claude-skills

Use when conducting authorized red team exercises against your own infrastructure where the blue team must not identify the attacker as internal — covers VPS provisioning, connection fingerprint sanitization, and operational separation to simulate a realistic external threat.

Use when performing authorized security testing, red teaming, or vulnerability assessment of web applications — especially stacks with PHP/Python/Node behind CDN/WAF, multi-subdomain targets, or modern SaaS-style infra (Supabase, n8n, Portainer, Mautic).

Use when mapping features, data models, or APIs of a live web app without access to source code — especially SPAs, Flutter Web, or React apps behind auth walls. Symptoms include: need to clone/replicate a product, competitive analysis, security audit, or building compatible tooling.