategies, or any creative/analytical challenge. Handles session…