Offensive Claude

Offensive Security Research Config for Claude Code

A spec-driven offensive security framework for Claude Code — structured engagement workflows based on the Cyber Kill Chain, 32 kill-chain skills (multi-file progressive-disclosure) plus a discipline layer (a SessionStart dispatcher + 6 process/discipline skills), 8 collaborative agents, and a shared 47-file vulnerability reference library. Inspired by GitHub's spec-kit, obra/superpowers, and gadievron/raptor (crash→exploitability + OSS-repo forensics).

Quick Setup

Installing as a plugin registers a SessionStart hook that injects the
using-offensive-claude dispatcher into every conversation, so the skill-invocation discipline
(scope → finding → OPSEC) is active from the first message.

Skills and agents activate automatically — no additional configuration needed.

Engagement Workflow

Engagements follow the Cyber Kill Chain as a structured 9-phase pipeline with quality gates:

Quick Start — Web App Pentest

Orchestration Commands

Workflow Presets

Quality Gates

Each phase transition validates:
- Required artifacts exist (templates filled)
- Findings have mandatory fields (CWE, CVSS, evidence, ATT&CK ID)
- Gate PASS → suggests next phase + relevant skills
- Gate FAIL → lists missing items

Structure

Safety, Testing & Autonomy

The framework's safety controls are executable, not prose, and covered by an automated test suite:

All safety code is adversarially red-teamed and regression-tested. See TERMS.md for the
authorization requirement — every request the toolkit sends is the operator's responsibility.

Crash → Exploitability Pipeline

For native memory-corruption work, a staged-proof pipeline turns "it crashes" into a defensible,
artefact-backed exploitability verdict — run via /engage.crash in the .devcontainer/…