Guide · Agent skill
How to use the Kernel Exploit Mitigations agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The offensive-mitigations skill gives an AI agent a structured checklist of modern operating-system memory-protection features, including KASLR, KPTI, SMEP, SMAP, KDP and MTE. With it active, the agent can explain what each protection does, suggest how to check whether it is enabled, and list the published bypass techniques associated with it. This guide shows you how to install the skill, trigger it with natural requests, and use it safely for authorised security work.
Kernel Exploit Mitigations ReferenceSnailSploit/Claude-Red · MIT Download the skill Quick start
- 1Download the ZIP. Get the offensive-mitigations ZIP from the skill's page on this directory.
- 2Unzip into a skills folder. Extract the folder into ~/.claude/skills/ for personal use, or into .claude/skills/ inside a project.
- 3Or upload in the Claude apps. In the Claude apps, open Settings, go to Capabilities, then Skills, and upload the skill.
- 4Confirm you are authorised. Only proceed against systems you own or have written permission to test.
- 5Ask a natural question. Name the target and protection, for example asking how to confirm SMAP is active on a test host.
- 6Run the detection checks. Use the Linux and Windows checks the skill references, such as grep on /proc/cpuinfo or the Device Guard query, and paste the output back for interpretation.
- 7Follow the suggested next steps. Ask the agent to track which checklist items are complete and what it recommends next.
What an agent skill is and what this one makes the agent do
An agent skill is a folder containing a SKILL.md file with instructions that an AI agent loads when your request matches the skill's topic. This skill contains a single file, SKILL.md, and does not include any scripts.
When it is active, the agent works through the checklist in order unless you say otherwise, applies each technique to your target or context, tracks which items are complete, and suggests next steps based on what it finds. The focus is offensive exploitation planning rather than defence.
- Explain what each kernel protection does
- Describe how to check whether a protection is enabled on a system
- List published bypass techniques that apply to each protection
- Suggest next steps based on findings
Install the offensive-mitigations skill
Download the ZIP file from the skill's page on this directory. Then choose one of the following locations, depending on whether you want the skill for all your projects or just one.
The skill folder is named offensive-mitigations. Unzip the download so that the folder and its SKILL.md file sit inside the skills directory. For a personal install, use ~/.claude/skills/. For a single project, use the .claude/skills/ folder inside that project.
If you use the Claude apps instead, open Settings, go to Capabilities, then Skills, and upload the skill there.
- Personal install: ~/.claude/skills/
- Project install: .claude/skills/ inside your project folder
- Claude apps: Settings → Capabilities → Skills, then upload
Trigger the skill with natural requests
You do not need a special command. The skill is meant to load when your conversation involves its trigger topics. The source lists these phrases: mitigations, ASLR bypass, DEP bypass, NX bypass, RELRO, stack canary bypass, CFI bypass, sandbox bypass, seccomp bypass, mitigation detection and checksec.
Name the target and the protection you care about. Requests that include the authorisation context tend to get the most relevant answer, because the agent is asked to consider applicability to your specific target.
- Which kernel mitigations are likely enabled on this Linux test machine, and what would I check next?
- Explain how SMEP works and which published techniques apply to it on a system I am authorised to test.
- Run me through the mitigation checklist for this target and track what is still unchecked.
- Mitigation detection: how do I confirm SMAP is active on this host?
Check whether a protection is enabled
The skill's practitioner notes list concrete places to look. On Linux, the source points to CPU flags and kernel status files. On Windows, it points to PowerShell and the Device Guard and Core isolation settings. Run these only on systems you own or are authorised to test.
The commands below are copied from the source. The agent can help you interpret the output.
- KPTI status on Linux: files under /sys/devices/system/cpu/vulnerabilities/ and dmesg | grep -i kpti
- SMAP and SMEP flags on Linux: grep smap /proc/cpuinfo and grep smep /proc/cpuinfo
- SMEP effective state on Linux: dmesg | grep -i smep
- Device Guard status on Windows: Get-CimInstance -ClassName Win32_DeviceGuard
grep smap /proc/cpuinfo
grep smep /proc/cpuinfo
dmesg | grep -i smep
dmesg | grep -i kptiRead the protections and their known bypass categories
The skill covers KASLR, KPTI, SMAP, SMEP, KDP, Memory Integrity (Core Isolation), RODATA, Hardened Usercopy and MTE. For each, it lists bypass categories at a high level, such as information leaks for KASLR, side channels for KPTI, and data-only attacks for SMEP.
The source describes MTE as a hardware-assisted feature using 4-bit tags on 16-byte allocations, with a fault on mismatch. It also notes that by default MTE protects userspace, and that kernel allocations do not use MTE. Treat these as starting points to verify, because the source is a checklist summary.
- KASLR: randomises kernel load addresses; bypass categories include information leaks and side channels
- KPTI: separates user and kernel page tables; relevant CPU vulnerability classes are listed
- SMEP and SMAP: hardware protections against executing or accessing user-space memory from the kernel
- MTE: tag-based memory-safety checking on ARM
Use the agent's next-step suggestions responsibly
After the agent reports which protections are enabled, ask it to suggest what to do next. Keep the work scoped to the target you have permission to test, and record which checklist items you have completed so the assessment is repeatable.
The skill is not a configuration guide. If your goal is to harden your own machine, you will get more from vendor documentation and the platform's own settings.
- Confirm written authorisation covers the exact system before running any check
- Ask the agent to note which items are verified on your system and which are only stated in the checklist
- Verify claims against primary sources before relying on them
What people use it for
- Studying how kernel memory protections such as KASLR, SMEP and SMAP work and where they came from
- Planning a penetration test by checking which kernel hardening features a system you are authorised to test has enabled
- Teaching students the history and trade-offs of memory-safety features like MTE
- Building a repeatable checklist of mitigation status items for a security assessment report
Frequently asked questions
Is the offensive-mitigations skill free?
The source lists the licence as MIT, which is a permissive open-source licence. The source does not mention pricing, so check the skill's page on this directory for any other terms.
What do I need to run this skill?
The source lists no required tools, does not run scripts, and does not use the network. The skill is a single SKILL.md file that an agent loads as instructions. You do need an agent environment that supports skills.
Where do I put the skill folder?
For a personal install, unzip it into ~/.claude/skills/. For a single project, use the .claude/skills/ folder inside that project. In the Claude apps, you can upload it under Settings, then Capabilities, then Skills.
What is the difference between this skill and checksec?
The source lists checksec as a trigger phrase, but the skill's content centres on kernel-level protections such as KASLR, KPTI, SMEP, SMAP, KDP and MTE. It does not describe itself as a replacement for checksec or any other tool, so compare the two based on what you need.
Why does the skill not give me hardening advice?
The content focuses on bypass techniques rather than configuration guidance, so it is not suited to people who only want to harden their own machine. For that, use vendor documentation and your operating system's security settings.
Is the information verified?
No. The source describes the file as a checklist summary with no tested code, and some claims are stated without citations. Verify important details against primary sources before relying on them.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits security researchers, authorised penetration testers and students who want a structured checklist of kernel memory protections and their published bypass categories. It is a poor fit for anyone who only wants to harden their own system, anyone without permission to test the target, or anyone who needs tested, fully cited guidance.
Download the skill