Skills red-team-tools
📦
red-team-tools
v1.1 Content revision r1 High Risk ⚙️ External commands🌐 Network access
Run Authorized Red Team Recon Workflows
Security testers need repeatable recon workflows across many tools. This skill organizes authorized enumeration, vulnerability triage, and reporting steps for Claude, Codex, and Claude Code.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "red-team-tools" from https://skillstore.io/skills/sickn33-red-team-tools.md and its manifest at https://skillstore.io/api/skills/sickn33-red-team-tools/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "red-team-tools". Plan passive recon for an authorized bug bounty domain.
Expected outcome:
- Scope summary with approved domains and exclusions.
- Passive data sources to query before active probing.
- Output files for subdomains, live hosts, technologies, and notes.
- Manual review checklist for high-value assets.
Using "red-team-tools". Prioritize testing after recon finds many live hosts.
Expected outcome:
- Group hosts by technology, status code, and exposed application type.
- Prioritize login portals, APIs, uploads, admin paths, and integrations.
- Flag scanner results that need manual reproduction before reporting.
Using "red-team-tools". Prepare a vulnerability report from validated findings.
Expected outcome:
- Finding title, affected asset, impact, reproduction summary, and evidence list.
- Severity rationale tied to business impact and exploitability.
- Clear remediation steps for engineering teams.
Security Audit
High Riskv5 • 7/7/2026 Open versioned report
The static backtick alerts are partly Markdown fence false positives, but several fenced blocks contain real external reconnaissance and scanning commands. The skill is a dual-use red-team guide with active network probing, API fuzzing, Nuclei scanning, and XSS testing guidance, so publication should require strong authorization warnings and safeguards.
1
Files scanned
316
Lines analyzed
19
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Dual-use Offensive Reconnaissance Workflow
The skill directs users through subdomain enumeration, live host discovery, content discovery, API fuzzing, and vulnerability scanning. This is appropriate only for authorized targets and can enable misuse against third parties.
The purpose statement and multiple workflows explicitly focus on reconnaissance, fuzzing, and vulnerability discovery. The scope constraints reduce but do not remove the dual-use risk.
Medium
Automated XSS Testing Guidance
The skill provides automated XSS hunting workflows and payload examples, including reflected payload checks. These techniques can be useful in bug bounty work but are unsafe outside authorization.
The XSS section names automated hunting and includes payload testing pipelines. The content is clearly vulnerability testing guidance, not general education only.
Capability review items (19)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Ruby/shell backtick execution
```bash
The block automates XSS hunting with ParamSpider, Gxss, Dalfox, and reflected payload checks. These commands perform vulnerability probing beyond passive analysis.
High
Ruby/shell backtick execution
```bash
The block instructs Nuclei vulnerability and CVE scanning against hosts. Automated vulnerability scanning can affect third-party systems and requires authorization.
High
Ruby/shell backtick execution
```bash
The block performs API endpoint fuzzing and probes HTTP methods including PUT, DELETE, and PATCH. These requests can be disruptive or unsafe outside explicit authorization.
High
Ruby/shell backtick execution
```bash
The Bash script accepts a domain and chains subfinder, httpx, waybackurls, and nuclei. It operationalizes automated reconnaissance and scanning against a supplied target.
High
Ruby/shell backtick execution
```bash
The example builds an XSS hunting pipeline with waybackurls, qsreplace, httpx, and Dalfox. It automates vulnerability testing against collected URLs.
High
Ruby/shell backtick execution
```bash
The example chains amass, httpx, and Nuclei for broad reconnaissance and vulnerability scanning. Running it can generate significant traffic against targets.
High
Unix shell invocation
#!/bin/bash
The shebang starts a Bash recon script that later runs subfinder, httpx, waybackurls, and Nuclei. This confirms executable external command guidance.
High
Hardcoded URL
curl -X $method https://target.com/api/users -v
The curl loop sends multiple HTTP methods, including mutating verbs, to an API endpoint. Even without a body, this can be unsafe on real systems.
Medium
Ruby/shell backtick execution
```bash
The block gives Bash commands for project setup, amass, and curl-based ASN lookup. It is documentation, but following it runs external reconnaissance commands and network requests.
Medium
Ruby/shell backtick execution
```bash
The block gives subdomain enumeration commands using amass, subfinder, assetfinder, findomain, dnsgen, and httprobe. These commands can enumerate third-party assets when executed.
Medium
Ruby/shell backtick execution
```bash
The block gives live host discovery commands using httprobe, httpx, and massdns. These are external reconnaissance commands that contact or resolve target infrastructure.
Medium
Ruby/shell backtick execution
```bash
The block instructs technology fingerprinting with WhatWeb and Nuclei templates. This is legitimate for authorized testing but can profile external hosts if misused.
Medium
Ruby/shell backtick execution
```bash
The block includes ffuf directory brute forcing plus URL collection and parameter discovery. These workflows can generate active traffic against a target application.
Medium
Ruby/shell backtick execution
```bash
The example pipes subfinder output into httpx for live target probing. It is a concise external reconnaissance command that contacts discovered hosts.
Medium
Hardcoded URL
ffuf -ac -v -u https://target.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-dire
The ffuf command performs directory brute forcing against an HTTPS target. This can create high-volume traffic and must be limited to authorized systems.
Medium
Hardcoded URL
ffuf -u https://target.com/api/FUZZ -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.t
The ffuf command fuzzes API endpoints on an HTTPS target. Active endpoint discovery can be noisy and requires permission from the target owner.
Medium
Hardcoded URL
ffuf -u https://target.com/api/v1/FUZZ -w api_wordlist.txt
The ffuf command fuzzes versioned API paths on an HTTPS target. This is active network probing and can burden or alert production services.
Medium
Hardcoded URL
ffuf -u https://target.com/api/v2/FUZZ -w api_wordlist.txt
The ffuf command fuzzes another versioned API path on an HTTPS target. This is active network probing and must stay within authorized scope.
Low
Hardcoded URL
curl -s "https://bgp.he.net/search?search=targetcompany&commit=Search"
The curl command contacts bgp.he.net and includes a target organization search term. This is low-risk OSINT, but it still sends target research to a third-party service.
Risk Factors
⚙️ External commands (29)
SKILL.md:39-52 SKILL.md:52-58 SKILL.md:58-82 SKILL.md:82-88 SKILL.md:88-97 SKILL.md:97-103 SKILL.md:103-112 SKILL.md:112-118 SKILL.md:118-133 SKILL.md:133-156 SKILL.md:156-170 SKILL.md:170-174 SKILL.md:174-183 SKILL.md:183-189 SKILL.md:189-201 SKILL.md:201-205 SKILL.md:205-233 SKILL.md:233-252 SKILL.md:252-261 SKILL.md:261-265 SKILL.md:265-272 SKILL.md:272-286 SKILL.md:286-288 SKILL.md:288-292 SKILL.md:292-294 SKILL.md:294-298 SKILL.md:298-301 SKILL.md:301-312 SKILL.md:206
🌐 Network access (6)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-red-team-tools/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-red-team-tools?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-red-team-tools?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-red-team-tools/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-red-team-tools.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). red-team-tools security audit report (audit version 5) [Author version 1.1]. Skillstore. https://skillstore.io/skills/sickn33-red-team-tools/audits/5BibTeX citation
@techreport{sickn33-sickn33-red-team-tools-2026,
author = {sickn33},
title = {red-team-tools security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-red-team-tools/audits/5},
note = {Author version 1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "red-team-tools security audit report (audit version 5)"
version: "1.1"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/sickn33-red-team-tools/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-red-team-tools:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance
What You Can Build
Plan Bug Bounty Recon
Build a scoped recon checklist for approved domains and collect repeatable evidence.
Map External Attack Surface
Inventory live hosts, technologies, and exposed paths for owned company assets.
Triage Web Findings
Use scanner output and manual checks to prioritize likely vulnerabilities for validation.
Try These Prompts
Create a Passive Recon Plan
Create a passive reconnaissance plan for my authorized target. Separate required inputs, tools, outputs, and manual review steps.
Organize Subdomain Enumeration
Build a scoped subdomain enumeration workflow for these approved domains. Include deduplication, live host checks, and evidence storage.
Prioritize Web Testing Areas
Review these recon results and prioritize web testing areas. Focus on APIs, uploads, integrations, authentication, and unusual attack surfaces.
Design a Safe Active Scan
Design an active scan plan for approved assets. Include rate limits, stop conditions, validation steps, and reporting evidence requirements.
Best Practices
- Confirm written authorization and scope before any active probing or fuzzing.
- Start with passive collection, then move to rate-limited active checks.
- Manually validate scanner output before reporting a vulnerability.
Avoid
- Scanning domains, hosts, or endpoints outside the approved scope.
- Running brute force or fuzzing workflows on production without permission.
- Submitting automated scanner output without reproduction or impact analysis.
Frequently Asked Questions
Is this skill only for authorized testing?
Yes. Use it only for assets where you have written permission and clear scope.
Does the skill install security tools?
No. It describes workflows that require separately installed tools and dependencies.
Can it run active scans?
It can guide active scan plans, but execution needs user approval, tools, and authorization.
Does it replace manual testing?
No. It helps organize automation, but findings still need manual validation.
Which tools does it reference?
It references Amass, Subfinder, httpx, httprobe, ffuf, Nuclei, Dalfox, waybackurls, and related tools.
How should results be reported?
Report only validated findings with affected assets, impact, reproduction steps, and remediation guidance.