claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.
This report summarizes scanner evidence for SnailSploit/Claude-Red, a Python project with 7,422 GitHub stars. SynthScan examined 97,843 lines of code across 92 source files, recording 414 pattern matches distributed across 13 syntactic categories. The legacy adjusted pattern signal is 4.8 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 324 finding(s).
Are imports declared and package/API names verified? 10 finding(s).
Are wrappers, guards, and repeated structures necessary? 84 finding(s).
Which changes need focused human review? 414 finding(s).
Run additional scans to build a history of the legacy pattern signal. Score changes are not a measure of AI adoption or code quality.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 414 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 1865 | # Step 1: Generate a cyclic pattern (de Bruijn sequence) | COMMENT |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 1874 | # Step 2: Crash the program with the pattern | COMMENT |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 1878 | # Step 3: Analyze the crash in GDB/Pwndbg (use the correct crash file- cwd or proper location) | COMMENT |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 1884 | # Step 4: Find the offset using the pattern in RIP | COMMENT |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 1893 | # Step 5: Verify control - overwrite RIP with a known value | COMMENT |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2076 | # Step 1: Find where return address is stored | COMMENT |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2083 | # Step 2: Query all writes to return address location | COMMENT |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2088 | # Step 3: Navigate to the corruption point | COMMENT |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2091 | # Step 4: Examine the guilty instruction | COMMENT |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2096 | # Step 5: Check registers to see the overflow in action | COMMENT |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2106 | # Step 1: Find and navigate to main() | COMMENT |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2114 | # Step 2: Examine argv (RDX = argv in Windows x64 calling convention) | COMMENT |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2121 | # Step 3: View the malicious input | COMMENT |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2127 | # Step 4: See how input reaches vulnerable function | COMMENT |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2132 | # Step 5: Find all reads from the input buffer to trace data flow | COMMENT |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2142 | # Step 1: Enable PageHeap for reliable UAF detection (run as admin) | COMMENT |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2145 | # Step 2: Record UAF crash with TTD | COMMENT |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2152 | # Step 3: Run to the crash | COMMENT |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2159 | # Step 4: Analyze the crash | COMMENT |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 3021 | # Step 1: Check if crash is on object method call | COMMENT |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 3025 | # Step 2: Check the object pointer | COMMENT |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 3029 | # Step 3: Check heap state (requires PageHeap enabled) | COMMENT |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 3033 | # Step 4: Back-trace with TTD (if available) | COMMENT |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 7071 | # Step 1: Record execution with crash input (test case 1 = stack overflow) | COMMENT |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 7075 | # Step 2: Decode the trace to see all branches taken | COMMENT |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 7079 | # Step 3: Find the crash point - last branches before crash | COMMENT |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 7090 | # Step 4: Convert to coverage for visualization | COMMENT |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 7094 | # Step 5: Compare with benign input (no crash - input fits in buffer) | COMMENT |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 7098 | # Step 6: Find unique crash path (code only hit during overflow) | COMMENT |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 7102 | # Step 7: Examine the unique addresses | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 1980 | # Step 8: Use TTD to examine the crash point | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 1987 | # Step 9: Examine the corrupted stack before ret executes | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2172 | # Step 5: Find all heap frees and identify the one matching crash address | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2181 | # Step 6: Get details on the free and navigate to it | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2193 | # Step 7: Navigate to use_after_free function entry | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2202 | # Step 8: Examine the freed memory at crash point | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2217 | # Step 9: Don't forget to disable PageHeap after analysis | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 6427 | #### Step 1: Generate CASR Reports | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 6457 | #### Step 2: Cluster Similar Crashes | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 6477 | #### Step 3: Prioritize by Exploitability | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 6497 | #### Step 4: Interactive Review with casr-cli | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 6510 | #### Step 5: Document Findings | COMMENT |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 7628 | # Step 1: Record the crash | STRING |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 7631 | # Step 2: Replay and analyze | STRING |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 7639 | # Step 3: Use reverse-next to trace back through execution | STRING |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 7648 | # Step 4: Set breakpoint and replay from start to catch corruption in action | STRING |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 7654 | # Step 5: Now buffer is in scope - examine stack layout and save return address | STRING |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 7665 | # Step 6: Break at strcpy call (avoids PLT resolution noise) | STRING |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 7670 | # Step 7: Set watchpoint on saved return address and continue into strcpy | STRING |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 7680 | # Step 8: Examine where we are - inside strcpy during the overflow | STRING |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 10449 | # Step 1: Minimize | STRING |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 10453 | # Step 2: Analyze | STRING |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 10459 | # Step 3: Generate PoC | STRING |
| LOW⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 10463 | # Step 4: Test PoC | STRING |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 11730 | # Step 1: Generate CASR reports for vuln_rop crashes | STRING |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 11762 | # Step 2: Cluster crashes | STRING |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 11766 | # Step 3: Review clusters | STRING |
| LOW⚡ | …ills/exploit-dev/offensive-basic-exploitation/SKILL.md | 2143 | # Step 1: Disassemble the binary | STRING |
| LOW⚡ | …ills/exploit-dev/offensive-basic-exploitation/SKILL.md | 2146 | # Step 2: Search for 'ret' instructions (opcode: 0xc3) | STRING |
| LOW⚡ | …ills/exploit-dev/offensive-basic-exploitation/SKILL.md | 2149 | # Step 3: Look backwards from each 'ret' for useful sequences | STRING |
| 117 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 1395 | #─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 1397 | #─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 1400 | #─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 1377 | #──────────────────────────────────────────────────────────────────────────────────────────────────────────────────[ REG | COMMENT |
| MEDIUM | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 4064 | # ================================================================= | COMMENT |
| MEDIUM | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 4068 | # ================================================================= | COMMENT |
| MEDIUM | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 5104 | #──────────────────────────────────────────────────────────────────────────────────────────────────────────────────[ REG | COMMENT |
| MEDIUM | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 5122 | #─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 5125 | #─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 8371 | #================================================================= | COMMENT |
| MEDIUM | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 10516 | # ============================================================ | STRING |
| MEDIUM | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 10518 | # ============================================================ | STRING |
| MEDIUM | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 11110 | # ================== | STRING |
| MEDIUM | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 11119 | # ================== | STRING |
| MEDIUM | …ills/exploit-dev/offensive-basic-exploitation/SKILL.md | 85 | # ============================================================ | COMMENT |
| MEDIUM | …ills/exploit-dev/offensive-basic-exploitation/SKILL.md | 87 | # ============================================================ | COMMENT |
| MEDIUM | …ills/exploit-dev/offensive-basic-exploitation/SKILL.md | 112 | # ============================================================ | COMMENT |
| MEDIUM | …ills/exploit-dev/offensive-basic-exploitation/SKILL.md | 114 | # ============================================================ | COMMENT |
| MEDIUM | …ills/exploit-dev/offensive-basic-exploitation/SKILL.md | 144 | # ============================================================ | COMMENT |
| MEDIUM | …ills/exploit-dev/offensive-basic-exploitation/SKILL.md | 146 | # ============================================================ | COMMENT |
| MEDIUM | …ills/exploit-dev/offensive-basic-exploitation/SKILL.md | 263 | # ============================================================ | COMMENT |
| MEDIUM | …ills/exploit-dev/offensive-basic-exploitation/SKILL.md | 265 | # ============================================================ | COMMENT |
| MEDIUM | …ills/exploit-dev/offensive-basic-exploitation/SKILL.md | 1940 | # ============================================================ | STRING |
| MEDIUM | …ills/exploit-dev/offensive-basic-exploitation/SKILL.md | 1942 | # ============================================================ | STRING |
| MEDIUM | …ills/exploit-dev/offensive-basic-exploitation/SKILL.md | 1955 | # ============================================================ | STRING |
| MEDIUM⚡ | …/infrastructure/offensive-windows-mitigations/SKILL.md | 1141 | # ---------------------------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …/infrastructure/offensive-windows-mitigations/SKILL.md | 1434 | # --------------------------------------------- | COMMENT |
| MEDIUM | …/infrastructure/offensive-windows-mitigations/SKILL.md | 1443 | # ------------------------------------------------------------ | COMMENT |
| MEDIUM | …/infrastructure/offensive-windows-mitigations/SKILL.md | 1458 | # ------------------------------------------------------------------- | COMMENT |
| MEDIUM | …/infrastructure/offensive-windows-mitigations/SKILL.md | 2493 | # ================================================ | COMMENT |
| MEDIUM | …/infrastructure/offensive-windows-mitigations/SKILL.md | 6357 | # ========================================================================= | COMMENT |
| MEDIUM | …/infrastructure/offensive-windows-mitigations/SKILL.md | 6361 | # ========================================================================= | COMMENT |
| MEDIUM | …s/infrastructure/offensive-windows-boundaries/SKILL.md | 8673 | // ── Registry-based CI status query ────────────────────────── | COMMENT |
| MEDIUM | …s/infrastructure/offensive-windows-boundaries/SKILL.md | 8734 | // ── Active CI policy file enumeration ─────────────────────── | COMMENT |
| MEDIUM | …s/infrastructure/offensive-windows-boundaries/SKILL.md | 8783 | // ── Verify Authenticode signature of a binary ─────────────── | COMMENT |
| MEDIUM | …s/infrastructure/offensive-windows-boundaries/SKILL.md | 8883 | // ── Scan for LOLBAS bypass binaries ───────────────────────── | COMMENT |
| MEDIUM | …s/infrastructure/offensive-windows-boundaries/SKILL.md | 8926 | // ── Check ASR rule enforcement ────────────────────────────── | COMMENT |
| MEDIUM | …s/infrastructure/offensive-windows-boundaries/SKILL.md | 8993 | // ── Test binary execution against WDAC ────────────────────── | COMMENT |
| MEDIUM | …s/infrastructure/offensive-windows-boundaries/SKILL.md | 10460 | // ── Enumerate ALL active ETW tracing sessions ─────────────── | COMMENT |
| MEDIUM | …s/infrastructure/offensive-windows-boundaries/SKILL.md | 10523 | // ── Enumerate registered ETW providers via TDH ────────────── | COMMENT |
| MEDIUM | …s/infrastructure/offensive-windows-boundaries/SKILL.md | 10583 | // ── Check if EtwEventWrite is already patched ─────────────── | COMMENT |
| MEDIUM | …s/infrastructure/offensive-windows-boundaries/SKILL.md | 12492 | // ── IOCTL code decoder ────────────────────────────────────── | COMMENT |
| MEDIUM | …s/infrastructure/offensive-windows-boundaries/SKILL.md | 12523 | // ── Enumerate loaded kernel drivers ───────────────────────── | COMMENT |
| MEDIUM | …s/infrastructure/offensive-windows-boundaries/SKILL.md | 12625 | // ── Probe known BYOVD driver device paths ─────────────────── | COMMENT |
| MEDIUM | …s/infrastructure/offensive-windows-boundaries/SKILL.md | 12695 | // ── Send test IOCTL to a target driver ────────────────────── | COMMENT |
| MEDIUM | …s/infrastructure/offensive-windows-boundaries/SKILL.md | 12786 | // ── Enumerate driver service entries from registry ────────── | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | install.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | .github/workflows/codeql.yml | 1 | # For most projects, this workflow file will not need changing; you simply need | COMMENT |
| LOW | .github/workflows/codeql.yml | 61 | COMMENT | |
| LOW | Skills/crypto/offensive-tls-attacks/SKILL.md | 221 | Applications that fail to properly validate TLS certificates create interception opportunities. Common flaws include dis | COMMENT |
| LOW | Skills/fuzzing/offensive-fuzzing-course/SKILL.md | 1361 | 5. **Overflow**: Writing 512 bytes into 256-byte buffer = 256 bytes overflow | COMMENT |
| LOW | Skills/fuzzing/offensive-fuzzing-course/SKILL.md | 1521 | # | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 321 | // Some programs behave differently: | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 1101 | # IMPORTANT: Full source info requires debug symbols (-g flag at compile time) | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 1201 | COMMENT | |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 1221 | # # Then re-run the crash | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 1361 | ```bash | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 1381 | # RDX 0 | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 1401 | # ► 0 0x4141414141414141 None | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 1421 | # _timer = { | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 1441 | #00:0000│ rsp 0x7ffcc3436d60 ◂— 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 1501 | #rax=00000000000000d7 rbx=000000000052e6b0 rcx=0000000000000000 | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 1521 | #READ_ADDRESS: ffffffffffffffff | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 1581 | # Look for: heap_overflow or HeapFree in the stack | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 1941 | COMMENT | |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 1981 | # Note: p- steps back to previous "step boundary" (breakpoints, calls), | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2021 | 0:000> dx @$cursession.TTD.Memory(0x14fed8, 0x14fee0, "w") | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2041 | COMMENT | |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2141 | ```bash | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2161 | # Call stack shows: | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2181 | # Step 6: Get details on the free and navigate to it | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2201 | COMMENT | |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2261 | # Executable: C:\CrashAnalysisLab\vuln_win_nosym.exe | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2301 | 0:000> k | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2341 | # Look for function prologue | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2361 | COMMENT | |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2401 | COMMENT | |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2601 | 0:000> .scriptrun C:\CrashAnalysisLab\crash_classify.js | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2621 | # Rsp: <error reading> | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2641 | 0:000> .exr -1 | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 2961 | # Now set breakpoint on strcpy and continue - next hit is the vulnerable one | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 3361 | COMMENT | |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 3781 | COMMENT | |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 5021 | **Using checksec (pwntools)**: | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 5041 | # Debuginfo: Yes | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 5101 | pwndbg> run 1 $(python3 -c "print('A'*200)") | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 5121 | # RIP 0x401225 (stack_overflow+79) ◂— ret | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 5201 | # NX: NX unknown - GNU_STACK missing | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 5221 | pwndbg> x/i $rip | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 5661 | # Example output: | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 5801 | COMMENT | |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 7021 | # File → Load file → drcov.target.12345.0000.proc.log | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 7081 | # Example output: | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 7241 | # [+] Hooked libc free at 0x7a0dddeadd30 | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 7501 | # [+] Hooked strcpy at 0x70b804b8b530 | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 7521 | # [!] TAINTED DATA REACHING SINK! | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 7721 | # Go back to find the exact UAF access | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 8161 | # Shows uninitialized (overflow hasn't happened yet) | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 8781 | # Number of clusters: 8 | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 8921 | [*] First free done | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 9401 | # [+] New variant (1): test=1, #0 in strcpy (/home/dev/crash_analysis_lab/vuln_as... | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 9661 | # Create crash input (150 A's triggers stack overflow) | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 10521 | # [+] Analyzing pocs/stack_crash_min.txt with test case 1... | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 10721 | # Run PoC (starts server automatically) | COMMENT |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 10961 | COMMENT | |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 11101 | COMMENT | |
| 73 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | Skills/web/offensive-ssti/SKILL.md | 135 | {{config.__class__.from_envvar.__globals__.__builtins__.__import__('os').popen('id').read()}} | CODE |
| CRITICAL | Skills/web/offensive-ssti/SKILL.md | 138 | {{self._TemplateReference__context.cycler.__init__.__globals__.os.popen('id').read()}} | CODE |
| CRITICAL | Skills/web/offensive-ssti/SKILL.md | 278 | GET /page?name=%24%7Bself.module.cache.util.os.popen('id').read()%7D HTTP/1.1 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | convert_skills.py | 161 | except Exception as e: | CODE |
| MEDIUM | tools/build_manifest.py | 51 | print(f"Error: {SKILLS_DIR} not found", file=sys.stderr) | CODE |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 9213 | except Exception: | CODE |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 9547 | except Exception: | CODE |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 10098 | except Exception as e: | CODE |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 10383 | except Exception: | CODE |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 10617 | except Exception as e: | STRING |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 10771 | except Exception as e: | STRING |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 10882 | except Exception as e: | STRING |
| LOW | Skills/exploit-dev/offensive-crash-analysis/SKILL.md | 11974 | except Exception as e: | STRING |
| LOW | …ills/exploit-dev/offensive-basic-exploitation/SKILL.md | 6877 | except Exception as e: | STRING |
| LOW | …ills/exploit-dev/offensive-basic-exploitation/SKILL.md | 7180 | except Exception as e: | STRING |
| LOW | …ills/exploit-dev/offensive-basic-exploitation/SKILL.md | 9334 | except Exception as e: | STRING |
| LOW | …ills/exploit-dev/offensive-basic-exploitation/SKILL.md | 9352 | except Exception as e: | STRING |
| LOW | Skills/web/offensive-open-redirect/SKILL.md | 347 | except Exception as e: | CODE |
| MEDIUM | Skills/web/offensive-open-redirect/SKILL.md | 348 | print(f"Error testing {test_url}: {e}") | CODE |
| LOW | …post-exploitation/offensive-data-exfiltration/SKILL.md | 76 | except Exception: pass # data is in the query itself | CODE |
| LOW | …post-exploitation/offensive-data-exfiltration/SKILL.md | 89 | except Exception: pass | CODE |
| LOW | …post-exploitation/offensive-data-exfiltration/SKILL.md | 407 | except Exception: pass | CODE |
| LOW | …s/supply-chain/offensive-dependency-confusion/SKILL.md | 306 | except Exception: pass | CODE |
| LOW⚡ | …/infrastructure/offensive-windows-mitigations/SKILL.md | 13108 | except Exception as e: | CODE |
| LOW | …/infrastructure/offensive-windows-mitigations/SKILL.md | 8456 | except Exception as e: | CODE |
| LOW | …/infrastructure/offensive-windows-mitigations/SKILL.md | 9790 | except Exception as e: | CODE |
| LOW | …/infrastructure/offensive-windows-mitigations/SKILL.md | 10091 | except Exception as e: | CODE |
| LOW | …/infrastructure/offensive-windows-mitigations/SKILL.md | 10250 | except Exception as e: | CODE |
| LOW | …/infrastructure/offensive-windows-mitigations/SKILL.md | 10559 | except Exception: | CODE |
| LOW | …/infrastructure/offensive-windows-mitigations/SKILL.md | 10683 | except Exception as e: | CODE |
| LOW | …/infrastructure/offensive-windows-mitigations/SKILL.md | 10763 | except Exception as e: | CODE |
| LOW | …/infrastructure/offensive-windows-mitigations/SKILL.md | 10835 | except Exception as e: | CODE |
| LOW | …/infrastructure/offensive-windows-mitigations/SKILL.md | 12469 | except Exception as e: | CODE |
| LOW | …/infrastructure/offensive-windows-mitigations/SKILL.md | 12508 | except Exception as e: | CODE |
| LOW | …/infrastructure/offensive-windows-mitigations/SKILL.md | 12549 | except Exception as e: | CODE |
| LOW | …/infrastructure/offensive-windows-mitigations/SKILL.md | 13086 | except Exception as e: | CODE |
| LOW | …/infrastructure/offensive-windows-mitigations/SKILL.md | 13145 | except Exception as e: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | README.md | 96 | | [AI Security](#ai-security) | 1 | Prompt injection, jailbreaking, RAG poisoning | | CODE |
| MEDIUM | Skills/ai/offensive-ai-security/SKILL.md | 365 | ### RAG/Vector Systems | COMMENT |
| MEDIUM | Skills/ai/offensive-ai-security/SKILL.md | 496 | ### Egress & Provenance for Agents/RAG | COMMENT |
| MEDIUM | Skills/infrastructure/offensive-initial-access/SKILL.md | 878 | #### RAG (Retrieval Augmented Generation) Database Poisoning | COMMENT |
| MEDIUM | Skills/infrastructure/offensive-initial-access/SKILL.md | 1114 | ##### Long-Term RAG Database Poisoning | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | Skills/fuzzing/offensive-fuzzing-course/SKILL.md | 1604 | uint8_t fake_data[1024]; | CODE |
| LOW⚡ | Skills/fuzzing/offensive-fuzzing-course/SKILL.md | 1605 | memset(fake_data, 'A', sizeof(fake_data)); | CODE |
| LOW⚡ | Skills/fuzzing/offensive-fuzzing-course/SKILL.md | 1607 | process_image(width, height, fake_data); | CODE |
| LOW | Skills/fuzzing/offensive-fuzzing-course/SKILL.md | 1686 | 3. **Overwrite**: The loop writes attacker data (`fake_data`) into the adjacent sensitive object. | CODE |
| LOW | …s/infrastructure/offensive-windows-boundaries/SKILL.md | 10121 | xmlns:user="placeholder" version="1.0"> | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | Skills/recon/offensive-osint/SKILL.md | 348 | - [Reality Defender](https://realitydefender.com/) — AI-generated content detection | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .github/workflows/codeql.yml | 56 | # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | convert_skills.py | 15 | CODE | |
| LOW | convert_skills.py | 167 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | convert_skills.py | 217 | CODE | |
| LOW | tools/build_manifest.py | 8 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …/infrastructure/offensive-windows-mitigations/SKILL.md | 2478 | def exploit_with_known_offset(): | CODE |
| LOW | …/infrastructure/offensive-windows-mitigations/SKILL.md | 9947 | def check_speculation_mitigations(): | CODE |
| LOW | …/infrastructure/offensive-windows-mitigations/SKILL.md | 9983 | def exploitation_decision_tree(vbs_data): | CODE |
| LOW | …s/infrastructure/offensive-windows-boundaries/SKILL.md | 8379 | def enumerate_system_processes(): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | install.sh | 5 | # Usage: | COMMENT |