Writing offensive skills

Skill hypnguyen1209/offensive-claude/skills/writing-offensive-skills

Use when creating or editing a skill in this offensive-claude repo — for the SKILL.md conventions (trigger descriptions, technique map, runnable scripts, OPSEC/detection, red-flags tables, flowchart rules)From its SKILL.md

Install

npx -y skills add hypnguyen1209/offensive-claude --skill writing-offensive-skills

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

SKILL.md

3.3 KB, 700 tokens by cl100k_base, as published. Nobody here has run it

Writing Offensive Skills

Overview

Conventions for authoring skills in this repo so the dispatcher can find them and operators can trust them. This adapts superpowers' skill conventions to offensive security.

REQUIRED BACKGROUND: superpowers:writing-skills (the general conventions) and superpowers:test-driven-development (skills are tested like code — baseline failure first).

Description = triggers only

The description: field decides whether the dispatcher loads the skill. Write Use when… triggering conditions and symptoms ONLY — never summarize the skill's workflow (a workflow summary makes Claude follow the description instead of reading the skill).

# BAD  (summarizes workflow): description: Recon skill that enumerates subdomains then scans ports
# GOOD (triggers only):       description: Use when mapping a target's external attack surface — subdomains, hosts, exposed services

Third person, technology-specific only if the skill is. Verb-first / gerund names.

Skill layout (progressive disclosure)

skills/<name>/
  SKILL.md         # thin router, <=180 lines
  references/      # per-technique deep-dives (theory + 2024-2026 + code + detection + OPSEC)
  scripts/         # runnable tooling (no placeholders)

Domain (technique) skill SKILL.md sections, in order: frontmatter → When to Activate → Technique Map (Technique | ATT&CK Txxxx | CWE | reference | script) → Quick Start → OPSEC & Detection table → Deep Dives (links into references/).

Discipline skill (a hard rule, e.g. finding/scope/opsec-discipline): Overview with the Iron Law → the rule → Red Flags (STOP signals) → Rationalizations table (excuse | reality). State "violating the letter is violating the spirit" and close loopholes explicitly.

The four pillars (every technique)

2024-2026 currency (web-search-verified CVEs; no fabricated ids — mark unverified ones), runnable scripts, OPSEC + detection pairing, technique-level ATT&CK + CWE.

Flowcharts

Only for non-obvious decision points / "where you might stop too early". Never for reference material (use tables), code (use blocks), or linear steps (use lists).

Cross-references

Name only, with explicit markers: **REQUIRED:** scope-discipline. Never @-link (force-loads, burns context). Frontmatter references:/scripts: list the files the skill ships.

Test before you trust

A skill that enforces discipline must resist rationalization under pressure. Capture the excuses an agent makes without the skill, put each in the Rationalizations table, and re-check. Safety-relevant scripts get a tests/ suite (run pytest) and an adversarial review before they're trusted.

Red Flags

Description summarizes the workflow → rewrite to triggers only
A domain skill with no Technique Map / no ATT&CK+CWE / no detection → incomplete
A discipline skill with no Red Flags / no Rationalizations table → won't hold under pressure
Fabricated CVE/arXiv ids presented as real → mark UNVERIFIED or remove

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.

Gives 1 of the 12 instructions most docs writing skills give in 700 tokens

Counted across 1,951 of the 3,904 authors here whose files we hold, read 2026-09-06

Use third-person for skill descriptionshere, and in 54 of 1951, across 35 files
Start descriptions with Use whenin 43 of 1951, across 29 files
Run baseline scenarios before writing any skillin 40 of 1951, across 26 files
Use active voicein 40 of 1951, across 36 files
Map file responsibilities before defining tasksin 36 of 1951, across 29 files
Use checkbox syntax for tracking stepsin 35 of 1951, across 27 files
Ask one question at a timein 35 of 1951
Offer execution options after saving the planin 33 of 1951, across 24 files
Include complete code in every stepin 33 of 1951, across 27 files
Design units with clear boundaries and interfacesin 31 of 1951, across 23 files
Announce the skill usage at the startin 30 of 1951
Verify agent compliance after adding the skillin 29 of 1951, across 17 files

Said here and by no other author read

Include technique map with ATT&CK and CWE identifiers
Include OPSEC and detection tables for every technique
Verify CVEs and research papers with web search
Provide runnable scripts without placeholders
Run pytest on safety-relevant scripts
Perform adversarial review on safety-relevant scripts

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.