Claude-Red: 78 Offensive Security Skills for Claude, and What to Check Before You Install

Claude-Red is a GitHub library of offensive security "skills" for Claude that gained about 209 stars in a single day this week and now sits near 8,000 stars. Per its README, it is "a curated library of offensive security skills designed for the Claude skills system", each one a structured SKILL.md file that primes Claude with an expert methodology for a specific attack surface. The badge counts 78 skills in 23 categories under an MIT license.

That makes it one of the most direct examples of a trend we have tracked for months: agent skills are becoming the way people package professional know-how, including the grey-area kind. This post explains what is in the repository, how to install it, and, because the README is thin on this, what you should settle before using it. Our earlier explainer on what agent skills are covers the format.

Claude-Red at a glance

What is actually inside?

Each skill is a markdown file with instructions that Claude loads when a conversation triggers it. The README lists skills spanning web application attacks (SQL injection, JWT), wireless, infrastructure and red team work, Active Directory, container escape and endpoint-detection evasion. The framing is a methodology: how a practitioner would approach the surface, which checks to run in what order, and what to look for.

That is both the appeal and the concern. For a pentester, a skill that encodes a consistent checklist saves time and reduces missed steps. For someone without authorization, the same checklist lowers the effort of attacking a target.

Two features of the repository are worth noting. First, the roadmap targets about 130 skills, and several phases (Internal AD and Windows, Cloud Identity, IoT, Web Fundamentals) are marked as planned, so the 78 skills are an early state of a growing library. Second, the README does not say how the skills were tested or validated, so you cannot assume the content is correct, current or safe to run against a live system.

How do I install Claude-Red?

The README gives several routes.

# Claude skills system: clone into your skills folder
git clone https://github.com/SnailSploit/Claude-Red ~/.claude/skills/claude-red

# or use sparse checkout to take a single category
# or run the repository's install.sh (interactive, custom target, or one category)

For Claude Code you can pipe a single SKILL.md into a session, and for Claude.ai you can paste one into a Project's system prompt. Our Claude Code commands reference covers the mechanics of loading context.

Two practical tips. Install one category rather than all 78, since every loaded skill spends context and widens what the agent may attempt. And read each SKILL.md before it goes live: a skill is instructions your agent follows, which is why third-party skill directories are a supply-chain surface.

Is it legal and allowed?

This is the question the README leaves open, so here is the careful version. The MIT license covers the text of the repository. It says nothing about whether you may attack a given system. Authorization comes from the owner of the target, ideally in writing: a signed scope for a pentest, a bug bounty program's rules, or your own lab.

The README names authorized red team engagements, bug bounty triage, security research, CTF preparation, operator training and attack surface exploration as use cases, but, per our reading, it has no dedicated disclaimer or authorization language. Treat the use-case list as the intended boundary, not as a safeguard.

Then there are the model provider's terms. Anthropic publishes an acceptable use policy that restricts malicious cyber activity. Whether a given skill-assisted workflow is allowed depends on what you ask Claude to do and against what. If you do professional security work, check your account's terms before building a workflow on top of this library, and expect Claude to decline some requests even with a skill loaded. We have not tested every skill, and nothing here should be read as saying all use is permitted or prohibited.

Employers and clients matter too. Running offensive tooling on a corporate laptop, or against a client network, without sign-off can breach policy even when the technique is standard.

Why does this matter beyond the repository?

Offensive skills are one half of a fast-moving picture. Anthropic itself has been blunt that defenders face a rough stretch as AI finds more vulnerabilities, and recent weeks have produced a steady stream of AI-assisted incidents, which we log in our October 2026 cyberattack tracker. On the defensive side, projects such as PentAGI automate authorized testing, and Claude's own continuous security scanning targets code owners.

Libraries like Claude-Red lower the skill floor for both sides. The legitimate user gets a structured assistant. The attacker gets the same. That is the reason to be explicit about authorization and logging, and the reason defenders should assume attackers can lean on this kind of packaged expertise.

How do skills like these change the work of a pentester?

A skill is a reusable prompt with structure. In a normal engagement, a tester switches between a mental checklist, reference notes and tooling. A skill loads the checklist into the agent's context so that the model follows a consistent order of operations and does not skip the boring steps. The gains are clearest on repetitive categories: web application testing, where the same classes of flaws (injection, broken authentication, token handling) recur, and wireless work, where a methodology keeps a long procedure on track.

The limits are just as clear. A skill cannot supply judgment about scope, impact or timing. It cannot tell the model that a production database is off limits on a Friday afternoon, and it does not replace the tester's responsibility for what the agent runs. The model can also be confidently wrong about a technique, and the README does not say how skills were checked. In practice, experienced testers use skills as accelerators for work they could do by hand, review the commands before they run, and treat the output as leads to verify rather than findings to report.

For learners, the value is different. Reading a well-organized methodology file is a fast way to see how practitioners think about an attack surface. Pair that with an intentionally vulnerable lab you own, and you get a legitimate way to practice that does not touch anyone else's systems.

How should a security team evaluate it?

1. Read before you load. Open the skills you plan to use and check them against your own methodology.
2. Pin a commit. Do not auto-pull a repository that is still adding skills.
3. Sandbox the agent. Run it in an environment with no production credentials and a network allowlist limited to the in-scope targets, for example with a policy runtime like NVIDIA OpenShell.
4. Keep a log. Record prompts, commands and targets so you can show what you did and that it stayed in scope.
5. Get written scope. No scope document, no test.
6. Compare with maintained alternatives. Other collections exist, such as the ECC agent harness, which we reviewed for install risks.

What would make the project more trustworthy?

Three additions would answer most of the open questions. A short authorization and responsible-use section would set expectations for contributors and users alike. A testing note, even a simple one saying which skills were run against which lab targets and with which model version, would show whether the methodologies work. And tagged releases would let teams pin and audit a known state instead of tracking a moving main branch. None of these exist in the README today, and until they do, the safe assumption is that this is a fast-growing community collection, not a vetted product.

Questions people will ask

Does it include exploit code? The README describes methodology skills. We have not audited each file for payloads, so check the ones you plan to use.

Is it from a known security vendor? The repository is published under the account SnailSploit. We could not establish a company behind it from the README, which is another reason to read before you trust.

Does it work with other agents? The skills are markdown. In principle other harnesses can load them, but the README targets Claude.

Will agents misuse it? An agent following an offensive skill is still an agent. If you give one a shell and a target list, it can touch real systems. If you are building or deploying agents and want to stop them before dangerous actions, AgentBeam is the agent security platform from the explainx.ai team.

Related reading

• What are agent skills? The complete guide
• ECC agent harness: 71 agents, 311 skills and install risks
• PentAGI: open-source autonomous pentest agent
• October 2026 cyberattacks and breaches tracker
• Anthropic on a worse-before-better vulnerability tsunami
• Claude Security continuous scanning
• Claude Code commands reference

Details reflect the Claude-Red repository as of October 23, 2026. Skill counts, licenses and policies change, so verify them before you rely on them.