メニュー
Use this skill when the user needs offensive security expertise — penetration testing, vulnerability assessment, red team operations, bug bounty hunting, or security research for authorized engagements.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
SOC 職業分類に基づく
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/javimosch/supercli --skill claude-redコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
SKILL.md を表示中
Use this skill when the user wants to search, create, read, or manage Notion pages and databases — search workspace, query databases, create pages, read/write page content as Markdown, manage blocks, users, and files.
Use this skill when the user wants to chat with LLMs from the terminal — OpenAI, Claude, Gemini, local models, RAG, and multi-turn conversations without leaving the shell.
Use this skill when the user wants static analysis for Kotlin code — detect code smells, complexity, style violations, and generate reports for CI pipelines.
| name | claude-red |
| description | Use this skill when the user needs offensive security expertise — penetration testing, vulnerability assessment, red team operations, bug bounty hunting, or security research for authorized engagements. |
58 curated SKILL.md files across 13 categories that prime AI agents with expert-level offensive security methodology. Built by SnailSploit.
git clone https://github.com/SnailSploit/Claude-Red.git
sc skills teach claude-red:quickstart
SQLi (error/blind/OOB, DB-specific), XSS (stored/reflected/DOM/mutation), SSRF (cloud metadata, filter bypass), SSTI (engine ID, RCE paths), XXE (OOB exfil, blind), IDOR (enumeration, business logic), File Upload (extension bypass, polyglots, webshells), RCE (chaining, command injection), Deserialization (Java/PHP/.NET gadget chains), Race Conditions (TOCTOU, single-packet), Request Smuggling (CL.TE, TE.CL, h2 desync), Open Redirect, Parameter Pollution, GraphQL (introspection, batching, alias IDOR), WAF Bypass, Business Logic
JWT (alg:none, key confusion, secret cracking), OAuth (redirect abuse, token leakage, PKCE bypass)
Kerberoast, ASREProast, ACL abuse, ADCS ESC1-15, delegation, persistence, hybrid AAD
WPA2-PSK (handshake, PMKID, hashcat), WPA3-SAE (downgrade, Dragonblood), WPA Enterprise (802.1X/EAP, eaphammer), WPS (Pixie Dust, brute), Evil Twin (KARMA, Mana, captive portal), KRACK/FragAttacks, Deauth, Bluetooth/BLE, Bluetooth Classic, Zigbee/Thread/Matter, Z-Wave, LoRaWAN/sub-GHz
AWS/Azure/GCP — privesc, IMDS, cross-account, CSPM evasion
Android + iOS — Frida, pinning bypass, storage, biometric, deep links
Hardware recon, firmware, RTOS, ICS/OT, MQTT/CoAP
Initial Access (phishing, drive-by, supply chain), Advanced Red Team (full kill chain, C2, OPSEC), EDR Evasion (unhooking, indirect syscalls, PPID spoofing), Shellcode (writing, encoding, injection), Keylogger Architecture, Windows Mitigations (ACG, Arbitrary Code Guard), Windows Boundaries (sandbox escape)
Stack/Heap, ROP chains, Mitigations, Structured Curriculum, Basic Exploitation (Linux), Crash Analysis, TOCTOU
libFuzzer/AFL++, Coverage-Guided, Bug Identification, Vulnerability Classes
OSINT Tools (recon-ng, theHarvester, Maltego), OSINT Methodology
Prompt injection, jailbreaking, RAG poisoning, LLM pentesting
Fast Triage Checklist, Professional Pentest Reporting (CVSS, evidence, exec summary)
These skills are intended for authorized engagements only. Each skill includes scope-check guidance. Unauthorized use is illegal.