Guide · Agent skill
How to use the Offensive Shellcode Reference agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The offensive-shellcode skill is a reference document that gives an AI agent detailed guidance on developing shellcode, the small raw machine code used in offensive security work. This guide explains what the skill changes about the agent's behaviour, how to install it from the ZIP on this page, how to ask for its help, and the safety limits that apply. It is written for readers who have not used agent skills before, but the skill's content assumes assembly and Windows internals knowledge.
Offensive Shellcode ReferenceSnailSploit/Claude-Red · MIT Download the skill Quick start
- 1Download the ZIP. Download the offensive-shellcode ZIP from this page.
- 2Unzip into a skills folder. Extract the offensive-shellcode folder into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ directory.
- 3Or upload in the Claude apps. Go to Settings → Capabilities → Skills and upload the skill if you use the Claude apps.
- 4Confirm authorisation. Make sure you have authorisation for the engagement or research before asking for any technique.
- 5Ask a specific request. Name the platform (x86 or x64, Windows, Linux or macOS) and the concept you want explained.
- 6Review the output critically. Check any code or technique against the source material and your own testing in a controlled environment.
What is an agent skill and what does this one do?
An agent skill is a folder containing a SKILL.md file with instructions that an AI agent loads when a request matches the skill's description. This skill's SKILL.md is a development reference for shellcode for offensive security engagements.
Once installed, the agent can explain position-independent code (PIC), Windows API resolution by walking the PEB, shellcode loader design, and conversion of PE files to shellcode using tools named in the skill such as Donut and sRDI. It also covers null byte avoidance, API hashing, encoder/decoder patterns, and staged versus stageless payloads.
- Walks through a shellcode development workflow: define the target, write position-independent assembly, extract and test the binary, avoid null bytes, encode, then package with a loader.
- Explains the allocate-write-execute pattern and why the skill prefers PAGE_READWRITE followed by PAGE_EXECUTE_READ over PAGE_EXECUTE_READWRITE.
- Lists execution techniques and the tools and resources it names, such as FlavorTown, ThreadlessInject and DripLoader.
Install the offensive-shellcode skill
Download the ZIP from this page. Unzip it so that the offensive-shellcode folder, containing SKILL.md, sits in your personal skills directory ~/.claude/skills/, or in a project's .claude/skills/ directory if you want the skill only for that project.
Alternatively, upload the skill in the Claude apps under Settings → Capabilities → Skills.
- Personal install: place the folder in ~/.claude/skills/.
- Project install: place the folder in the project's .claude/skills/ directory.
- Claude apps: Settings → Capabilities → Skills, then upload.
How do you trigger the skill with natural requests?
You do not need a special command. The agent uses the skill when your request matches its description, which covers writing custom x86/x64 shellcode, implementing PIC, building shellcode loaders, evading AV/EDR detection, or converting PE files to shellcode.
State the platform and the authorised context in your request. The skill's workflow starts by defining the concept and target platform, so naming x86 or x64 and Windows, Linux or macOS gives the agent what it needs.
- Explain how position-independent code finds its own address using call/pop on Windows.
- Summarise the PEB walk steps for locating kernel32 on x64.
- Compare CreateRemoteThread, NtSetContextThread and APC injection in terms of how loud they are.
- Explain how Donut and sRDI differ when converting a DLL to shellcode.
What can you ask it to do?
The skill is most useful when you want an explanation or a design review drawn from its reference material. Its sections cover concepts, Windows API resolution, loaders, PE conversion, storage and hiding, evasion, cross-platform notes, and a DripLoader technique summary.
The skill also includes a full x64 reverse shell example written in Python with Keystone. Treat that as material the skill describes, not as a tested tool.
- Ask for the difference between staged and stageless payloads.
- Ask which storage location the reference rates as higher or lower risk.
- Ask what the reference says about Linux 6.9+ eBPF arena or Windows on ARM64 syscalls.
What does the skill need and what are the safety notes?
The listing states no required dependencies, that the skill runs no scripts, and that it uses no network access. Its only file is SKILL.md.
The content is directly aimed at evading security controls. Use it only for authorised engagements, research on how EDR and AV detect injection, or study of Windows internals. Do not use it against systems you are not permitted to test. The skill points to external projects and tools; those are separate downloads with their own code, and this skill does not install them.
- No scripts run and no network calls are made by the skill itself.
- The skill is for defenders only in the narrow sense that it is not written to help them detect these techniques.
- Confirm written authorisation before applying any technique to a target.
What people use it for
- A red team operator reviewing how a PEB walk locates kernel32 before drafting an authorised test plan.
- A security student asking the agent to explain PE structure and why Certificate Table storage keeps a signed PE signature intact.
- A researcher comparing how remote injection steps such as OpenProcess, Allocate, Write and Execute are scrutinised by EDR.
- A developer learning why loaders are often written in Zig, Rust, Nim or Go and what the skill says about runtime signatures.
Frequently asked questions
How do I install the offensive-shellcode agent skill?
Download the ZIP from this page and unzip the offensive-shellcode folder into ~/.claude/skills/ or a project's .claude/skills/ directory. In the Claude apps you can instead upload it under Settings → Capabilities → Skills.
Is the offensive-shellcode skill free?
The skill is listed under the MIT licence. Check the licence file in the source repository for the full terms before reusing it.
What does the offensive-shellcode skill require?
The listing states no requirements, runs no scripts, and uses no network access. The skill is a single SKILL.md file.
Can beginners use this skill to learn shellcode?
The material assumes assembly and Windows internals knowledge. A beginner wanting general coding help should choose a learning resource that starts from those basics.
What are alternatives to this skill?
The skill itself names external projects such as Donut, sRDI, Pe2shc, ScareCrow, and FlavorTown for related tasks. Those are separate tools with their own documentation and are not bundled with this skill.
Does this skill help defenders detect shellcode?
No. The listing says the skill focuses on evasion rather than detection, so defenders looking for detection guidance should use other resources.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are a red team operator, penetration tester or security researcher with authorisation and you want a detailed reference on shellcode development and evasion concepts. Pick something else if you lack authorisation for the systems involved, want general coding help, or need guidance on detecting these techniques.
Download the skill