The Markdown Arsenal: Distilling Offensive Expertise for Claude

The Drop-In Doctrine

The central bet of Claude-Red is that a large language model does not need more code-writing practice; it needs better tactical focus. The project, maintained by 0xwilliamortiz and derived from Kai Aizen’s upstream SnailSploit library, is a collection of roughly fifty-eight SKILL.md files organized across thirteen categories—from web application attacks to wireless exploitation, EDR evasion, and fuzzing methodology [1]. Each file is a terse, structured prompt fragment designed for Anthropic’s Claude Skills system. Drop one into a conversation, and the model shifts from generalist to specialist: mention SQL injection, and the offensive-sqli skill loads on demand, priming Claude with error-based, blind, out-of-band, and ORM-specific techniques without crowding the context window with irrelevant tradecraft.

This is not a repository of exploits. There are no pre-baked scripts, no Metasploit modules, no compiled binaries. The skills are operating instructions—roughly eighty to two hundred lines apiece—based originally on Sahar Shlichov’s offensive checklists [4]. The upstream project has attracted nearly three thousand stars on GitHub, suggesting that the security community is hungry for precisely this kind of distilled methodology [1]. The promise, emblazoned in the project’s own tagline, is that “Give Claude the right skill and it stops being a chatbot. It becomes an operator.” That is marketing, but it points to a real phenomenon: as foundation models grow capable of generating shellcode on request, their bottleneck shifts from syntax to strategy.

The Wireless Obsession

If you want to understand where Claude-Red’s muscle memory currently lives, look at the wireless category. A Phase 3 commit shattered a single monolithic Wi-Fi skill into thirteen per-surface modules, covering everything from 802.11 reconnaissance and WPA2-PSK handshake capture to WPA3-SAE transition downgrades, Dragonblood side-channels, EAP evil-twin attacks, BLE GATT enumeration, Zigbee ZCL command injection, Z-Wave S0 key derivation flaws, and LoRaWAN sub-GHz exploitation [1]. The granularity is almost obsessive: there are separate skills for deauthentication frames, KRACK/FragAttacks supplicant testing, and WPS Pixie Dust versus online PIN brute-forcing.

This depth stands in sharp contrast to the rest of the library. Active Directory, cloud, mobile, and IoT are each represented by a single overview skill that the roadmap candidly labels “expanding” [1]. The repository’s center of gravity is clearly in web and wireless attack surfaces, with infrastructure and exploit development sitting somewhere in between. The roadmap calls the wireless split “mandatory,” implying it was treated as a foundational architectural requirement rather than an incremental addition. Whether that reflects the maintainer’s personal expertise or a perceived gap in AI-assisted tooling for radio-frequency attacks is unclear, but the imbalance is a visible rough edge.

Operating Instructions, Not Exploits

The project’s most interesting technical insight is negative: it argues that pre-baked demos are brittle. A static Python script for SSRF or a hardcoded ROP chain fails the moment a target’s stack layout, filter logic, or cloud metadata endpoint deviates from the training distribution. Claude-Red’s alternative is to feed the model concise, surface-specific methodology—how to identify an engine, how to bypass a WAF, how to chain a TOCTOU race—so that Claude generates context-specific exploitation code on demand [4].

This approach treats the LLM as a reasoning engine that lacks domain focus, not as a code compiler that lacks syntax. The skills act as cognitive guardrails, narrowing the model’s generative aperture to a specific attack class. The original upstream philosophy deliberately capped the collection at thirty-eight skills, asserting that larger libraries accumulate filler and that operators will not reliably use skills they cannot quickly memorize [4]. The current fork has already blown past that limit to fifty-eight and is targeting roughly one hundred and seven, raising a tension between comprehensiveness and the tight scoping that was once a core design constraint. The README now states that “focused, single-surface skills are preferred over monolithic overviews,” but maintaining that focus at triple the size will be a taxonomic challenge, not an engineering one.

A Grassroots Counterpoint to Corporate AI Red Teaming

Claude-Red sits at an awkward, productive intersection in the security landscape. The AI red-teaming market—defined here as adversarial testing of AI systems themselves—is projected to grow from $1.43 billion in 2024 to $4.8 billion by 2029, driven by the EU AI Act and enterprise adoption [8]. Corporate offerings like Bugcrowd’s AI Penetration Testing service employ human testers to probe prompt injection, model inversion, and data poisoning in LLM applications [6]. Anthropic’s own Frontier Red Team stress-tests Claude’s cyber capabilities, measuring its aptitude for N-day exploit development, robotics control, and cryptographic weakness discovery [7]. Open-source frameworks such as Microsoft’s PyRIT and NVIDIA’s Garak provide systematic, large-scale probing of model safety [5][8].

Claude-Red is none of these. It is not a scanner, a fuzzer, or a safety harness. It is a curated knowledge layer that uses an LLM to attack other systems, placing it in the AI-assisted offensive security quadrant. It appears in the awesome-ai-security-tools catalog alongside reconnaissance agents, SAST integrations, and LLM-driven fuzzers, a list that has itself accumulated about a thousand stars since its initialization in mid-2026 [11]. In that ecosystem, Claude-Red occupies a humble but distinct niche: it is the documentation layer, the part that tells the machine what to do after the machine has already learned how to code.

Taxonomy, Not Engineering

It is worth stating plainly what this repository is not. There are novel algorithms here, no custom C2 protocols, no sandbox escape primitives. The engineering is entirely in the taxonomy—deciding that “offensive-request-smuggling” deserves its own skill distinct from “offensive-business-logic,” or decomposing an entire wireless kill chain into thirteen discrete cognitive modules. The value is editorial, not architectural.

That editorial judgment is still uneven. The AI Security category contains exactly one skill, covering prompt injection, jailbreaks, and RAG poisoning—a category so meta it borders on irony for a project built atop an LLM [1]. Cloud identity, mobile, and embedded systems are similarly thin. The project is also platform-bound: the skills are purpose-built for Anthropic’s Claude Skills system, meaning they cannot be dropped into a GPT-4 session or a local Llama instance without reformatting. And while the repository includes an installer and a manifest generator, these are convenience wrappers around what remains, at its core, a collection of markdown files [1].

The Road to 107 and the Human Question

The roadmap plots seven phases, ending at roughly one hundred and seven skills. Phase 3—the wireless split—is already complete. Phase 7 is polish: manifests, documentation, and installation hygiene [1]. The timing is commercially convenient. The EU AI Act demands full compliance by August 2026, and enterprises are scrambling to assess AI-specific vulnerabilities in applications that ship features faster than they mature security practices [6][8].

Yet the broader literature insists that human expertise remains non-negotiable. Bugcrowd emphasizes that automated tools lack the contextual awareness to assess complex, multi-step exploit chains in LLM applications [6]. The EC-Council frames AI as an augmentation layer, arguing that critical thinking, creativity, and intuition still belong to the human operator [12]. Claude-Red’s trajectory suggests a similar division of labor: the skills do not replace the red teamer; they compress the red teamer’s reference library into a format the model can load in milliseconds.

The unresolved tension is whether these micro-instructions will remain necessary as foundation models absorb ever-larger corpora of security literature. If Claude can already infer SQL injection techniques from raw CVE descriptions, the value of offensive-sqli may shift from teaching the model how to attack to reminding the operator what to ask. In that future, Claude-Red becomes less of an exploit generator and more of an orchestration grammar—a structured way for human operators to steer an increasingly capable assistant through a methodology they no longer have time to memorize. The repository is betting that expertise, even when automated, still needs a table of contents.