Claude-Red
Awesome ListSnailSploit/Claude-Red
Curated library of offensive security skills that turn Claude into a red team operator.
Overview
claude-red is a curated collection of 78 offensive security skills packaged as structured SKILL.md files for the Claude Skills system. Each skill primes Claude with expert methodology for a specific attack surface, from SQL injection and web exploitation to EDR evasion, Active Directory abuse, and exploit development. Skills load on demand via conversational triggers, targeting authorized red team engagements, bug bounty triage, and security research.
README Preview
\n\n\n\n# claude-red\n\n**Offensive security skills for Claude — drop-in `SKILL.md` files that turn Claude into a context-aware red team operator.**\n\n[](LICENSE)\n[](#skill-index)\n[](#categories)\n[](https://github.com/SnailSploit/claude-red)\n[](https://github.com/SnailSploit/claude-red/network/members)\n\n[Overview](#overview) • [Quickstart](#quickstart) • [Categories](#categories) • [Skill Index](#skill-index) • [Roadmap](#roadmap) • [Contributing](#contributing)\n\n\n\n---\n\n## Overview\n\n`claude-red` is a curated library of offensive security skills for the [Claude Skills system](https://docs.claude.com). Each skill is a structured `SKILL.md` file that primes Claude with expert-level methodology for a specific attack surface — from SQL injection to shellcode, EDR evasion to ADCS abuse.\n\nDrop a skill into your Claude environment and it behaves like a domain specialist: it knows the techniques, the tooling, the edge cases, and the escalation paths. Skills load on demand based on conversational triggers — you don't pay context for skills you aren't using.\n\n**Use cases:** authorized red team engagements, bug bounty triage, security research, CTF preparation, operator training, and methodical attack surface exploration.\n\n---\n\n## Quickstart\n\n### Claude Skills System (Recommended)\n\n```bash\ngit clone https://github.com/SnailSploit/claude-red ~/.claude/skills/claude-red\n```\n\nClaude auto-loads matching skills based on conversational triggers (e.g., mentioning SQL injection loads `offensive-sqli`).\n\nTo install a single category:\n\n```bash\ngit clone --filter=blob:none --sparse https://github.com/SnailSploit/claude-red\ncd claude-red && git sparse-checkout set Skills/web Skills/active-directory\n```\n\n### Claude Code\n\n```bash\ncat Skills/web/offensive-sqli/SKILL.md | claude --system-file -\n\ncat Skills/active-directory/**/SKILL.md | claude --system-file -\n```\n\n### Claude.ai (Manual)\n\nPaste the contents of a `SKILL.m
FAQ (1)
TroubleshootingHow to fix Windows Defender flagging 'Backdoor:PHP/Perhetshell.A!dha' after cloning claude-skill-registry?
The Severe alert is triggered by offensive-sqli/SKILL.md, an offensive SQL-injection skill auto-ingested into the registry whose exploit payloads match Defender's Backdoor:PHP/Perhetshell.A!dha signature. Workarounds: 1) If you don't need offensive security tooling, let Defender quarantine the file or manually delete the offensive-sqli skill folder from your local clone, then run a quick scan to confirm clean. 2) If you intentionally use the skill for authorized penetration testing, add a targeted exclusion via elevated PowerShell: Add-MpPreference -ExclusionPath "<clone-path>\skills\offensive-sqli" — only exclude paths you fully trust, as the file contains live exploit code. 3) Watch registry issue #27 (majiayu000/claude-skill-registry) and re-pull once the maintainer removes or sanitizes the flagged skill, then remove any manual exclusion.