Guide · Agent skill
How to use the Full-Scope Red Team Engagement agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains what the conducting-full-scope-red-team-engagement skill does, how to install it for an AI agent, and how to ask for its help with a red team or purple team exercise. It is written for security professionals and consultants who are planning an authorized engagement. After reading it you will know how to install the skill, how to trigger it with a natural request, and what it will and will not do for you.
Full-Scope Red Team Engagementmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Check your prerequisites. Confirm you have Python 3 and signed Rules of Engagement covering the target. Without written authorization, stop here.
- 2Install attackcti. Run pip install attackcti so scripts/agent.py can load. The script exits with an install message if the library is missing.
- 3Install the skill. Download the ZIP from the page, then unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills in the Claude apps.
- 4Make a natural request. Describe the engagement in plain language, including the threat actor, objectives and scope. Mention purple teaming if that is the goal.
- 5Plan with the six-phase workflow. Work through threat modeling, reconnaissance, initial access, post-exploitation, objectives and reporting, using the ATT&CK mapping table in Phase 1.
- 6Track results and write the report. Use the helpers to log actions, detection gaps and metrics, then fill the report template with findings, the ATT&CK mapping and recommendations.
What the skill makes the agent do
The skill teaches an AI agent to plan and document a full red team exercise. In that exercise an authorized team simulates a realistic attacker moving from reconnaissance through initial access, privilege escalation, lateral movement and data theft, to test whether defenders notice and respond.
The agent gets a six-phase workflow mapped to the MITRE ATT&CK framework: planning and threat modeling, reconnaissance, initial access, post-exploitation and lateral movement, objective achievement, and reporting and debrief. It also gets a report template, reference material on ATT&CK techniques and standards, and Python helpers that track actions, detection gaps and metrics.
- Maps the engagement to ATT&CK tactics and techniques based on a threat profile
- Lists the metrics to track, such as mean time to detect, mean time to respond and TTP coverage
- Provides a report structure with an executive summary, attack narrative, ATT&CK mapping, findings and detection gap analysis
Check the requirements before you install
The skill is a planning and reporting aid. It is not a tool that attacks anything by itself. You still need the items the skill lists as prerequisites before any work starts.
The source lists these requirements: Python 3; the attackcti Python library, which scripts/agent.py needs and which it reports as missing with an install message if it is not present; and written Rules of Engagement with legal authorization. Offensive tools named in the workflow, such as amass, theHarvester, nmap, msfvenom, GoPhish, Rubeus and secretsdump.py, are referenced but not supplied. You only need them if you run those commands yourself.
- Python 3
- attackcti (install with pip install attackcti, as listed in the skill's API reference)
- Signed Rules of Engagement and a defined scope, escalation contacts and emergency stop procedure
- Legal review of compliance with the Computer Fraud and Abuse Act and local law
Install the skill with a ZIP download or the Claude apps
Download the ZIP of the skill from the page where you found this guide. Then choose one of these two routes.
For Claude Code, unzip the download into your personal skills folder ~/.claude/skills/, or into a project's .claude/skills/ folder if you want the skill available only in that project. For the Claude apps, upload the ZIP under Settings → Capabilities → Skills.
- Personal install: unzip into ~/.claude/skills/
- Project install: unzip into the project's .claude/skills/ folder
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
Trigger the skill with a natural request
You do not need a special command. Describe the work in plain language that matches the skill's purpose: scoping or running a full-scope, objective-based engagement, or purple-teaming against a specific threat actor's techniques. The skill's description is written for these situations, so requests in that style are the ones most likely to load it.
Include the context the agent needs: the organization type, the threat actor you want to emulate, the objectives and what is in and out of scope. The skill's workflow asks for threat intelligence on the relevant adversary group, so name the group if you have one, for example APT29, FIN7 or Lazarus Group.
- Plan a full-scope red team engagement against a financial services client, emulating FIN7, with objectives around domain admin access and crown jewel data
- Build a purple team exercise plan that maps APT29 techniques to ATT&CK and lists the detection gaps to test
- Draft the final red team report structure with an executive summary, ATT&CK heat map and detection gap analysis
Work through the six phases
Start with Phase 1, planning and threat modeling. The skill provides a table that maps each kill chain stage to ATT&CK tactics and example techniques, from reconnaissance through impact. Use it to decide which techniques fit the threat profile, then move to the reconnaissance, initial access and post-exploitation phases.
Phase 5 defines objectives such as domain dominance, data exfiltration, business impact simulation and physical access. Phase 6 produces the report. Ask the agent to keep the action log and detection gaps current, since the Python helpers are built for tracking those items.
- Phase 1: Planning and threat modeling
- Phase 2: Reconnaissance (OSINT)
- Phase 3: Initial access
- Phase 4: Post-exploitation and lateral movement
- Phase 5: Objective achievement
- Phase 6: Reporting and debrief
Safety notes on scripts and network use
The skill runs scripts and uses the network. scripts/agent.py depends on attackcti, which is a client for MITRE ATT&CK data. The offensive commands in the workflow describe real intrusion techniques, including credential dumping, DCSync and phishing payloads. Running them against systems you do not own or have written permission to test can be illegal.
Treat the skill's commands as reference material. Do not run them on a live environment until the rules of engagement and emergency stop plan are signed. Production environments need extra care because an exercise can cause outages or expose data.
- Confirm written authorization before any command is run
- Keep an emergency stop plan and escalation contacts on hand
- Review each script before running it, and run it only in an environment you control
- Do not run the workflow commands against production systems without a rules-of-engagement document
What people use it for
- Scoping a full-scope objective-based engagement with an ATT&CK-mapped kill chain
- Planning a purple team exercise that emulates one threat actor's techniques against your detections
- Writing a structured final report with an executive summary, attack narrative and detection gap analysis
- Tracking metrics such as mean time to detect and TTP coverage across an exercise
Frequently asked questions
Is the conducting-full-scope-red-team-engagement skill free?
The skill is published under the Apache-2.0 licence, as stated in its metadata. Check the licence file in the download for the full terms before reusing or modifying it.
What do I need to install the skill?
Download the ZIP and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills in the Claude apps. The scripts also need Python 3 and the attackcti library.
Does the skill attack systems by itself?
No. The skill is described as a planning and reporting aid. Its workflow includes offensive command examples, but you must run them yourself, and only with written authorization.
Do I need to install nmap, Metasploit or other offensive tools?
Only if you choose to run the related commands yourself. Tools such as amass, theHarvester, nmap, msfvenom, GoPhish, Rubeus and secretsdump.py are referenced by the skill but not supplied with it.
Why does scripts/agent.py say attackcti is missing?
The script depends on the attackcti Python library and exits with an install message if it cannot find it. Install it with pip install attackcti, then run the script again.
How is this different from a penetration test or other red team tools?
The skill focuses on planning and documenting a realistic, objective-based adversary simulation mapped to MITRE ATT&CK, not on running individual scans. For reporting, the skill lists tools such as PlexTrac, Ghostwriter and Serpico as options, but it does not claim to replace them.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Security teams and consultants who already hold written authorization and want a structured, ATT&CK-mapped plan and report template will get the most from this skill. Beginners who want to learn hacking from scratch, or anyone without authorization, should pick a training resource or wait until they have a signed rules of engagement.
Download the skill