claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a spec
Install
The skill file stays in the publisher's repository.
Paste the copied command in a terminal. It installs this SKILL.md into that agent.
npx skills add SnailSploit/Claude-Red --skill offensive-osint-methodology -a cursor -y
claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.
Questions
How do I install Claude-Red?
Download Skills/recon/offensive-osint-methodology/SKILL.md from the publisher, or copy the path and open the repository. PlugMCP lists the skill and does not host the file.
Where does Claude-Red live?
The publisher keeps it at https://github.com/SnailSploit/Claude-Red.
Which agents can use Claude-Red?
Claude, Cursor, and Codex can read a SKILL.md you add from the publisher's repository.
claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.
Structured OSINT methodology framework: target definition, source selection, collection workflows, data correlation, timeline reconstruction, and reporting. Use to guide systematic OSINT campaigns or teach OSINT methodology.
Trigger Phrases
Use this skill when the conversation involves any of:
OSINT methodology, open source intelligence, target profiling, data correlation, OSINT workflow, intelligence collection, OSINT campaign, recon methodology
Instructions for Claude
When this skill is active:
Load and apply the full methodology below as your operational checklist
Follow steps in order unless the user specifies otherwise
For each technique, consider applicability to the current target/context
TRM: Create relationship graphs for addresses/transactions
Arkham: Multichain explorer with entity labels, graph creation, and alerts
MetaSleuth: Transaction visualization for retail users
Range: CCTP bridge explorer
Socketscan: EVM bridge explorer
Pulsy: Bridge explorer aggregator
Chainalysis: Horizon 2.0 cross‑chain tracing suite (paid)
Elliptic: Lens visual link explorer (launched Dec 2024)
Most compliance suites now provide real‑time bridge‑risk scoring dashboards (e.g., TRM, Chainalysis)
Layer 2 / Rollup Analysis
zkSync Era / Polygon zkEVM: Zero-knowledge proofs hide transaction details on L2; only deposit/withdrawal bridge events visible on L1. Use zkSync Era Block Explorer and PolygonScan zkEVM.
Arbitrum / Optimism: Transactions batched and compressed; L2 state reconstructed from L1 calldata. Use Arbiscan and Optimistic Etherscan. Check L2Beat for risk framework and technology stack.
StarkNet: Cairo VM with STARK proofs; different address derivation. Use Voyager or StarkScan.
Base / Blast / Scroll: OP Stack or ZK-rollups; similar challenges to above.
Privacy protocols on L2:
Aztec Network: Programmable privacy with noir circuits; limited block explorer visibility.
Railgun: Privacy system for DeFi on Ethereum/Polygon/BSC; shielded pools obscure sender/receiver/amount.
Privacy Pools: Proposed Tornado Cash successor with association sets; not yet deployed at scale.
Challenges:
Bridge mixers (Hop Protocol, Across, Stargate) create synthetic liquidity pools that break direct tracing; funds enter/exit via pool swaps.
Cross-rollup transfers further obfuscate trails; requires tracking via bridge contracts and relayer infrastructure.
Many L2s lack mature analytics tools; explorers show transactions but relationship graphs are sparse.
Methodology:
Start with L1 bridge events (deposits/withdrawals); these anchor L2 activity to known addresses.
Use L2-specific explorers to trace activity within the rollup.
For privacy protocols, focus on timing analysis, deposit/withdrawal clustering, and off-chain metadata (transaction memos, Tornado Cash-style notes).
Download Skills/recon/offensive-osint-methodology/SKILL.md from the publisher, or copy the path and open the repository. PlugMCP lists the skill and does not host the file.
Where does Claude-Red live?
The publisher keeps it at https://github.com/SnailSploit/Claude-Red.
Which agents can use Claude-Red?
Claude, Cursor, and Codex can read a SKILL.md you add from the publisher's repository.