Writing Offensive Skills for Claude
Use when creating or editing a skill in this offensive-claude repo — for the SKILL.md conventions (trigger descriptions, technique map, runnable scripts, OPSEC/detection, red-flags tables, flowchart rules)
Install
one command, takes just this skill from the repositorynpx skills add https://github.com/hypnguyen1209/offensive-claude --skill writing-offensive-skillsThe instruction itself
9 sections, as written by the authorWriting Offensive Skills
Overview
Conventions for authoring skills in this repo so the dispatcher can find them and operators can
trust them. This adapts superpowers' skill conventions to offensive security.
REQUIRED BACKGROUND: superpowers:writing-skills (the general conventions) and
superpowers:test-driven-development (skills are tested like code — baseline failure first).
Description = triggers only
The description: field decides whether the dispatcher loads the skill. Write Use when…
triggering conditions and symptoms ONLY — never summarize the skill's workflow (a workflow summary
makes Claude follow the description instead of reading the skill).
# BAD (summarizes workflow): description: Recon skill that enumerates subdomains then scans ports
# GOOD (triggers only): description: Use when mapping a target's external attack surface — subdomains, hosts, exposed services
Third person, technology-specific only if the skill is. Verb-first / gerund names.
Skill layout (progressive disclosure)
skills/<name>/
SKILL.md # thin router, <=180 lines
references/ # per-technique deep-dives (theory + 2024-2026 + code + detection + OPSEC)
scripts/ # runnable tooling (no placeholders)
Domain (technique) skill SKILL.md sections, in order: frontmatter → When to Activate →
Technique Map (Technique | ATT&CK Txxxx | CWE | reference | script) → Quick Start →
OPSEC & Detection table → Deep Dives (links into references/).
Discipline skill (a hard rule, e.g. finding/scope/opsec-discipline): Overview with the Iron Law →
the rule → Red Flags (STOP signals) → Rationalizations table (excuse | reality). State
"violating the letter is violating the spirit" and close loopholes explicitly.
The four pillars (every technique)
2024-2026 currency (web-search-verified CVEs; no fabricated ids — mark unverified ones), runnable
scripts, OPSEC + detection pairing, technique-level ATT&CK + CWE.
Flowcharts
Only for non-obvious decision points / "where you might stop too early". Never for reference
material (use tables), code (use blocks), or linear steps (use lists).
Cross-references
Name only, with explicit markers: REQUIRED: scope-discipline. Never @-link (force-loads,
burns context). Frontmatter references:/scripts: list the files the skill ships.
Test before you trust
A skill that enforces discipline must resist rationalization under pressure. Capture the excuses an
agent makes without the skill, put each in the Rationalizations table, and re-check. Safety-relevant
scripts get a tests/ suite (run pytest) and an adversarial review before they're trusted.
Red Flags
- Description summarizes the workflow → rewrite to triggers only
- A domain skill with no Technique Map / no ATT&CK+CWE / no detection → incomplete
- A discipline skill with no Red Flags / no Rationalizations table → won't hold under pressure
- Fabricated CVE/arXiv ids presented as real → mark UNVERIFIED or remove
Other skills for the same job
different authors, same section of the catalogue
Guide users through a structured workflow for co-authoring documentation. Use when user wants to write documentation, proposals, technical specs, decision docs, or similar structured content. This workflow helps users efficiently transfer context, refine content through iteration, and verify the doc works for readers. Trigger when user mentions writing docs, creating proposals, drafting specs, or similar documentation tasks.
Automatically creates user-facing changelogs from git commits by analyzing commit history, categorizing changes, and transforming technical commits into clear, customer-friendly release notes. Turns hours of manual changelog writing into minutes of automated generation.
Use when implementing any feature or bugfix, before writing implementation code
Use when you have a spec or requirements for a multi-step task, before touching code
Use when creating new skills, editing existing skills, or verifying skills work before deployment
Use when writing or improving README files. Not all READMEs are the same — provides templates and guidance matched to your audience and project type.
| Remove signs of AI-generated writing from text. Use when editing or reviewing text to make it sound more natural and human-written. Based on Wikipedia's inflated symbolism, promotional language, superficial -ing analyses, vague attributions, em dash overuse, rule of three, AI vocabulary words, negative parallelisms, and excessive conjunctive phrases.
Official Opentrons Protocol API for OT-2 and Flex robots. Use when writing protocols specifically for Opentrons hardware with full access to Protocol API v2 features. Best for production Opentrons protocols, official API compatibility. For multi-vendor automation or broader equipment control use pylabrobot.
How to use it
Take hypnguyen1209/writing-offensive-skills from the repository into ~/.claude/skills for personal
use, or into .claude/skills inside a project.
The agent identifies a skill by the name field in its header. Two skills with the
same name cannot sit side by side — one of them will be ignored.