This skill provides methodology and tooling for planning and executing authorized red team engagements, including attack path analysis, MITRE ATT&CK technique scoring, choke point identification, OPSEC risk assessment, and crown jewel targeting. It produces structured attack plans and engagement reports.

✨ What it does

  • Generates scored, kill-chain-ordered attack plans via engagement_planner.py.
  • Scores techniques by effort and detection risk.
  • Identifies choke points in attack paths.
  • Assesses OPSEC risks for each phase.
  • Targets crown jewels defined in the Rules of Engagement.
  • Enforces authorization requirement with --authorized flag.

🎯 When to use it

  • Planning an authorized red team engagement or offensive security simulation.
  • Analyzing attack paths to identify choke points and prioritize detection.
  • Scoping a red team exercise with defined crown jewels and success criteria.
  • Conducting an assumed breach tabletop exercise to test detection capabilities.

🚀 How to use

Trigger by asking for red team planning or attack path analysis, or run the engagement_planner.py script directly. Inputs include technique IDs, access level (external/internal/credentialed), crown jewels, and optional target count. Example prompts:

Plan a red team engagement for an external attacker targeting our database server.
Run engagement_planner.py with techniques T1059,T1078,T1003, access-level external, and crown jewels 'Database'.

📄 Output: A JSON engagement plan with phases, choke points, OPSEC risks, and effort scores.

📦 Add this skill to Claude Code

# 1. Get the skills repo
git clone --depth 1 https://github.com/alirezarezvani/claude-skills /tmp/claude-skills

# 2. Copy this skill into your project (or ~/.claude/skills for all projects)
mkdir -p .claude/skills
cp -r /tmp/claude-skills/engineering-team/skills/red-team .claude/skills/red-team

Skill source: engineering-team/skills/red-team/SKILL.md

⚠️ Good to know

Requires written authorization (signed Rules of Engagement) and the --authorized flag; unauthorized use is illegal.

❓ FAQ

What is the difference between this skill and security-pen-testing?

This skill focuses on structured adversary simulation and attack planning, while security-pen-testing is about systematic exploitation of specific vulnerabilities.

What does the --authorized flag do?

It confirms that the engagement has written authorization; without it, the tool will not generate output.

How are choke points identified?

Choke points are techniques in credential_access and privilege_escalation that are prerequisites for multiple paths to crown jewels.

🤖 Overview, features, install steps and FAQ were generated from the project's SKILL.md on Sep 4, 2026. Always check the original source before running commands.