Guide · Agent skill
How to use the offensive-rce agent skill for RCE testing
Updated · written with AI from the project's own documentation and checked against our catalogue data
The offensive-rce skill gives an AI agent a structured remote code execution (RCE) testing checklist, covering areas such as command injection, template injection, deserialization and file upload. It is written for security professionals on authorised web application penetration tests and bug bounty work, as well as developers and students who want to understand how RCE bugs arise. By the end of this guide you will know what the skill does, how to install it, how to trigger it with natural requests, and what to keep in mind before using it.
Remote Code Execution Testing ChecklistSnailSploit/Claude-Red · MIT Download the skill Quick start
- 1Download the ZIP. Download the offensive-rce skill ZIP from this page.
- 2Unzip into a skills folder. Extract it to ~/.claude/skills/ for personal use, or to a project's .claude/skills/ folder.
- 3Or upload in the Claude apps. Open Settings, go to Capabilities, and upload the skill under Skills.
- 4State your authorised scope. Tell the agent the target you are authorised to test and the context, such as a web form or upload feature.
- 5Ask for a natural request. Describe the task in plain language using a trigger term such as command injection or SSTI RCE.
- 6Follow the checklist. Let the agent guide you through input mapping, test payloads, bypasses and harmless confirmation.
What is an agent skill and what does offensive-rce do?
An agent skill is a folder containing a SKILL.md file with instructions that an AI agent loads when a conversation matches the skill's topic. The offensive-rce skill's SKILL.md holds a remote code execution methodology: where user input enters an application, which payloads to test in each context, and how to confirm a finding safely.
When the skill is active, the agent is told to follow the methodology in order unless you say otherwise, consider each technique against your target, track which checklist items are complete, and suggest next steps based on findings. The skill is a reference of attack techniques; it does not scan anything on its own.
- Maps user-controlled input such as URL parameters, HTTP headers, body parameters and file uploads
- Suggests test payloads for command injection, server-side template injection (SSTI), insecure deserialization, file upload processing and related contexts
- Proposes harmless confirmation steps such as running whoami, ls or a short sleep 5
Install the offensive-rce skill
Download the ZIP for the offensive-rce skill from this page. Unzip it into your personal skills folder at ~/.claude/skills/, or into a project's .claude/skills/ folder if you want the skill only for that project.
If you use the Claude apps instead, open Settings, go to Capabilities, and upload the skill under Skills.
- Personal install: ~/.claude/skills/offensive-rce/
- Project install: .claude/skills/offensive-rce/ inside your project folder
- Claude apps: Settings → Capabilities → Skills
Trigger the skill with natural requests
You do not need a special command. The skill activates when your conversation involves terms such as RCE, remote code execution, command injection, OS injection, SSTI RCE, deserialization RCE, file upload RCE, XXE RCE, dependency confusion or code execution.
Name the target and the context you are testing. The more specific you are about the input location and the technology, the more useful the checklist will be.
- Example: "I'm running an authorised pentest on a Flask app. Walk me through testing the search parameter for SSTI RCE."
- Example: "Check this PHP upload handler for file upload RCE. Here is the code."
- Example: "Help me plan command injection testing for the ping feature on this bug bounty target."
Work through the checklist with the agent
The methodology starts by identifying input locations, then submits test payloads to detect potential vulnerabilities. If requests are blocked, it moves to protection bypass techniques. Finally it confirms a vulnerability using harmless commands.
Ask the agent to keep a list of what has been tested and what remains. This keeps a long engagement organised and makes your notes easier to report.
- Step 1: identify suspicious input locations
- Step 2: submit test payloads to those locations
- Step 3: try bypass techniques if requests are blocked
- Step 4: confirm with harmless commands such as whoami, ls or sleep 5
Step 4 example command: whoamiSafety notes: scripts and network access
The skill's metadata lists no required dependencies, says it does not run scripts, and says it does not use the network. The only file listed is SKILL.md, so the skill itself does not execute code or contact servers.
The payloads it describes are real attack techniques. Use them only against systems you own or have written permission to test. Using them without consent may be illegal.
- Requires: nothing listed
- Runs scripts: no
- Uses network: no
- Only use the payloads on authorised targets
Tips for getting better results
The checklist is broad, so narrowing the scope helps. Tell the agent which framework, language and server you are facing, since the SSTI and deserialization payloads depend on the engine in use.
Remember that the skill has no scanner and needs a security background to interpret results. Treat its suggestions as a structured starting point and verify each finding yourself.
- Name the language and framework (for example Jinja2, Twig, Freemarker or Thymeleaf)
- Ask for harmless confirmation steps before any broader testing
- Use the agent's suggested next steps to decide what to test next
What people use it for
- Planning an authorised web application penetration test around a file upload feature
- Working through command injection checks on a bug bounty program's search or ping function
- Learning how SSTI in Jinja2 or Twig arises so you can fix it in your own code
- Reviewing a deserialization endpoint for unsafe handling of untrusted data
Frequently asked questions
How do I install the offensive-rce skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps you can instead upload it under Settings → Capabilities → Skills.
Is the offensive-rce skill free?
The skill is published under the MIT licence, as listed on this page. Check the licence file in the source repository for the full terms.
What does the offensive-rce skill need to run?
The metadata lists no requirements. It does not run scripts and does not use the network. The skill needs a security background to interpret results.
Does offensive-rce scan my website for vulnerabilities?
No. The skill is a reference checklist of RCE techniques and has no scanner. The agent suggests where to test and what payloads to try, and you carry out and verify the testing yourself.
Can I use this skill on any website?
No. Only test systems you own or have written permission to test. The payloads are real attack techniques, and using them without consent may be illegal.
How is this different from a tool like tplmap or ysoserial?
The skill is a methodology that tells the agent what to check. The SKILL.md mentions tools such as tplmap, ysoserial and marshalsec as references for specific testing, but the skill does not run them.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use offensive-rce if you are a security professional, bug bounty hunter or student doing authorised web application testing and want a structured RCE checklist. Pick something else if you want a plain automated scan or you are not able to test with a solid security background, because the skill gives techniques, not results.
Download the skill