writing-offensive-skills

Name: writing-offensive-skills
Author: hypnguyen1209

320stars55forks

How to install writing-offensive-skills?

hypnguyen1209/offensive-claude/writing-offensive-skills

$npx -y skills add hypnguyen1209/offensive-claude --skill writing-offensive-skills

Installs into the current project.

Summary

Use when creating or editing a skill in this offensive-claude repo — for the SKILL.md conventions (trigger descriptions, technique map, runnable scripts, OPSEC/detection, red-flags tables, flowchart rules)

Files · 1

View on GitHub

SKILL.md

1	# Writing Offensive Skills
2
3	## Overview
4
5	Conventions for authoring skills in this repo so the dispatcher can find them and operators can
6	trust them. This adapts superpowers' skill conventions to offensive security.
7
8	REQUIRED BACKGROUND: superpowers:writing-skills (the general conventions) and
9	superpowers:test-driven-development (skills are tested like code — baseline failure first).
10
11	## Description = triggers only
12
13	The `description:` field decides whether the dispatcher loads the skill. Write `Use when…`
14	triggering conditions and symptoms ONLY — never summarize the skill's workflow (a workflow summary
15	makes Claude follow the description instead of reading the skill).
16
17	```yaml
18	# BAD (summarizes workflow): description: Recon skill that enumerates subdomains then scans ports
19	# GOOD (triggers only): description: Use when mapping a target's external attack surface — subdomains, hosts, exposed services
20	```
21
22	Third person, technology-specific only if the skill is. Verb-first / gerund names.
23
24	## Skill layout (progressive disclosure)
25
26	```
27	skills/<name>/
28	SKILL.md # thin router, <=180 lines
29	references/ # per-technique deep-dives (theory + 2024-2026 + code + detection + OPSEC)
30	scripts/ # runnable tooling (no placeholders)
31	```
32
33	Domain (technique) skill SKILL.md sections, in order: frontmatter → When to Activate →
34	Technique Map (Technique \| ATT&CK Txxxx \| CWE \| reference \| script) → Quick Start →
35	OPSEC & Detection table → Deep Dives (links into `references/`).
36
37	Discipline skill (a hard rule, e.g. finding/scope/opsec-discipline): Overview with the Iron Law →
38	the rule → Red Flags (STOP signals) → Rationalizations table (excuse \| reality). State
39	"violating the letter is violating the spirit" and close loopholes explicitly.
40
41	## The four pillars (every technique)
42
43	2024-2026 currency (web-search-verified CVEs; no fabricated ids — mark unverified ones), runnable
44	scripts, OPSEC + detection pairing, technique-level ATT&CK + CWE.
45
46	## Flowcharts
47
48	Only for non-obvious decision points / "where you might stop too early". Never for reference
49	material (use tables), code (use blocks), or linear steps (use lists).
50
51	## Cross-references
52
53	Name only, with explicit markers: `REQUIRED: scope-discipline`. Never `@`-link (force-loads,
54	burns context). Frontmatter `references:`/`scripts:` list the files the skill ships.
55
56	## Test before you trust
57
58	A skill that enforces discipline must resist rationalization under pressure. Capture the excuses an
59	agent makes without the skill, put each in the Rationalizations table, and re-check. Safety-relevant
60	scripts get a `tests/` suite (run `pytest`) and an adversarial review before they're trusted.
61
62	## Red Flags
63
64	- Description summarizes the workflow → rewrite to triggers only
65	- A domain skill with no Technique Map / no ATT&CK+CWE / no detection → incomplete
66	- A discipline skill with no Red Flags / no Rationalizations table → won't hold under pressure
67	- Fabricated CVE/arXiv ids presented as real → mark UNVERIFIED or remove

People who liked this also viewed

6 picks

Type

writing-offensive-skills

320stars55forks

View on GitHub

How to install writing-offensive-skills?

hypnguyen1209/offensive-claude/writing-offensive-skills

$npx -y skills add hypnguyen1209/offensive-claude --skill writing-offensive-skills

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Writing Offensive Skills
2
3	## Overview
4
5	Conventions for authoring skills in this repo so the dispatcher can find them and operators can
6	trust them. This adapts superpowers' skill conventions to offensive security.
7
8	REQUIRED BACKGROUND: superpowers:writing-skills (the general conventions) and
9	superpowers:test-driven-development (skills are tested like code — baseline failure first).
10
11	## Description = triggers only
12
13	The `description:` field decides whether the dispatcher loads the skill. Write `Use when…`
14	triggering conditions and symptoms ONLY — never summarize the skill's workflow (a workflow summary
15	makes Claude follow the description instead of reading the skill).
16
17	```yaml
18	# BAD (summarizes workflow): description: Recon skill that enumerates subdomains then scans ports
19	# GOOD (triggers only): description: Use when mapping a target's external attack surface — subdomains, hosts, exposed services
20	```
21
22	Third person, technology-specific only if the skill is. Verb-first / gerund names.
23
24	## Skill layout (progressive disclosure)
25
26	```
27	skills/<name>/
28	SKILL.md # thin router, <=180 lines
29	references/ # per-technique deep-dives (theory + 2024-2026 + code + detection + OPSEC)
30	scripts/ # runnable tooling (no placeholders)
31	```
32
33	Domain (technique) skill SKILL.md sections, in order: frontmatter → When to Activate →
34	Technique Map (Technique \| ATT&CK Txxxx \| CWE \| reference \| script) → Quick Start →
35	OPSEC & Detection table → Deep Dives (links into `references/`).
36
37	Discipline skill (a hard rule, e.g. finding/scope/opsec-discipline): Overview with the Iron Law →
38	the rule → Red Flags (STOP signals) → Rationalizations table (excuse \| reality). State
39	"violating the letter is violating the spirit" and close loopholes explicitly.
40
41	## The four pillars (every technique)
42
43	2024-2026 currency (web-search-verified CVEs; no fabricated ids — mark unverified ones), runnable
44	scripts, OPSEC + detection pairing, technique-level ATT&CK + CWE.
45
46	## Flowcharts
47
48	Only for non-obvious decision points / "where you might stop too early". Never for reference
49	material (use tables), code (use blocks), or linear steps (use lists).
50
51	## Cross-references
52
53	Name only, with explicit markers: `REQUIRED: scope-discipline`. Never `@`-link (force-loads,
54	burns context). Frontmatter `references:`/`scripts:` list the files the skill ships.
55
56	## Test before you trust
57
58	A skill that enforces discipline must resist rationalization under pressure. Capture the excuses an
59	agent makes without the skill, put each in the Rationalizations table, and re-check. Safety-relevant
60	scripts get a `tests/` suite (run `pytest`) and an adversarial review before they're trusted.
61
62	## Red Flags
63
64	- Description summarizes the workflow → rewrite to triggers only
65	- A domain skill with no Technique Map / no ATT&CK+CWE / no detection → incomplete
66	- A discipline skill with no Red Flags / no Rationalizations table → won't hold under pressure
67	- Fabricated CVE/arXiv ids presented as real → mark UNVERIFIED or remove

People who liked this also viewed

6 picks

Type