Back to Devoured - September 14, 2026
DEVOURED
Claude-Red (GitHub Repo)

Claude-Red (GitHub Repo)

DevOps securityairesearch Kai Aizen
Claude-Red provides a library of offensive security modules that prime Claude to function as a domain-specific red team operator.
What: The library contains structured `SKILL.md` files for 23 offensive security categories, including EDR evasion, Active Directory exploitation, and SQL injection, allowing users to trigger specific methodology during engagements.
Why it matters: This represents a shift in security tooling, where AI models are not just assistants but specialized operators that load technical context dynamically based on the conversation topic.
Takeaway: Install the repository to your local Claude skill path or use `cat` to prepend specific `SKILL.md` files to your system prompts when performing authorized security research.
Decoder
  • EDR evasion: Techniques used to bypass Endpoint Detection and Response software by masking malicious activity or exploiting how the security agent monitors system calls.
  • Red team: A group authorized to simulate real-world cyberattacks on an organization to test its security defenses.
Original article

claude-red

Offensive security skills for Claude — drop-in SKILL.md files that turn Claude into a context-aware red team operator.

Overview

claude-red is a curated library of offensive security skills for the Claude Skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQL injection to shellcode, EDR evasion to ADCS abuse.

Drop a skill into your Claude environment and it behaves like a domain specialist: it knows the techniques, the tooling, the edge cases, and the escalation paths. Skills load on demand based on conversational triggers — you don't pay context for skills you aren't using.

Use cases: authorized red team engagements, bug bounty triage, security research, CTF preparation, operator training, and methodical attack surface exploration.

Quickstart

Claude Skills System (Recommended)

git clone https://github.com/SnailSploit/claude-red ~/.claude/skills/claude-red

Claude auto-loads matching skills based on conversational triggers (e.g., mentioning SQL injection loads offensive-sqli).

To install a single category:

git clone --filter=blob:none --sparse https://github.com/SnailSploit/claude-red
cd claude-red && git sparse-checkout set Skills/web Skills/active-directory

Claude Code

cat Skills/web/offensive-sqli/SKILL.md | claude --system-file -

cat Skills/active-directory/**/SKILL.md | claude --system-file -

Claude.ai (Manual)

Paste the contents of a SKILL.md into a Project's system prompt or prepend it to your conversation.

Install Script

./install.sh                           # interactive
./install.sh --target ~/.claude/skills # explicit target
./install.sh --category web            # single category

Categories

Category Skills Focus
Web Application 16 OWASP Top 10, business logic, advanced web vulnerability classes
Auth & Identity 2 JWT exploitation, OAuth/OIDC abuse
Active Directory 1 On-prem AD attack methodology
Wireless 14 802.11, WPA2/3, EAP, WPS, evil-twin, BLE, Zigbee, Z-Wave, LoRa, sub-GHz
Cloud 1 AWS, Azure, GCP attack paths
Mobile 1 Android and iOS application testing
IoT & Embedded 1 Hardware, firmware, RTOS, ICS/OT
Infrastructure & Red Team 7 Initial access, EDR evasion, advanced red team operations, Windows internals
Exploit Development 6 Stack/heap corruption, ROP, mitigations, crash analysis, TOCTOU
Fuzzing & Vulnerability Research 4 libFuzzer, AFL++, coverage-guided fuzzing, vulnerability taxonomy
Reconnaissance 2 OSINT tooling and structured intelligence collection
API Security 2 REST/gRPC/WebSocket testing, business logic abuse
Container & Kubernetes 2 Container escape, Kubernetes cluster exploitation
CI/CD & Pipeline 2 Pipeline exploitation, secrets extraction
Cryptography 2 Cryptographic implementation attacks, TLS/SSL
Privilege Escalation 2 Linux and Windows privilege escalation
Post-Exploitation 3 Lateral movement, persistence mechanisms, data exfiltration
Forensics & C2 2 Anti-forensics tradecraft, C2 framework operations
Supply Chain 2 Supply chain attacks, dependency confusion
Social Engineering 2 Phishing campaigns, physical/vishing/smishing
Network Attacks 1 Layer 2/3 attacks, MITM, protocol poisoning
AI Security 1 Prompt injection, jailbreaking, RAG poisoning
Utility 2 Fast triage checklists, professional reporting

Roadmap

Phase Focus Skills Status
1 Internal AD/Windows — split into focused skills +16 Planned
2 Cloud Identity — Entra, ADFS, Okta, M365 +10 Planned
3 Wireless — WPA2/3, EAP, BLE, Zigbee, Z-Wave, LoRa, sub-GHz +12 Complete
4 IoT — UART/JTAG, flash extraction, fault injection, RTOS, ICS +10 Planned
5 Web Fundamentals — recon, auth bypass, access control, CSRF, CORS +8 Planned
6 Web Advanced — proto pollution, SAML, OIDC, WebSocket, SSI/ESI +10 Planned
7 Documentation and tooling polish — Complete
8 New categories — 10 new domains with 20 skills +20 Complete
9 Deep rewrites — deserialization, GraphQL, advanced red team, SSTI — Complete

Contributing

Contributions welcome. Focused, single-surface skills are preferred over monolithic overviews.

Acknowledgements

  • Author: Kai Aizen (SnailSploit) — GenAI security research
  • Original Checklists: Sahar Shlichov — the offensive checklist collection that many of these skills build on
  • Community: Pull requests and feedback that keep the library aligned with the evolving threat landscape
Explore all 74 articles in today's digest

Fresh dev news, AI-digested daily. Never miss a trend at devoured.fyi