acl-abuse
Exploits misconfigured Active Directory ACLs for privilege escalation. Covers GenericAll, GenericWrite, WriteDACL, WriteOwner,…
@blacklanternsecurityInstall SkillSecurity
Skill
/auth-coercion-relay
Forces remote systems to authenticate back to attacker-controlled listeners and relays captured authentication to escalate privileges or move laterally. Covers authentication coercion (PetitPotam, PrinterBug, DFSCoerce, ShadowCoerce, CheeseOunce), NTLM relay (ntlmrelayx to
Claude Code
$ npx -y skills add blacklanternsecurity/red-run --skill auth-coercion-relay --agent claude-code
Codex
$ npx skills add blacklanternsecurity/red-run --skill auth-coercion-relay -a codex -y
Cursor
$ npx skills add blacklanternsecurity/red-run --skill auth-coercion-relay -a cursor -y
Gemini CLI
$ npx skills add blacklanternsecurity/red-run --skill auth-coercion-relay -a gemini-cli -y
GitHub Copilot
$ npx skills add blacklanternsecurity/red-run --skill auth-coercion-relay -a github-copilot -y
OpenCode
$ npx skills add blacklanternsecurity/red-run --skill auth-coercion-relay -a opencode -y
Windsurf
$ npx skills add blacklanternsecurity/red-run --skill auth-coercion-relay -a windsurf -y
SKILL.md
auth-coercion-relay.SKILL.mdThis file is not shown here. Its text matched a pattern that tries to override an agent's instructions. Read it on GitHub ↗
Ships withred-run
Security assessment toolkit for Claude Code. red-run combines skills, MCP servers, and Claude Code agent teams with routing logic that guides Claude and the operator through the phases of a security assessment — recon, initial access, lateral movement,
30079 skills12 agents7 MCP
Stars on GitHub
Momentum
- stars in total
- 300
Other skills on red-run.
@blacklanternsecurityInstall Skillad-discovery
Enumerates Active Directory domains and maps attack surface for penetration testing.
@blacklanternsecurityInstall Skillad-persistence
Establishes persistent access in Active Directory environments after domain compromise. Covers DCShadow (rogue DC attribute…
@blacklanternsecurityInstall Skilladcs-access-and-relay
Exploits ADCS through ACL abuse on templates/CA objects and NTLM relay to enrollment endpoints. Covers ESC4 (template ACL →…
@blacklanternsecurityInstall Skilladcs-persistence
Establishes persistence and exploits weak certificate mapping in AD CS. Covers ESC9 (no security extension), ESC10 (weak…
@blacklanternsecurityInstall Skilladcs-template-abuse
Exploits misconfigured AD CS certificate templates to impersonate any domain user via SAN manipulation or enrollment agent abuse.…
@blacklanternsecurityInstall SkillMore skills from other plugins.
api-security
Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication,…
@zhaoxuya520Install Skillabusing-dpapi-for-cred…
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys)…
@mukul975Install Skillclean-user-facing-text
Clean and finalize authorized natural-language text intended for readers by auditing suspicious invisible Unicode and rewriting…
@guillaumemeyerInstall Skill
Questions about auth-coercion-relay.
- Which coding agents can use auth-coercion-relay?
- auth-coercion-relay installs in Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI, using each agent's flag shown on this page. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.