RadarTopicsBuildersWeeklyReads
Open Source Radar
SnailSploit/

Claude-Red

GitHub

claude-red is a Python-based collection of SKILL.md files to teach Claude red-team skills across multiple categories. It provides a quickstart for cloning or sparse-checkout, and includes an install script with category options.

2.8kstars
457forks
3issues
MITlicense
2026since
Star historydaily snapshots by VibeCrowd

Collecting history — the radar snapshots this repo daily. The trend line appears after 3 days of data (1 so far).

Alternatives & relatedmatched by topic overlap
Reviewgenerated from repository data · Aug 5, 2026

What it is

claude-red is a curated library of offensive security skills for the Claude Skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface.

Drop a skill into your Claude environment and it behaves like a specialist: it knows the techniques, the tooling, the edge cases, and the escalation paths. Skills load on demand based on conversational triggers.

How it works

The project consists of categorized Skill files under Skills/ with dedicated SKILL.md files for each technique. Claude can load individual skills or entire categories via input prompts and system prompts, using the provided SKILL.md contents.

Getting started

"Quickstart" section shows how to clone or sparse-checkout:

# Clone into a directory Claude will scan
git clone https://github.com/SnailSploit/claude-red ~/.claude/skills/claude-red

# Or install only one category
git clone --filter=blob:none --sparse https://github.com/SnailSploit/claude-red
cd claude-red && git sparse-checkout set Skills/web Skills/active-directory

Claude will auto-load matching skills based on triggers (e.g. mentioning SQLi loads offensive-sqli).

Claude code examples show how to pipe SKILL.md contents into claude:

# Point Claude at a single skill before a session
cat Skills/web/offensive-sqli/SKILL.md | claude --system-file -

# Or load a whole category
cat Skills/active-directory/**/SKILL.md | claude --system-file -

Install Script options:

./install.sh                           # interactive
./install.sh --target ~/.claude/skills # explicit target
./install.sh --category web            # one category

Getting started (continued)

The README also lists categories and per-category skill counts, such as 16 Web Application skills and 2 Auth & Identity skills, across various domains like Active Directory, Wireless, Cloud, Mobile, IoT & Embedded, Infrastructure & Red Team, Exploit Development, Fuzzing & Vulnerability Research, Reconnaissance, AI Security, and Utility.

Recent releases

Latest release noted: Snail Claude-Red-Skills V.2 (2026-03-08) with a link to the full changelog commits.

Traction

The repository shows 2808 stars and 457 forks in FACTS, with 3 open issues.

License

MIT license is stated in the README badge and LICENSE file reference.

Contributing

Contributions workflow is mentioned with standard section heading.

Acknowledgements

Author: Kai Aizen (SnailSploit). Links to snailsploit site and related profiles are provided in the Documentation & Author section.

Agent skills inside · 26
All skills →
offensive-jwtJWT attack methodology for penetration testers. Covers algorithm confusion (alg:none, RS256→HS256), weak HMAC secret brute force, kid parameter injection (SQLi, path traversal), jku/x5u/jwk header injection, JWKS cache poisoning, JWS/JWE confusion, timing attacks, and mobile JWT storage extraction. Use when testing JWT-based authentication, hunting auth bypass via token manipulation, or evaluating JWT implementation security in web or mobile apps.Securityoffensive-cloudCloud security attack methodology covering AWS, Azure, and GCP. Includes credential harvesting (IMDS, ~/.aws, env vars, leaked CI secrets, instance roles), enumeration with cloud-specific tools (pacu, ScoutSuite, Prowler, ROADtools, gcp_enum), privilege escalation paths (IAM PassRole, AssumeRole chains, Lambda/Functions privilege flips, Azure Owner-on-self, GCP serviceAccountTokenCreator), persistence techniques (IAM user/key creation, AAD app registration, GCP svc account key creation, EventBridge/Logic Apps backdoors), data exfiltration (S3/Blob/GCS, snapshot share, RDS/CosmosDB/Cloud SQL exSecurityoffensive-toctouTime-of-Check / Time-of-Use (TOCTOU) race condition exploitation methodology across binary, kernel, filesystem, web, and container layers. Covers symbolic-link races (open/access/stat split), file-descriptor races, fopen/realpath traversal races, /proc and procfs races, FUSE-backed slow-fs races to widen the window, ptrace and signal races, kernel double-fetch / userspace pointer races, container/runc/symlink escape primitives, kubernetes admission/authz TOCTOU, web auth-vs-authz TOCTOU, JWT-claim TOCTOU at gateway vs service, payment/idempotency races, and modern race-amplification techniquesSecurityoffensive-fuzzingPractical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness writing, corpus curation, mutation strategies, coverage measurement, and crash triage. Use when setting up or running fuzz campaigns against any target: file parsers, network protocols, kernel drivers, EDR engines, embedded firmware, or language runtimes.Testing & QAoffensive-shellcodeShellcode development reference for offensive security engagements. Use when writing custom x86/x64 shellcode, implementing position-independent code (PIC), building shellcode loaders, evading AV/EDR detection, or converting PE files to shellcode. Covers null byte avoidance, API hashing, encoder/decoder patterns, staged vs stageless payloads, Windows PEB traversal, and cross-platform shellcode techniques.Securityoffensive-active-directoryActive Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential abuse (Kerberoasting, ASREProasting, NTLM relay, LLMNR/NBT-NS poisoning), privilege escalation (ACL abuse, GPO abuse, unconstrained/constrained delegation), lateral movement (Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, WMI/WinRM/PsExec), persistence (Golden/Silver/Diamond Tickets, DCSync, DCShadow, AdminSDHolder, Skeleton Key), forest trust attacks, ADCS abuse (ESC1-ESC15), and modern MDI/Defender for Identity evasion. Use when assessing onOther
SharePost on XLinkedIn
All trending reposRevenue-verified startups →