Skills red-team-tools-and-methodology
📦
red-team-tools-and-methodology
v1.1 Content revision r1 High Risk ⚙️ External commands🌐 Network access
Run Authorized Red-Team Workflows
Security teams need repeatable reconnaissance without losing scope discipline. This skill organizes authorized red-team and bug bounty workflows into practical steps.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "red-team-tools-and-methodology" from https://skillstore.io/skills/sickn33-red-team-tools-and-methodology.md and its manifest at https://skillstore.io/api/skills/sickn33-red-team-tools-and-methodology/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "red-team-tools-and-methodology". Plan first-day reconnaissance for an authorized bug bounty program covering example.com.
Expected outcome:
- A scoped plan that starts with passive discovery and acquisition research.
- A separate active phase for live host checks, content discovery, and controlled scanning.
- A validation phase for duplicate removal, false positive review, and report preparation.
Using "red-team-tools-and-methodology". Prioritize testing for an approved web application with APIs, profiles, and file uploads.
Expected outcome:
- A risk-ranked checklist covering file uploads, API authorization, profile fields, integrations, and error pages.
- Suggested evidence to collect for each finding type.
- Notes to avoid out-of-scope testing and production disruption.
Using "red-team-tools-and-methodology". Turn scanner output into a responsible bug bounty report outline.
Expected outcome:
- A concise finding summary, affected assets, reproduction steps, impact statement, and remediation guidance.
- A reminder to remove false positives and avoid unsupported severity claims.
Security Audit
High Riskv5 • 7/7/2026 Open versioned report
This community skill is a dual-use red-team guide with many runnable reconnaissance, fuzzing, and vulnerability scanning workflows. Several Markdown fence detections are false positives, but command blocks and network examples present real misuse risk without strict authorization controls. No prompt injection attempt was found in SKILL.md.
1
Files scanned
311
Lines analyzed
19
Review items
0
False positives ignored
Confirmed security concerns (4)
High
Dual-Use Offensive Security Workflow
The skill explicitly guides reconnaissance, vulnerability discovery, attack-vector identification, and bug bounty hunting against target scopes.
The purpose and deliverables directly state reconnaissance, vulnerability discovery, attack vectors, and bug bounty hunting. The context confirms dual-use offensive intent.
High
Automated Active Probing and Fuzzing
The skill combines content discovery, API fuzzing, HTTP method probing, and Nuclei scanning into repeatable active testing workflows.
The cited sections contain concrete ffuf, Nuclei, and curl workflows that actively probe web and API surfaces. These workflows can affect external systems without strict scope controls.
High
Automated XSS Payload Testing Guidance
The skill provides an XSS hunting pipeline that injects script payloads into URLs and checks responses for reflected payload execution.
The XSS section names automated XSS hunting and includes a script payload replacement workflow. The later filter tests reinforce exploit-oriented payload handling.
Medium
Network reconnaissance
cat params.txt | Gxss -p test
The Gxss command processes parameters for XSS reflection testing as part of an automated XSS hunting section. It supports vulnerability reconnaissance even if the single command may depend on prior URL data.
Capability review items (19)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Ruby/shell backtick execution
```bash
This block automates XSS hunting with ParamSpider, Gxss, Dalfox, qsreplace, and curl using a script payload. It can actively probe applications for exploitable input handling.
High
Ruby/shell backtick execution
```bash
This quick example chains waybackurls, qsreplace, httpx, and Dalfox for XSS hunting. It automates vulnerability probing against collected URLs.
Medium
Ruby/shell backtick execution
```bash
This range contains shell commands for directory setup, ASN lookup, amass, and curl against an external BGP service. The commands support reconnaissance and can contact third-party infrastructure.
Medium
Ruby/shell backtick execution
```bash
This range contains subdomain enumeration commands using amass, subfinder, assetfinder, findomain, dnsgen, and httprobe. These are active or passive reconnaissance workflows that can be misused outside authorized scope.
Medium
Ruby/shell backtick execution
```bash
This range runs httprobe, httpx, and massdns to discover live hosts and resolve domains. The commands perform network reconnaissance against target assets.
Medium
Ruby/shell backtick execution
```bash
This block runs whatweb and nuclei technology checks against host lists. These external tools fingerprint web targets and may generate traffic to third-party systems.
Medium
Ruby/shell backtick execution
```bash
This block runs ffuf, waybackurls, gau, grep, and unfurl for endpoint and content discovery. The ffuf command performs active web fuzzing against a target URL.
Medium
Ruby/shell backtick execution
```bash
This range runs Nuclei scans for templates, CVEs, and web vulnerabilities. Automated vulnerability scanning can affect external systems without strict authorization and rate controls.
Medium
Ruby/shell backtick execution
```bash
This block runs ffuf against API endpoints and loops curl over HTTP methods. It is active API enumeration that can probe hidden routes and access controls.
Medium
Ruby/shell backtick execution
```bash
This range is a Bash recon script that runs subfinder, httpx, waybackurls, and nuclei for a supplied domain. It automates external reconnaissance and vulnerability scanning.
Medium
Ruby/shell backtick execution
```bash
This quick example pipes subfinder results into httpx and tee. It is a runnable reconnaissance pipeline against a target domain.
Medium
Ruby/shell backtick execution
```bash
This example chains amass, httpx, and nuclei for broad recon and vulnerability scanning. It can generate external network traffic and scanner results.
Medium
Unix shell invocation
#!/bin/bash
Line 204 starts an executable Bash script used for automated reconnaissance. The script later invokes network discovery and vulnerability scanning tools.
Low
Hardcoded URL
curl -s "https://bgp.he.net/search?search=targetcompany&commit=Search"
The curl command contacts bgp.he.net for target organization lookup. It is intentional external network access for reconnaissance, though the URL is a public lookup service.
Low
Hardcoded URL
ffuf -ac -v -u https://target.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-dire
The ffuf command targets https://target.com/FUZZ for content discovery. It is a placeholder, but the workflow directs active HTTP fuzzing against a web service.
Low
Hardcoded URL
ffuf -u https://target.com/api/FUZZ -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.t
The ffuf command targets https://target.com/api/FUZZ for API discovery. This is active endpoint fuzzing and can affect third-party services if used without authorization.
Low
Hardcoded URL
ffuf -u https://target.com/api/v1/FUZZ -w api_wordlist.txt
The ffuf command targets a versioned API path at https://target.com/api/v1/FUZZ. It is active network fuzzing against an API surface.
Low
Hardcoded URL
ffuf -u https://target.com/api/v2/FUZZ -w api_wordlist.txt
The ffuf command targets a versioned API path at https://target.com/api/v2/FUZZ. It is active network fuzzing against an API surface.
Low
Hardcoded URL
curl -X $method https://target.com/api/users -v
The curl loop sends multiple HTTP methods to https://target.com/api/users. This probes API method handling and can reach external systems.
Risk Factors
⚙️ External commands (29)
SKILL.md:37-50 SKILL.md:50-56 SKILL.md:56-80 SKILL.md:80-86 SKILL.md:86-95 SKILL.md:95-101 SKILL.md:101-110 SKILL.md:110-116 SKILL.md:116-131 SKILL.md:131-154 SKILL.md:154-168 SKILL.md:168-172 SKILL.md:172-181 SKILL.md:181-187 SKILL.md:187-199 SKILL.md:199-203 SKILL.md:203-231 SKILL.md:231-250 SKILL.md:250-259 SKILL.md:259-263 SKILL.md:263-270 SKILL.md:270-284 SKILL.md:284-286 SKILL.md:286-290 SKILL.md:290-292 SKILL.md:292-296 SKILL.md:296-299 SKILL.md:299-310 SKILL.md:204
🌐 Network access (6)
Detected Patterns
Network reconnaissance
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-red-team-tools-and-methodology/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-red-team-tools-and-methodology?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-red-team-tools-and-methodology?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-red-team-tools-and-methodology/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-red-team-tools-and-methodology.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). red-team-tools-and-methodology security audit report (audit version 5) [Author version 1.1]. Skillstore. https://skillstore.io/skills/sickn33-red-team-tools-and-methodology/audits/5BibTeX citation
@techreport{sickn33-sickn33-red-team-tools-and-methodology-2026,
author = {sickn33},
title = {red-team-tools-and-methodology security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-red-team-tools-and-methodology/audits/5},
note = {Author version 1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "red-team-tools-and-methodology security audit report (audit version 5)"
version: "1.1"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/sickn33-red-team-tools-and-methodology/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-red-team-tools-and-methodology:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance
What You Can Build
Plan Bug Bounty Reconnaissance
Build a scoped workflow for passive discovery, live host checks, content discovery, and finding triage.
Structure Internal Assessments
Create a repeatable checklist for authorized application mapping, API review, vulnerability scanning, and evidence collection.
Teach Web Testing Methodology
Use the tool list and workflow sections to teach responsible reconnaissance and validation practices.
Try These Prompts
Plan Authorized Recon
I have written authorization to test example.com. Build a scoped reconnaissance plan using this skill. Include inputs, tools, outputs, and rate limits.
Create Enumeration Checklist
Create a subdomain and live-host enumeration checklist for an approved bug bounty target. Put passive steps before active steps.
Prioritize Web Testing
Review these allowed assets and technologies. Prioritize content discovery, API checks, and XSS testing by risk and effort.
Design Safe Recon Pipeline
Design an authorized recon pipeline for multiple domains. Include storage layout, tool order, validation steps, rate limits, and report-ready artifacts.
Best Practices
- Confirm written authorization, target scope, rate limits, and prohibited techniques before active testing.
- Run passive discovery before active probing, then document each tool, input, output, and timestamp.
- Manually verify automated findings before disclosure, and remove duplicates or false positives from reports.
Avoid
- Testing domains, IPs, or subsidiaries that are not explicitly in scope.
- Running fuzzing or vulnerability scans without rate limits or production safeguards.
- Submitting scanner output without manual validation, reproduction steps, and impact analysis.
Frequently Asked Questions
Is this skill only for authorized testing?
Yes. Use it only with written authorization, defined scope, and program rules.
Does the skill install tools automatically?
No. It assumes tools such as Amass, Subfinder, httpx, ffuf, Nuclei, and Dalfox are already available.
Can it run active scans?
It provides workflows for active scans, but users must approve commands and apply rate limits.
Does it validate vulnerabilities?
It helps organize validation, but automated findings still require manual review and evidence.
What targets should users provide?
Users should provide only in-scope domains, IP ranges, applications, and program restrictions.
Is it suitable for training?
Yes, when used in labs, internal ranges, or authorized programs with clear safety rules.
Developer Details
Author
sickn33License
MIT
Author version
v1.1
Skillstore revision
r1
Version notice
The author-declared version is not valid SemVer.
Repository
https://github.com/sickn33/antigravity-awesome-skills/tree/main/web-app/public/skills/red-team-toolsRef
9f814fc6a43fd99946f2da5e0df231c65a38bc76
Maintenance freshness
7/18/2026
Usage
6 downloads · 133 views
File structure
📄 SKILL.md