It turns security methods into selectable Claude instructions
Claude-Red is not a vulnerability scanner, exploitation framework, or hosted service. It is a collection of 78 structured SKILL.md files that tell Claude how to approach particular offensive-security problems. The index spans 23 categories, including web applications, identity, Active Directory, wireless, cloud, mobile, exploit development, fuzzing, containers, CI/CD, cryptography, post-exploitation, supply chain, social engineering, network attacks, and AI security. The aim is to keep an assistant on a stable procedure instead of letting it jump between ideas or omit checks.
The project packages those 78 procedures as skills that load when a matching topic is discussed. According to the README, mentioning SQL injection can activate the relevant skill, while unused skills do not consume context. Stated use cases include authorized red teams, bug bounty triage, security research, CTF preparation, training, and attack-surface exploration. Because topics include EDR evasion, persistence, and data exfiltration, strict engagement boundaries remain essential.
What happened when we ran it
We cloned commit 24d7968 into an unprivileged Debian container with 3 CPUs, 8 GB of RAM, no secrets, and Python 3.12. The checkout contained 96 files, about 425 lines of source, and occupied 4.7 MB. Installation succeeded in 54 seconds, adding 35 packages and using 37 MB on disk. The build then succeeded in 1 second. Those are practical numbers for evaluating or adding the repository to an isolated workstation without a long provisioning cycle.
Our run found no tests script or target, so the test step was skipped rather than passed. There was also no tests directory and no Dockerfile, while 4 CI workflow files were present. A pip-audit scan reported 0 known vulnerabilities in the installed dependencies. This is encouraging dependency hygiene for the exact environment and commit we measured, but it does not validate the accuracy, safety, or formatting of 78 instruction files. The clearest lab finding is mixed: setup was quick on our box, while automated behavioral coverage was unavailable.
The index is unusually useful for choosing the right playbook
The strongest design choice is the concrete taxonomy. Web testing alone has 16 skills, separating SQL injection, XSS, SSRF, SSTI, XXE, IDOR, file upload, deserialization, race conditions, request smuggling, GraphQL, WAF bypass, and business-logic testing. Wireless is split into 14 skills rather than treated as one generic subject. Operators can install everything, use sparse checkout for selected directories, pipe one file into Claude Code as a system file, or paste one into a Claude.ai project.
The descriptions are specific enough to route work before opening a file. The Active Directory entry names Kerberoasting, ACL abuse, ADCS ESC1-15, delegation, and hybrid identity; the OAuth entry calls out redirect URI abuse, token leakage, and PKCE bypass. That is more useful than a directory of vaguely named prompts. The MIT license keeps reuse straightforward, and the install script accepts an explicit target or category selector.
The main weakness is trust, not installation
The project asks users to place powerful third-party instructions into an assistant's operating context. Yet our snapshot exposed no runnable test target for checking file structure, metadata, routing collisions, or unintended changes across 78 skills. Four CI workflow files show that automation exists, but the supplied evidence does not establish what those workflows verify. The repository also does not replace authorization, tool installation, credential isolation, command review, evidence storage, or a final human-written report.
Some README claims should be treated as promises to inspect, not results we independently proved. Our 1-second build says the repository builds in the measured container; it does not show that conversational triggers always load the best skill or that advice handles every edge case. Before operational use, teams should review the exact files they plan to load, pin a commit, restrict permissions, and record which guidance influenced each finding.
Activity looks healthy, although release cadence is still unclear
The repository had 3,359 stars and 11 open issues in the supplied snapshot. Its latest release was v0.3.0 on August 30, 2026, and the last push occurred one second before the release timestamp, only 13 days before our September 12 run. Taken together, adoption and recency look healthy rather than abandoned. However, one release date cannot establish a regular cadence, and the open-issue count alone does not reveal response time, resolution quality, or maintainer capacity. Community interest is evident; long-term maintenance consistency is less certain.
It belongs beside an engagement process, not above it
In a real stack, Claude-Red fits between an authorized operator's question and the tools they already control. Use one reviewed SKILL.md to structure testing, then run approved tools separately, capture raw evidence, and verify every conclusion before reporting it. For web-only work, OWASP's testing guide offers a neutral shared standard; PayloadsAllTheThings is better for direct technique references. Anthropic's broader skills repository fits when security is only 1 part of the workflow.
The practical recommendation is narrow: try v0.3.0 in an isolated profile if Claude Code is already part of an authorized security program and the 78-topic index saves preparation time. Do not give the collection unattended production access or confuse structured instructions with validated findings. The low setup cost makes a pilot easy, while the missing test target calls for local review and change control. Claude-Red is a useful playbook shelf, not an autonomous red team.