A spec-driven offensive security framework for Claude Code — structured engagement workflows based on the Cyber Kill Chain, 25 specialized skills, 6 collaborative agents, and 47 vulnerability reference files. Inspired by GitHub's spec-kit methodology.

# Method 1: One-liner install (recommended)
curl -sL https://raw.githubusercontent.com/hypnguyen1209/offensive-claude/main/install.sh | bash

# Method 2: Clone + install script
git clone https://github.com/hypnguyen1209/offensive-claude.git ~/offensive-claude
cd ~/offensive-claude && bash install.sh

# Method 3: Manual copy
git clone https://github.com/hypnguyen1209/offensive-claude.git ~/offensive-claude
cp -r ~/offensive-claude/skills ~/.claude/skills
cp -r ~/offensive-claude/agents ~/.claude/agents
cp -r ~/offensive-claude/templates ~/.claude/templates
cp -r ~/offensive-claude/workflows ~/.claude/workflows
cp -r ~/offensive-claude/commands ~/.claude/commands
cp -r ~/offensive-claude/presets ~/.claude/presets
cp ~/offensive-claude/CLAUDE.md ~/.claude/CLAUDE.md

Skills and agents activate automatically — no additional configuration needed.

Engagements follow the Cyber Kill Chain as a structured 9-phase pipeline with quality gates:

Phase 0    Phase 1    Phase 2      Phase 3     Phase 4       Phase 5       Phase 6    Phase 7       Phase 8
SCOPE  →  RECON  →  WEAPONIZE →  DELIVERY →  EXPLOIT  →  INSTALLATION →   C2    →  ACTIONS ON →  REPORT
                                                                                    OBJECTIVES

/engage.init web-app --client ACME
/engage.scope                           # Define targets, ROE, authorization
/engage.recon                           # Subdomain enum, port scan, tech fingerprint
/engage.weaponize                       # Select exploits, design payloads
/engage.exploit                         # Execute exploits, document findings
/engage.report                          # Generate technical report + executive summary

Each phase transition validates:

• Required artifacts exist (templates filled)
• Findings have mandatory fields (CWE, CVSS, evidence, ATT&CK ID)
• Gate PASS → suggests next phase + relevant skills
• Gate FAIL → lists missing items

.
├── skills/                        # 25 skill modules (SKILL.md per directory)
│   ├── recon-osint/
│   ├── exploit-development/
│   ├── ...
│   └── references/                # 47 vulnerability pattern files
├── agents/                        # 6 collaborative sub-agents
├── templates/                     # Structured templates per Kill Chain phase
│   ├── scope/                     #   Phase 0: scope-definition, emergency-contact
│   ├── recon/                     #   Phase 1: recon-plan, attack-surface
│   ├── weaponize/                 #   Phase 2: exploit-blueprint, payload-config
│   ├── delivery/                  #   Phase 3: delivery-plan, social-engineering
│   ├── exploit/                   #   Phase 4: exploit-plan, finding records
│   ├── install/                   #   Phase 5: persistence, cleanup-plan
│   ├── c2/                        #   Phase 6: c2-infrastructure, opsec-checklist
│   ├── actions/                   #   Phase 7: objectives, collection-plan
│   └── report/                    #   Phase 8: technical-report, executive-summary
├── workflows/                     # Kill Chain workflow definitions (YAML)
│   ├── WORKFLOW-ENGINE.md         #   Orchestration engine instructions
│   ├── web-app-pentest.yml
│   ├── red-team-engagement.yml
│   └── ...
├── commands/                      # /engage.* orchestration slash commands
├── presets/                       # Engagement type presets (7 presets)
├── CLAUDE.md                      # System prompt & behavior config
├── settings.json                  # Claude Code settings, permissions, MCP servers
├── install.sh                     # One-liner install script
└── README.md

Agents collaborate through structured handoffs — planning agents feed execution agents, execution agents feed analysis agents for validation.

Detailed patterns with vulnerable/secure code examples, organized by category:

• Taint Analysis (4): source-sink tracing, filter evaluation, threat model, false positive reduction
• Memory Safety (7): buffer overflow, integer overflow, UAF, null deref, OOB read, unsafe Rust
• Injection (11): SQL, command, XSS, SSRF, SSTI, XXE, deserialization, path traversal, file upload, prototype pollution, ReDoS
• Authentication (8): bypass, authorization flaws, session management, hardcoded creds, default creds, brute force, permissions
• Cryptography (4): weak algorithms, key management, side-channel, certificate validation
• Concurrency (3): race conditions, TOCTOU, established patterns
• Web/API (5): CORS, CSRF, open redirect, resource exhaustion, API security
• Supply Chain (3): dependency confusion, code integrity, ML model files
• Active Directory (1): delegation, GPO abuse, RODC, SCCM/WSUS, ADCS, trust attacks

1. Claude Code reads CLAUDE.md — sets offensive security persona with Kill Chain methodology
2. Use /engage.init <preset> to start a structured engagement, or use skills standalone
3. Each phase has templates, quality gates, skill mappings, and agent coordination
4. Agents collaborate through structured handoffs — planning → execution → analysis layers
5. Quality gates validate findings before phase transitions (CWE, CVSS, evidence required)
6. Reports are generated from structured finding records with evidence linking

• Add skills: create skills/<name>/SKILL.md with YAML frontmatter including kill_chain metadata
• Add agents: create agents/<name>.md with layer, phases, and collaboration metadata
• Add workflows: create workflows/<name>.yml following the workflow schema
• Add presets: create presets/<name>/preset.yml with phase/skill/agent selection
• Add templates: create templates/<phase>/<name>.md with gate and dependency metadata
• Add MCP servers: edit mcpServers in settings.json

• Claude Code CLI, Desktop App, or VS Code extension
• For MCP integrations: IDA Pro with ida-multi-mcp plugin, JADX with MCP server