Claude-Red
Domain58 offensive-security SKILL.md files turning Claude into a red-team operator across web, cloud, wireless, and exploit dev.
Install
$ git clone https://github.com/SnailSploit/claude-red ~/.claude/skills/claude-red
Update
$ git -C ~/.claude/skills/claude-red pull
Or re-clone/re-copy from the repo if it is not a git checkout.
When to use it
- Conducting authorized penetration testing or red-team engagements and wanting Claude primed with attack methodology
- Researching a specific attack surface like SQL injection, JWT exploitation, Kerberoasting, or EDR evasion
- Doing exploit development, fuzzing, or vulnerability research and needing structured technique references
- Working across web, cloud, wireless, mobile, IoT, or Active Directory security domains
Commands & flags
- git clone https://github.com/SnailSploit/claude-red ~/.claude/skills/claude-red
- Install the whole library into your skills directory.
- git clone --filter=blob:none --sparse https://github.com/SnailSploit/claude-red
- Clone with sparse checkout to pull only selected categories.
- git sparse-checkout set Skills/web Skills/active-directory
- Limit the checkout to specific attack-surface categories.
- ./install.sh --category web
- Run the interactive installer for a single category.
- cat Skills/web/offensive-sqli/SKILL.md | claude --system-file -
- Pipe a single SKILL.md into a Claude session.
- (mention an attack surface, e.g. SQL injection)
- Conversational triggers auto-load the matching skill.
How to use it
Install the whole library by cloning into your skills directory:
git clone https://github.com/SnailSploit/claude-red ~/.claude/skills/claude-red
Install just one or two categories with sparse checkout, or run the interactive installer:
git clone --filter=blob:none --sparse https://github.com/SnailSploit/claude-red
cd claude-red && git sparse-checkout set Skills/web Skills/active-directory
# or:
./install.sh --category web
Once installed, skills load automatically on conversational triggers (e.g. mentioning SQL injection activates the relevant skill). You can also pipe a SKILL.md into a session: cat Skills/web/offensive-sqli/SKILL.md | claude --system-file -.
Why it earns its place
Packs 58 expert-authored offensive-security methodologies into drop-in SKILL.md files spanning 13 domains (web, auth, AD, wireless, cloud, mobile, IoT, infra/red-team, exploit dev, fuzzing, recon, AI security, reporting). Contextual loading means only the relevant attack-surface knowledge enters the context window. Intended strictly for authorized, legal security testing.
Try it
> Help me test this login endpoint for SQL injection and JWT algorithm-confusion on my authorized engagement.