Red Team
This skill provides methodology and tooling for planning and executing authorized red team engagements, including attack path analysis, MITRE ATT&CK technique scoring, choke point identification, OPSEC risk assessment, and crown jewel targeting. It produces structured attack plans and engagement reports.
✨ What it does
- Generates scored, kill-chain-ordered attack plans via engagement_planner.py.
- Scores techniques by effort and detection risk.
- Identifies choke points in attack paths.
- Assesses OPSEC risks for each phase.
- Targets crown jewels defined in the Rules of Engagement.
- Enforces authorization requirement with --authorized flag.
🎯 When to use it
- Planning an authorized red team engagement or offensive security simulation.
- Analyzing attack paths to identify choke points and prioritize detection.
- Scoping a red team exercise with defined crown jewels and success criteria.
- Conducting an assumed breach tabletop exercise to test detection capabilities.
🚀 How to use
Trigger by asking for red team planning or attack path analysis, or run the engagement_planner.py script directly. Inputs include technique IDs, access level (external/internal/credentialed), crown jewels, and optional target count. Example prompts:
Plan a red team engagement for an external attacker targeting our database server.
Run engagement_planner.py with techniques T1059,T1078,T1003, access-level external, and crown jewels 'Database'.
📄 Output: A JSON engagement plan with phases, choke points, OPSEC risks, and effort scores.
📦 Add this skill to Claude Code
# 1. Get the skills repo
git clone --depth 1 https://github.com/alirezarezvani/claude-skills /tmp/claude-skills
# 2. Copy this skill into your project (or ~/.claude/skills for all projects)
mkdir -p .claude/skills
cp -r /tmp/claude-skills/engineering-team/skills/red-team .claude/skills/red-teamSkill source: engineering-team/skills/red-team/SKILL.md
⚠️ Good to know
Requires written authorization (signed Rules of Engagement) and the --authorized flag; unauthorized use is illegal.
❓ FAQ
What is the difference between this skill and security-pen-testing?
This skill focuses on structured adversary simulation and attack planning, while security-pen-testing is about systematic exploitation of specific vulnerabilities.
What does the --authorized flag do?
It confirms that the engagement has written authorization; without it, the tool will not generate output.
How are choke points identified?
Choke points are techniques in credential_access and privilege_escalation that are prerequisites for multiple paths to crown jewels.
🤖 Overview, features, install steps and FAQ were generated from the project's SKILL.md on Sep 4, 2026. Always check the original source before running commands.