How to use the Advanced Red Team Operations agent skill

What the skill makes the agent do

Once installed, the agent follows a red team methodology covering the whole lifecycle of a simulated attack. The skill's own overview frames red team work as testing detection and response by pursuing specific objectives, under rules of engagement that define what is in bounds. Every action is meant to be deliberate, documented and reversible.

The guidance covers engagement scoping and rules of engagement negotiation, tiered command-and-control infrastructure design, operator logging and deconfliction, evasion techniques, chain-of-custody handling for collected data, and reporting with MITRE ATT&CK mappings and purple team debriefs. It also covers assumed-breach, external-to-internal, insider threat and hybrid physical-cyber scenarios.

• It shapes how the agent reasons and writes about engagements.
• It does not add new tools to your machine.
• Most of what you see is guidance and example commands, not an automated attack runner.

Install the skill from the ZIP

Download the ZIP for offensive-advanced-redteam from our page. The skill is a folder whose main file is SKILL.md. Unzip it so that the skill folder sits inside your personal skills directory, ~/.claude/skills/, or inside a project's .claude/skills/ folder if you want it available only to that project.

If you use the Claude apps instead, open Settings, go to Capabilities, and upload the skill under Skills. Either route works; pick the one that matches how you use the agent.

• Personal install: place the skill folder in ~/.claude/skills/.
• Project install: place the skill folder in the project's .claude/skills/ folder.
• Claude apps: Settings, then Capabilities, then Skills, then upload.

Trigger it with natural requests

You do not need a special command. The skill's description lists its topics, including engagement scoping, rules of engagement, C2 infrastructure design, OPSEC, data chain of custody, ATT&CK-mapped reporting and purple team debriefs. Asking the agent about those things in plain language is the normal way to bring the methodology into the conversation.

Be specific about your role and your authorization. The skill is written for operators planning or executing engagements, so say what kind of engagement you are running and what the client has signed off on.

• Ask for help drafting rules of engagement sections such as the authorization window, notification thresholds and emergency contacts.
• Ask for a deconfliction process design, such as a trusted agent model or a deconfliction log format.
• Ask for a structured report draft with ATT&CK mappings for a set of observed techniques.
• Ask for a purple team debrief plan that checks which detections fired and where the gaps are.

Example requests and what to expect

A useful request names the scenario, the objective and the constraints. For example: draft a rules of engagement outline for an assumed-breach engagement against a financial firm, with a 24/7 emergency contact and a list of out-of-scope systems. The agent should respond with a structured outline drawn from the skill's ROE guidance, which lists dates and hours, authorized techniques, notification thresholds, emergency contacts and a written legal authorization reference.

A second example: outline a purple team debrief for a hybrid engagement where the team used phishing and then moved laterally. Expect the agent to organise the debrief around ATT&CK techniques and detection gaps rather than a list of findings alone. Review every output yourself before using it; the skill is guidance, and it is not tested against your environment.

What you need and safety notes

The skill lists no required tools, runs no scripts and makes no network calls. Its only file is SKILL.md. Because it contains no executable code, installing it does not change your machine beyond adding the text file.

The content describes evasion and attribution-avoidance techniques. These are illegal to use against systems without the owner's consent. Do not use anything from the skill without written authorization for the specific target, and treat the guidance as an aid to authorized work, not permission to act. The skill is also not a learning course and not a scanning or exploitation toolchain.

• Requirements: none listed.
• Runs scripts: no.
• Uses network: no.
• Licence: MIT.
• Written authorization for the exact target is required before any technique is used.

Tips for getting useful output

Give the agent your engagement type, your constraints and your reporting audience. The skill's structure works best when the agent knows whether the output is for a client executive, a technical defender or a purple team session.

Check the agent's ATT&CK technique IDs against the official framework before they go into a report. Keep your own deconfliction and custody records; the skill recommends logging every action, but the record you keep is the one that matters in a dispute.

• Name the engagement scenario in the first message.
• State the authorization and scope before asking for techniques.
• Verify all ATT&CK IDs yourself.
• Ask for the output in the format your client expects.