Claude Red Team Skills: Inside Claude-Red

Somebody built a library of Claude red team skills, put 78 of them in one repository, and collected 3,627 stars doing it. Claude-Red is a set of structured SKILL.md files that prime Claude with attack-surface methodology, and it sits at the point where two 2026 trends meet: the skills format going mainstream, and offensive security tooling deciding it wants in.

This is a report on what the project is and what it signals. It contains no attack procedures, no tooling walkthrough, and no skill-by-skill inventory, and that's deliberate rather than coy.

What Claude-Red is

Claude's skills system loads packaged instructions on demand, triggered by what you're talking about. A skill is a Markdown file with structure: when it applies, what methodology to follow, which edge cases matter. The point is that you don't spend context on skills you aren't using.

Claude-Red applies that format to offensive security. Its own description says each skill primes Claude with expert-level methodology for a specific attack surface, so that dropping one in makes the model behave like a domain specialist rather than a generalist guessing at terminology.

The stated use cases are the ones that make it a legitimate project rather than a liability: authorised red team engagements, bug bounty triage, security research, CTF preparation, operator training, and methodical attack-surface exploration. Every one of those is work somebody is paid or permitted to do.

How the skills system makes this possible at all

Understanding why Claude red team skills exist as a category needs one fact about how skills load. They activate conversationally, so a library of 78 of them costs nothing until something in the conversation matches. That's what makes a large curated set practical where a large system prompt would not be.

Before skills, the equivalent was a prompt you pasted, which meant one enormous block of methodology competing for attention with the actual task, or a dozen prompt files you managed by hand. The format turned a personal collection into something installable, versioned and shareable, which is the whole reason libraries like this appeared. If you want the general version of that story, we wrote up what agent skills are and why they spread.

Claude-Red's install paths follow from that. You can clone the whole repository into your skills directory, sparse-checkout a single category, pipe one file into Claude Code as a system file, or paste a skill into a project on claude.ai. Four routes, the same Markdown.

What "offensive security skills" means here, at the level of categories

The repository organises its 78 skills into 23 categories, and the distribution is the informative part.

Web application work is the largest group at 16 skills, covering the OWASP Top 10, business logic flaws and more advanced web vulnerability classes. Wireless is close behind at 14, spanning 802.11, WPA2 and WPA3, EAP, WPS, evil-twin setups, plus Bluetooth Low Energy, Zigbee, Z-Wave, LoRa and sub-GHz. Infrastructure and red team operations holds 7, exploit development 6, authentication and identity 2, and then single skills each for Active Directory, cloud attack paths across AWS, Azure and GCP, mobile application testing, and IoT and embedded work including firmware, RTOS and industrial control systems.

Two things stand out. Wireless at 14 skills is disproportionate to how much of modern security work is wireless, which reads like the maintainer's own specialism rather than a market survey. And the long tail of one-skill categories suggests a library that mapped out its ambitions early and has only filled some of them in. The MINDMAP.md in the repository and the phase-numbered commit messages both point the same way: this was planned as a structure, then populated.

Browsing the directory tree makes the organising principle plain: one folder per area, with names that map onto how security teams already divide work. Recon, forensics, fuzzing, containers, CI/CD, cryptography, supply chain, social engineering and an ai folder for offensive AI security each get their own slot. That taxonomy is ordinary to anyone in the field, which is exactly the point; the library isn't inventing a structure, it's borrowing one the profession settled on decades ago and attaching a skill file to each box.

The growth curve, and what it implies about the format

Version 0.3.0 is where the shape changed. The release notes describe going from 37 skills sitting in flat directories to 78 across 23 organised categories, which is more than doubling the content and, more tellingly, imposing a hierarchy on it. Flat directories work until they don't; the reorganisation is what a collection does when it stops being one person's notes.

The commit history backs that up. Thirty-four commits, most of them batched phase work with messages about reorganising into categories, adding twenty skills across ten of them, and deeply rewriting the thin ones. Somebody audited their own library for skills that didn't carry their weight and rewrote them, which is a maintenance behaviour you rarely see in a repository built for stars.

Six months of elapsed time, from 4 March 2026 to a release at the end of August, produced 3,627 stars and 555 forks. The fork count is the interesting half of that ratio: roughly one fork per seven stars is high, and forks of a skills library usually mean people are keeping private modifications rather than admiring it from the timeline.

What it signals about the skills layer

The specialisation is the story. The collections that circulated first were general-purpose: productivity helpers, formatting rules, a code reviewer, the sort of thing anyone might install. What's appearing now is vertical, with version numbers, changelogs, security policies and contribution guides, aimed at a profession rather than at a task. You wouldn't install this one unless security is your job, and that narrowing is new.

Claude-Red carries all of that: a CHANGELOG.md, a SECURITY.md, a CONTRIBUTING.md, an install script with interactive and category-scoped modes, a generated claude-skills.json manifest, and a release tagged with its own contents, v0.3.0 titled "78 Skills, 23 Categories" and published at the end of August 2026. That's a package, maintained by five contributors, not a folder of prompts.

What that tells you about the ecosystem: the skills format has crossed from personal configuration into distributable professional tooling, and offensive security got there early because its practitioners already think in methodologies and checklists. Our survey of the best Claude skills tracks the same shift across less specialised categories.

Responsible use, and why the framing matters more than usual

Every technique in a library like this already exists in published security literature, in training courses, and in tools people have been running for twenty years. The model isn't learning new attacks; it's getting a better index into methodology that was already public. That's the honest version of the capability question, and it's why "should this exist" is a less useful question than "who is running it and under what authorisation".

The line that matters has never been about tools. Testing systems you own, or that you have written permission to test, is legitimate work with an established profession behind it. Running the same technique against someone else's infrastructure is a crime in most jurisdictions, and the presence or absence of an AI in the loop changes nothing about that.

Where AI does change something is speed and volume. A methodology that used to require an operator who had internalised it can now be invoked by someone who hasn't, which lowers the floor of skill needed to act on it. That cuts both ways, since defenders get the same speedup, and the honest position is that nobody has data yet on which side benefits more.

Claude-Red does the things you'd want a project in this space to do. The SECURITY.md is worth reading rather than skimming: it names the intended uses as authorised penetration testing with documented scope and rules of engagement, bug bounty programmes with explicit written permission, CTF and training environments, and independent research with responsible disclosure, then says outright that the skills are not intended for unauthorised access and that misuse may violate the CFAA in the US, the Computer Misuse Act in the UK, or equivalent statutes elsewhere.

It also asks for vulnerabilities in the library itself to be reported privately, with a malicious payload committed by accident or an unsafe shell command in the install script given as examples. That's a maintainer who has thought about the supply-chain risk of their own distribution, which is a different and rarer concern than the one everybody argues about.

None of it changes the structural limit: the project cannot verify that whoever cloned it has permission to point it at anything. It's MIT licensed with everything visible, and everything after that is on the operator.

One last detail the commit log gives away. Most of the batched work in this repository, the category reorganisation and the skill rewrites and the policy files, is committed under the author name claude. A set of Claude red team skills written largely by Claude is either the natural endpoint of the format or a slightly unnerving one depending on your mood. Either way it's worth knowing before you treat 78 files as 78 pieces of human tradecraft.

What we're not covering

We read the repository and we're not reproducing its contents. No skill names, no technique walkthroughs, no worked examples. Reporting that a curated offensive-security skills library exists, is popular, and is organised a particular way is useful context about the ecosystem. Republishing its methodology in a marketing blog is not journalism and wouldn't add anything the repository doesn't already say better.

If you do security work and this is relevant to your job, the repository is public and you can evaluate it yourself against your own engagement rules.

The one operational note worth making is brand-agnostic: a skills library is a pile of Markdown that changes how a model behaves, and it installs into a directory with no review step. Whatever you install, install it somewhere you can inspect and roll back. Zentor is useful here for a boring reason rather than a security one, since a hosted cloud AI computer keeps that directory on a machine that isn't the laptop holding your client work.

FAQ

Is Claude-Red free and open source?

Yes. MIT licensed, with the source public on GitHub. It had 3,627 stars, 555 forks and 5 contributors when we checked on 13 September 2026, with the most recent release v0.3.0 covering 78 skills across 23 categories.

What are Claude skills?

Packaged instruction files that Claude loads on demand when the conversation matches their triggers, instead of sitting in your context permanently. A skill carries methodology, tooling knowledge and edge cases for one domain, which is what lets a library of dozens stay practical.

Is it legal to use red-team AI tools?

Using them against systems you own or have written authorisation to test is legitimate professional work. Using them against anything else is generally a criminal offence regardless of what software is involved, and an AI assistant in the loop doesn't change the legal position. Scope and authorisation are what matter, not the tool.

Does Claude-Red teach the model new attacks?

Not in any meaningful sense. The techniques it indexes are documented in public security literature and training material. What a library like this changes is retrieval and consistency, not the existence of the knowledge.

How do you install it?

Cloning the repository into your Claude skills directory is the documented route, with a sparse-checkout option for a single category, an interactive install script, and manual paths for Claude Code and claude.ai.

The takeaway

Claude red team skills are worth paying attention to as an ecosystem signal rather than as a product most readers will install. A 78-skill library with a changelog and a security policy is what a format looks like after it stops being a novelty, and offensive security reaching that stage before most other professions says something about which disciplines already had their methodology written down.

Expect more of these, in more fields, with the same packaging. The interesting question for the next year isn't whether vertical skill libraries work; it's who ends up curating them, and whether anyone reviews what's inside before thousands of people clone it.

Repository facts verified against the GitHub API and the project's own README on 13 September 2026.