Guide · Agent skill
How to use the Specialized Attack Playbooks agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The specialized-attack-playbooks skill is a single written file, SKILL.md, that gives an AI agent detailed notes on a set of named products and setups, such as a GoEdge CDN admin API, ARP spoofing on a shared network, and an OCS chat system with MinIO storage. It is written mainly in Chinese with some English. This guide explains what the skill does, how to install it, how to ask for it in plain language, and the safety conditions you must meet before using it.
Specialized Attack PlaybooksAIPentest/CyberStrikeAI · Apache-2.0 Download the skill Quick start
- 1Confirm authorisation. Get written permission that names the exact systems in scope. Do not start until it is in place.
- 2Download the ZIP. Download the specialized-attack-playbooks ZIP from this page.
- 3Install the skill. Unzip it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder, or upload the ZIP under Settings, Capabilities, Skills.
- 4Prepare a lab. Set up Python 3 and the listed Linux tools in an isolated lab or test environment you control.
- 5Make a scoped request. Ask for one topic in plain language and state the authorised scope and the result you need.
- 6Review each step. Check every suggested action against your engagement scope before running it, and read any script first.
- 7Record and report. Log what you tested and what you found, and share it with your security team.
What an agent skill is and what this one does
An agent skill is a folder containing a SKILL.md file. When the skill is installed, the agent reads its description and loads the full notes only when a request matches the topic. Think of it as reference material the agent can consult, not a separate program.
This skill is a bundle of attack notes for penetration-testing scenarios. Its description covers fingerprinting tips, API call sequences, bypass ideas and cleanup steps for topics such as TLS private key exposure in a CDN admin API, ARP man-in-the-middle attacks, S3 credential chains, BT Panel, UniApp app reverse engineering, and MinIO object storage. Its stated purpose is to make the agent a more capable assistant for authorised testers working on these scenarios.
Check you are allowed to use it before you install
Use this skill only on systems you have explicit written permission to test, or in a lab you control. The content describes unauthorised access, credential theft and traffic interception. Using those techniques against systems you do not own or have not been authorised to test is illegal in most places.
If you are a defender looking for remediation advice, this skill is the wrong tool. Its focus is on exploitation, and it mentions fixes only in passing.
- Written authorisation covering the exact systems in scope
- A lab or test environment you control for practice
- A security team review, because the file includes references to fraud, phishing and grey-market operations
Install the skill from the ZIP
Download the ZIP for specialized-attack-playbooks from this page and unzip it. The skill folder should contain SKILL.md. For a personal install, place the folder inside ~/.claude/skills/. For a single project, place it inside that project's .claude/skills/ folder.
In the Claude apps, you can instead upload the ZIP under Settings, then Capabilities, then Skills. Start a new conversation afterwards so the agent picks up the skill.
- Personal install: ~/.claude/skills/specialized-attack-playbooks/
- Project install: <your-project>/.claude/skills/specialized-attack-playbooks/
- Claude apps: Settings → Capabilities → Skills → upload the ZIP
~/.claude/skills/specialized-attack-playbooks/SKILL.mdTrigger the skill with a natural request
You do not need a special command. The skill loads when your request matches its description, which names GoEdge, CDN, ARP MITM, BT Panel, OCS and MinIO. Say what the target is, what you are authorised to do, and what result you want, in plain language.
State the authorisation in the request. The agent should work within the scope you give it, so name the lab or the systems in scope and say what is excluded.
- Using the specialized attack playbooks, help me plan an authorised assessment of the BT Panel on our lab server, within the scope in my engagement letter.
- Check whether the MinIO deployment in our test environment matches the notes for this playbook, and list what to verify.
- Summarise the attack-surface notes for OCS chat systems so I can build a test checklist for our client's authorised engagement.
What a good session looks like
Ask for one topic at a time and for the reasoning behind each step, not only the commands. Keep notes of what you tested, with timestamps and the authorisation reference, so the results can be reported and reviewed.
Because the source file is mostly in Chinese, ask the agent to summarise sections in English if you need to check them with your team.
- Start with a scoped question about one system
- Ask for verification steps alongside any attack step
- Record every action against the authorised scope
- Ask the agent to flag steps that go beyond your permission
What you need to run it
The skill itself is text. Its helper script, scripts/chengzi_decrypt.py, needs Python 3. The ARP section refers to Linux tools such as arpspoof, tcpdump and dsniff. You also need access to the target systems or a lab environment. The skill declares that it runs scripts and uses the network.
Only run the helper script and any tools on a machine you control, inside the authorised scope, and after reading the script yourself.
- Python 3 for scripts/chengzi_decrypt.py
- Linux tools named in the ARP section: arpspoof, tcpdump, dsniff
- Authorised access to targets or a lab environment
- Network access, since the skill declares it uses the network
What people use it for
- Planning an authorised penetration test of a web control panel by reviewing the fingerprinting and access-control notes.
- Building a test checklist for a mobile app client engagement, covering how to review bundled front-end files for exposed configuration.
- Studying how known weaknesses in CDN admin APIs and object storage work so a red team can test whether a client's own setup is protected.
- Reviewing an authorised lab environment to confirm whether it matches the attack-surface notes in the skill.
Frequently asked questions
Is the specialized-attack-playbooks skill free?
The source material for this page does not state a price or licence terms beyond the Apache-2.0 licence listed for the repository. Read the licence in the source repository before you reuse or redistribute the file.
How do I install specialized-attack-playbooks in Claude?
Download the ZIP, then either unzip the folder into ~/.claude/skills/ for personal use, into a project's .claude/skills/ folder, or upload the ZIP in the Claude apps under Settings, Capabilities, Skills. The folder should contain SKILL.md.
What does the skill require to run?
The helper script scripts/chengzi_decrypt.py needs Python 3. The ARP section refers to Linux tools such as arpspoof, tcpdump and dsniff. You also need authorised access to targets or a lab environment, and the skill declares that it runs scripts and uses the network.
Is this skill safe to run on my own network?
It describes attacks on real systems, so only use it on systems you own or have written permission to test. Review the helper script before running it, and run it in a lab first. It declares that it runs scripts and uses the network.
Is there a free alternative to this skill?
This page does not list alternatives, and I have not verified any. For general penetration-testing support, look at tools and skills that your security team already trusts and that come with clear documentation and licences.
Does this skill help with defending against these attacks?
Not really. The source focuses on exploitation steps and mentions fixes only in passing, such as noting that some issues were patched. For remediation guidance, use vendor advisories and your own security team's hardening standards.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits authorised penetration testers and red teams who already have written permission for the named systems, and security researchers who need to understand these weaknesses. It is a poor fit for defenders, for anyone without authorisation, and for anyone wanting a general-purpose or safe skill, so have a security team review it before use.
Download the skill