Traction scoreGitHub stars can be faked, so popularity alone can be misleading. Traction Score looks for broader signs of recent attention, adoption, and active maintenance.
Claude-Red provides structured guidance for simulating sophisticated attacks against on-premises and hybrid Active Directory environments. It assists red team operators in navigating the lifecycle of an internal engagement, from initial reconnaissance to long-term persistence.
The skill set focuses on the technical execution of credential abuse, privilege escalation via ACL and GPO manipulation, and lateral movement using protocols like WMI and WinRM. It also includes specific methodologies for exploiting Active Directory Certificate Services (ADCS) and evading modern identity detection systems.
Compatible AgentsThe repository documents support for these agents. The skills may also work with other agents that can load SKILL.md files, but they may need some setup or small changes.
Follow the documented setup, then try a first task.
Recommended Claude Skills installation
Installs: Complete claude-red skill library · Claude
Before you start
Git
A Claude environment using the Claude Skills system
In a terminal, clone the complete claude-red repository into Claude's skills directory. Claude auto-loads matching skills based on conversational triggers.
Use the offensive-sqli skill to create a small, non-destructive SQL injection detection plan for an authorized staging endpoint. Given the endpoint URL, one redacted sample HTTP request, the explicitly in-scope parameters, and any known database type, identify the input vectors to check, select a minimal set of basic and boolean/time-based probes, describe the response differences to record, and provide remediation guidance. Do not extract data, escalate privileges, or attempt RCE.
Use the offensive-bluetooth-classic skill to review user-provided discovery and SDP output from an authorized Bluetooth Classic assessment. Given the discovered device list, SDP service records, device models, and known firmware versions, produce a concise inventory of exposed profiles, authentication questions to verify, likely legacy-risk areas, and evidence to capture in the report. Do not initiate pairing or interact with device services.
Use the offensive-krack-fragattacks skill to assess whether KRACK or FragAttacks testing is worth pursuing for an authorized client device. Given the client model, operating system, firmware version, Wi-Fi stack or chipset if known, and engagement scope, produce a short applicability matrix covering patch likelihood, relevant attack family and CVEs, a controlled validation plan, and the reporting fields to collect. Do not run attacks or force client reassociation.
Claude
Cursor
Gemini CLI