/operation
Run an objectives-based adversary-emulation operation aligned to real threat-actor TTPs, recon to impact.
$ npx -y skills add jassics/awesome-claude-security --agent claude-codeHow it fires
How this command gets triggered: by you, by Claude, or both.
- Fires itselfClaude auto-loads it when your prompt matches the work.
- You can call itInvoke it directly when you want it.
- Slash command
/operation
Context preview
What this command does when you run it.
Run an objectives-based adversary-emulation operation aligned to real threat-actor TTPs, recon to impact.
Command definition
operation.mddescription: Run an objectives-based adversary-emulation operation aligned to real threat-actor TTPs, recon to impact.
argument-hint: [objective / threat actor to emulate + scope]
Plan and run an **authorized** red-team operation for: **$ARGUMENTS**
Confirm authorization, objective(s), and rules of engagement first — red-team work is objective-driven (e.g., "reach the crown-jewel data"), not vulnerability-coverage. If the objective or scope is unclear, ask.
Walk the operation, using installed skills (note any whose plugin is missing):
1. **Threat intel** — `/threat-intelligence:threat-actor-profiling` to pick a realistic actor and its TTPs. 2. **Map TTPs** — `/security-knowledge:attack-lookup` to translate the actor's behaviors into ATT&CK techniques to emulate. 3. **Recon** — `/osint:osint-footprinting` and `/osint:exposure-discovery` for the initial-access surface. 4. **Emulate** — `/red-team:adversary-emulation` to execute the chosen TTP chain (initial access → execution → persistence → priv-esc → lateral movement → impact), with `/network-security:network-pentest` for the network legs. 5. **Report** — `/security-reporting:pentest-report` for the operation narrative and `/security-diagramming:attack-tree` for the attack path; map findings to ATT&CK for the blue team.
For deep execution, hand off to the `red-team-operator` agent. Emulate adversary behavior to test detection & response — log what *should* have been caught for the purple-team debrief.
Read more
description: Run an objectives-based adversary-emulation operation aligned to real threat-actor TTPs, recon to impact. argument-hint: [objective / threat actor to emulate + scope]
Plan and run an **authorized** red-team operation for: **$ARGUMENTS**
Confirm authorization, objective(s), and rules of engagement first — red-team work is objective-driven (e.g., "reach the crown-jewel data"), not vulnerability-coverage. If the objective or scope is unclear, ask.
Walk the operation, using installed skills (note any whose plugin is missing):
1. **Threat intel** — `/threat-intelligence:threat-actor-profiling` to pick a realistic actor and its TTPs. 2. **Map TTPs** — `/security-knowledge:attack-lookup` to translate the actor's behaviors into ATT&CK techniques to emulate. 3. **Recon** — `/osint:osint-footprinting` and `/osint:exposure-discovery` for the initial-access surface. 4. **Emulate** — `/red-team:adversary-emulation` to execute the chosen TTP chain (initial access → execution → persistence → priv-esc → lateral movement → impact), with `/network-security:network-pentest` for the network legs. 5. **Report** — `/security-reporting:pentest-report` for the operation narrative and `/security-diagramming:attack-tree` for the attack path; map findings to ATT&CK for the blue team.
For deep execution, hand off to the `red-team-operator` agent. Emulate adversary behavior to test detection & response — log what *should* have been caught for the purple-team debrief.
A Claude Code plugin marketplace for the full cybersecurity & GenAI-security lifecycle — from recon and threat modeling to detection engineering, GRC, and CISO-level strategy. A pentester knows which OWASP test bends a broken-access-control endpoint.
Repo: jassics/awesome-claude-security
Other commands on awesome-claude-security.
- /safety-review
Run an AI safety review for a feature/model — harms, evaluations, guardrails, and a documented safety case.
Open command - /defend
Run a threat-informed defense cycle for a technique or threat — coverage check, hunt, detection, and purple-team validation.
Open command - /board-brief
Build a board/executive security brief — strategy, quantified risk, and a board-ready deck.
Open command - /tech-review
Assess technology/security risk for a strategic decision and frame the secure-by-design path.
Open command - /precommit
Run the pre-commit security gate on the current changeset and report a single pass/fail verdict.
Open command - /assessment
Run a compliance gap-assessment for a framework, tie gaps to risk, and produce findings + remediation.
Open command