secskills

SecSkills

Security skills for Claude Code that encode the judgment professionals bring, not another wrapper around a scanner. Offense, defense, and the reverse-engineering and code-audit core both sides share. Every skill is fact-checked against primary sources.

Claude already knows what nmap -sV does. What it does not reliably hold is the discipline: trace a finding to demonstrated impact before you report it, capture memory before someone reimages the box, refuse to ship a detection that was never tested against production noise, notice the honeypot before you touch it. SecSkills is that discipline, written down and routed to the moment it applies.

Three plugins in one marketplace. Install only the side you work:

Plugin	For
secskills-offense	Red team, pentest, offensive AppSec
secskills-defense	DFIR, SOC, detection engineering, threat intel
secskills-core	Reverse engineering, code/crypto audit, AI/MCP security, reporting; shared by both

/plugin marketplace add trilwu/secskills

# Offensive — red team / pentest / offensive AppSec
/plugin install secskills-offense@secskills-marketplace
/plugin install secskills-core@secskills-marketplace

# Defensive — DFIR / SOC / detection
/plugin install secskills-defense@secskills-marketplace
/plugin install secskills-core@secskills-marketplace

/reload-plugins

Skills reference their siblings by name across plugins. A hand-off to a skill you did not install is an inert mention, so nothing breaks. You get the skills you have.

---

Who it's for

SecSkills is built for four working roles. Each gets a coherent toolkit, not a grab-bag.

🔴 Red team / pentest → offense + core

Full attack-chain methodology with the tradecraft judgment that separates a finding from a footgun: recon and enumeration, Active Directory and Entra ID (Kerberos delegation, AD CS ESC1-16, DCSync), cloud and managed Kubernetes, container escapes, mobile, wireless, and web/API/auth exploitation. Plus the engagement discipline most collections skip: recognizing-deception (spot the honeypot/canary before you trip it), maintaining-engagement-state (credential provenance and the cleanup register that survives a context window), and reporting-security-findings.

🛡️ AppSec / code review → core (+ offense to prove impact)

Source-audit methodology with a four-question verification gate, PR review that reads the lines a change removed, cryptography-misuse review, supply-chain and CI/CD auditing, and AI/LLM + MCP security. Language-agnostic by default, with auditing-php-applications for PHP's specific footguns (unserialize/phar:// POP chains, type-juggling auth bypass, php:// wrappers) and hunting-web-backdoors for planted webshells. Reach into offense when you need to demonstrate the bug, not just describe it. And when the target is big enough to warrant a campaign, orchestrating-vulnerability-research runs the hunt as an adversarial loop: builders hunt each slice, an independent critic tries to refute every candidate against the running target, and nothing counts until it is proven, not plausible.

🔵 DFIR / incident response → defense + core

Preserve-first response: memory/disk/network forensics, malware and shellcode analysis, Windows endpoint DFIR, Linux persistence hunting, and cross-cloud incident investigation for AWS, Azure, GCP, and M365/Entra. Each is built around the audit-log defaults that decide whether a question is even answerable. Backed by the RE core (native, Go/Rust/.NET, iOS, firmware, packers).

🟣 SOC / detection engineering → defense + core

The high-volume work, done with base-rate discipline: triaging-security-alerts (the true / benign-true / false-positive distinction that keeps a detection program alive), detection-as-code across Sigma/YARA/Suricata with real false-positive analysis, hypothesis-driven threat hunting, risk-based vulnerability management (KEV + EPSS, not raw CVSS), and finished threat intelligence with attribution discipline.

Cloud and Kubernetes are covered from both sides: exploiting-cloud-platforms / attacking-eks-gke-aks for red, hardening-cloud-posture / defending-kubernetes / investigating-*-incidents for blue, so purple-team work stays in one vocabulary.

What makes a skill

Each skill is a methodology, not a command dump, with three things a cheat sheet does not give you:

• An explicit scope and hand-off. Every skill says when to use a different one, named in backticks. That is how the skills compose instead of colliding.
• A Rationalizations to Reject section: the plausible-sounding shortcuts that cause missed findings and bad calls, each with why it is wrong. This is the highest-value part of most skills; it is the judgment a command list cannot carry.
• Two tiers that stay out of your way. Domain skills carry methodology for a whole area and trigger on plain-language requests. Procedure skills cover one exact target-and-toolchain that is rare and unrecoverable from general knowledge (reversing a Flutter app with blutter, say), and load only when their identifying evidence is present. Neither costs context until it applies.

Every skill is fact-checked, and dated

Every skill has been verified line-by-line against primary sources (vendor docs, RFCs, tool source) and carries a verified: date in frontmatter. That is the whole point: the opposite of confidently-wrong AI output.

python3 scripts/validate.py --strict                 # "Fact-checked ...: 92/92"
grep -L "^verified:" secskills-*/skills/*/SKILL.md   # unverified skills (none)

What that pass caught is why it exists. The first sampled dozen skills held 31 factual errors, about 2.6 per skill, so the whole collection was driven through the same pass. Cross-cutting sweeps then found the high-impact ones: CrackMapExec archived since 2023 (14 dead invocations → NetExec/nxc), the retired AzureAD PowerShell module (→ Microsoft Graph), Volatility's entry point wrong in ~40 commands (vol, not volatility3), a fabricated Sigma utf8 modifier, and stale M365 audit-log retention that would read an empty 90-day window as "no activity" when six months of history existed.

Two honest caveats:

• verified: is dated, not eternal. Tool flags, CVE version bounds, retention windows, and API paths drift. Trust the methodology (the sequencing, the scope, the Rationalizations to Reject) and re-confirm any specific before it lands in a deliverable. The re-verification method is itself a skill: .claude/skills/verifying-skill-accuracy.
• CI checks form, not truth. validate.py, sync_attack.py, and run_evals.py verify structure, the ATT&CK index, and routing against self-authored cases. A green run means well-formed; the verified: dates are the accuracy signal.

Skills

Code and application security

Skill	Use it for
auditing-code-for-vulnerabilities	Full source audit: context → attack surface → bug-class hunt → variant analysis, with a four-question verification gate
orchestrating-vulnerability-research	Run a discovery campaign across a codebase, binary, or live target: split the surface into slices, hunt each with a builder agent, and have a separate critic refute every candidate against the running artifact before it counts
auditing-php-applications	PHP-specific bugs: unserialize/phar:// POP chains, type juggling, php:// wrappers, superglobal trust, WordPress/Magento/Laravel
hunting-web-backdoors	Sweep a web tree for planted webshells: static deobfuscation, append-infections, known shell families as leads
reviewing-code-changes	Security review of a diff, branch, or PR, including the lines the change removed
testing-web-applications	Black-box web testing: injection, auth, JWT, SSRF, uploads
testing-apis	REST and GraphQL: BOLA, mass assignment, rate limits
reviewing-cryptography	Crypto misuse: AEAD, nonces, key management, timing, TLS, JWT
auditing-supply-chain	Dependencies, malicious packages, GitHub Actions, SBOM, provenance
auditing-mcp-servers	Reviewing an MCP server: tool-definition injection, token passthrough, per-tool authorization
vetting-agent-extensions	Deciding whether a third-party skill, plugin, or MCP server is safe to install: context-loaded content as injection surface, config that runs on startup, trust verdict
securing-ai-systems	LLM and agentic security: prompt injection, tool authority, RAG isolation, the lethal trifecta
exploiting-web3-smart-contracts	Solidity and smart contract auditing

Defense, detection, and response

Skill	Use it for
triaging-security-alerts	Work an alert queue to a defensible disposition: true / benign-true / false-positive, base rates, time-boxing
responding-to-incidents	DFIR: evidence preservation, artifact analysis, timelining, scoping, containment
analyzing-malware	Containment-first sample analysis, config and C2 extraction, IOC and YARA output
engineering-detections	Sigma/YARA/Suricata authoring with real false-positive analysis
hunting-threats	Hypothesis-driven hunting with stack counting and outlier analysis
managing-vulnerabilities	Risk-based remediation order: KEV + EPSS + reachability + asset value, SSVC, not raw CVSS
producing-threat-intelligence	Indicator pivoting, actor/campaign tracking, attribution discipline, finished intel products
reporting-security-findings	Severity, proof of concept, report structure, disclosure

Offensive operations

Skill	Use it for
recognizing-deception	Spot honeypots, canary tokens, and decoy accounts before you trip them
maintaining-engagement-state	Credential provenance, access inventory, and the cleanup register across a multi-day engagement
performing-reconnaissance	OSINT, subdomain enumeration, attack surface mapping
enumerating-network-services	Service enumeration and exploitation
attacking-active-directory	Kerberoasting, BloodHound, DCSync, lateral movement
escalating-linux-privileges	SUID, capabilities, sudo, cron, kernel
escalating-windows-privileges	Services, DLL hijacking, tokens, potato attacks
exploiting-containers	Docker and Kubernetes escapes and misconfiguration
exploiting-cloud-platforms	AWS, Azure, GCP enumeration and abuse
testing-mobile-applications	Android and iOS assessment
attacking-wireless-networks	Wi-Fi attacks and capture
cracking-passwords	Hash identification and offline cracking
establishing-persistence	Post-exploitation persistence
transferring-files	File transfer and exfiltration channels
performing-social-engineering	Authorized phishing and pretexting
exploiting-memory-corruption	Turn a crash into a working exploit: ROP, heap grooming, defeating ASLR/NX/canary/RELRO
testing-thick-clients	Desktop fat-client testing: non-HTTP proxying, config/memory secrets, client-side trust bypass, two-tier DB access
attacking-hardware-interfaces	Physical device surface: UART/JTAG, SPI flash-off, secure-boot triage, sub-GHz SDR replay feasibility

Web and API procedure skills

Skill	Triggers on
exploiting-ssrf	Any feature that fetches a user-supplied URL; webhooks, importers, renderers
exploiting-deserialization	rO0AB, AAEAAAD, O:, gAJ in a cookie or parameter
attacking-graphql	/graphql, a query/mutation body, {data, errors} envelope
attacking-grpc-protobuf	HTTP/2 with application/grpc, opaque binary bodies
attacking-jwt	A token starting eyJ in a header, cookie, or body