agentsclimarketplace

Writing offensive skills

Skill hypnguyen1209/offensive-claude/skills/writing-offensive-skills

Offensive security toolkit for Claude Code covering red team, exploit dev, AD attacks, EDR bypass, mobile pentest

Install
npx -y skills add hypnguyen1209/offensive-claude --skill writing-offensive-skills

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Use when creating or editing a skill in this offensive-claude repo — for the SKILL.md conventions (trigger descriptions, technique map, runnable scripts, OPSEC/detection, red-flags tables, flowchart rules)

SKILL.md

3.3 KB, 700 tokens by cl100k_base, as published. Nobody here has run it

Writing Offensive Skills

Overview

Conventions for authoring skills in this repo so the dispatcher can find them and operators can trust them. This adapts superpowers' skill conventions to offensive security.

REQUIRED BACKGROUND: superpowers:writing-skills (the general conventions) and superpowers:test-driven-development (skills are tested like code — baseline failure first).

Description = triggers only

The description: field decides whether the dispatcher loads the skill. Write Use when… triggering conditions and symptoms ONLY — never summarize the skill's workflow (a workflow summary makes Claude follow the description instead of reading the skill).

# BAD  (summarizes workflow): description: Recon skill that enumerates subdomains then scans ports
# GOOD (triggers only):       description: Use when mapping a target's external attack surface — subdomains, hosts, exposed services

Third person, technology-specific only if the skill is. Verb-first / gerund names.

Skill layout (progressive disclosure)

skills/<name>/
  SKILL.md         # thin router, <=180 lines
  references/      # per-technique deep-dives (theory + 2024-2026 + code + detection + OPSEC)
  scripts/         # runnable tooling (no placeholders)

Domain (technique) skill SKILL.md sections, in order: frontmatter → When to Activate → Technique Map (Technique | ATT&CK Txxxx | CWE | reference | script) → Quick Start → OPSEC & Detection table → Deep Dives (links into references/).

Discipline skill (a hard rule, e.g. finding/scope/opsec-discipline): Overview with the Iron Law → the rule → Red Flags (STOP signals) → Rationalizations table (excuse | reality). State "violating the letter is violating the spirit" and close loopholes explicitly.

The four pillars (every technique)

2024-2026 currency (web-search-verified CVEs; no fabricated ids — mark unverified ones), runnable scripts, OPSEC + detection pairing, technique-level ATT&CK + CWE.

Flowcharts

Only for non-obvious decision points / "where you might stop too early". Never for reference material (use tables), code (use blocks), or linear steps (use lists).

Cross-references

Name only, with explicit markers: **REQUIRED:** scope-discipline. Never @-link (force-loads, burns context). Frontmatter references:/scripts: list the files the skill ships.

Test before you trust

A skill that enforces discipline must resist rationalization under pressure. Capture the excuses an agent makes without the skill, put each in the Rationalizations table, and re-check. Safety-relevant scripts get a tests/ suite (run pytest) and an adversarial review before they're trusted.

Red Flags

  • Description summarizes the workflow → rewrite to triggers only
  • A domain skill with no Technique Map / no ATT&CK+CWE / no detection → incomplete
  • A discipline skill with no Red Flags / no Rationalizations table → won't hold under pressure
  • Fabricated CVE/arXiv ids presented as real → mark UNVERIFIED or remove

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.

Gives 0 of the 12 instructions most docs writing skills give in 700 tokens

Counted across 1,637 of the 3,044 authors here whose files we hold, read 2026-08-07

  • announce the skill at startin 54 of 1637, across 26 files
  • convert legacy doc files before editingin 45 of 1637, across 7 files
  • Predict questions readers might askin 42 of 1637, across 4 files
  • Generate clarifying questions for initial contextin 42 of 1637, across 3 files
  • Create document scaffold with placeholder textin 42 of 1637, across 3 files
  • Brainstorm content options for each sectionin 42 of 1637, across 3 files
  • Test document with fresh context-less instancein 42 of 1637, across 3 files
  • include exact file paths in every taskin 42 of 1637, across 15 files
  • ask interview questions one at a timein 42 of 1637, across 27 files
  • Apply surgical edits during refinementin 41 of 1637, across 2 files
  • Offer structured workflow or freeformin 40 of 1637, across 1 file
  • Ask for document meta-contextin 40 of 1637, across 2 files

Said here and by no other author read

  • include a technique map in domain skills
  • pair OPSEC with detection for every technique
  • add ATT&CK and CWE ids to every technique
  • use tables for reference material
  • use lists for linear steps
  • require related skills with explicit markers

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.