# red-run

Security assessment toolkit for Claude Code. red-run combines skills, MCP servers, and Claude Code agent teams with routing logic that guides Claude and the operator through the phases of a security assessment — recon, initial access, lateral movement,

- Tier: Indexed (plain plugin)
- Category: Security
- Page: https://www.flowy.sh/listings/blacklanternsecurity-red-run
- Source: https://github.com/blacklanternsecurity/red-run
- Price: free and open source

## Summary
red-run is a Claude Code plugin with 79 hand-picked skills for security work, indexed on Flowy. Install it with the command on its page. It includes acl-abuse, ad-discovery, ad-persistence. Its skills do not fire on their own yet. Request auto-invocation to have Flowy route them as you prompt. Free and open source.

## Install (Claude Code)
```
npx -y skills add blacklanternsecurity/red-run --agent claude-code
```

## Skills
- acl-abuse
- ad-discovery
- ad-persistence
- adcs-access-and-relay
- adcs-persistence
- adcs-template-abuse
- auth-coercion-relay
- credential-dumping
- gpo-abuse
- kerberos-delegation
- kerberos-roasting
- kerberos-ticket-forging
- pass-the-hash
- sccm-exploitation
- trust-attacks
- password-spraying
- ctf
- av-edr-evasion
- legacy
- container-escapes
- database-enumeration
- infrastructure-enumeration
- network-recon
- pivoting-tunneling
- remote-access-enumeration
- smb-enumeration
- smb-exploitation
- xmpp-enumeration
- credential-recovery
- linux-cron-service-abuse
- linux-discovery
- linux-file-path-abuse
- linux-kernel-exploits
- linux-sudo-suid-capabilities
- windows-credential-harvesting
- windows-discovery
- windows-kernel-exploits
- windows-service-dll-abuse
- windows-token-impersonation
- windows-uac-bypass
- unknown-vector-analysis
- retrospective
- 2fa-bypass
- ajp-ghostcat
- browser-exploitation
- command-injection
- cors-misconfiguration
- csrf
- deserialization-dotnet
- deserialization-java
- deserialization-php
- file-upload-bypass
- idor
- jwt-attacks
- ldap-injection
- lfi
- nosql-injection
- oauth-attacks
- password-reset-poisoning
- php-code-injection
- python-code-injection
- race-condition
- request-smuggling
- smb-share-webshell
- source-code-review
- sql-injection-blind
- sql-injection-error
- sql-injection-stacked
- sql-injection-union
- ssrf
- ssti-freemarker
- ssti-jinja2
- ssti-twig
- tomcat-manager-deploy
- web-discovery
- xss-dom
- xss-reflected
- xss-stored
- xxe

## FAQ

### What is red-run?
Security assessment toolkit for Claude Code. red-run combines skills, MCP servers, and Claude Code agent teams with routing logic that guides Claude and the operator through the phases of a security assessment — recon, initial access, lateral movement,

### How do I install red-run?
Run these in Claude Code: npx -y skills add blacklanternsecurity/red-run --agent claude-code. Then prompt normally.

### Does red-run auto-invoke its skills?
Not yet. It is indexed on Flowy as a plain plugin. Request auto-invocation on its page and Flowy will route its skills for you as you prompt.

### Is red-run free?
Yes. Flowy is free and open source, with nothing gated. You can read every skill in full before you install.