Guide · Agent skill
How to use the offensive data exfiltration agent skill safely
Updated · written with AI from the project's own documentation and checked against our catalogue data
This page explains the offensive-data-exfiltration agent skill, a methodology file that gives an AI agent a structured reference for data exfiltration techniques used in authorized red team and penetration testing work. It is written for security professionals and detection engineers who need to understand what the skill covers, how to install it, and where its limits are. This guide describes the skill at the level of its categories and safety requirements; it does not reproduce its operational commands.
Offensive Data Exfiltration MethodsSnailSploit/Claude-Red · MIT Download the skill Quick start
- 1Download the ZIP. Download the skill ZIP from this page and unzip it. Confirm SKILL.md is inside the skill folder.
- 2Place the skill folder. Copy the folder to ~/.claude/skills/ for personal use, or to a project's .claude/skills/ folder for one project.
- 3Or upload it in the Claude apps. In the Claude apps, open Settings, go to Capabilities, and upload the skill under Skills.
- 4Confirm written authorization. Before any request, confirm you hold written permission covering the exact target and scope.
- 5Ask a scoped question. Describe the engagement and ask for a planning summary, report text, or detection review.
- 6Review the output with a detection lens. Check which logs and sensors would show each technique and record findings in your report.
What the skill makes the agent do
The skill is a single SKILL.md methodology file. When it is loaded and a request matches its description, the agent can draw on its reference material on exfiltration channels, staging, encoding, and verification, all mapped to MITRE ATT&CK techniques such as T1048, T1041, T1567, and T1132.
The source covers several channel families: DNS, HTTPS, ICMP, cloud storage, email, steganography, encoding and encryption, and covert channels. It also includes data staging and a verification step. The file is dense and tool-specific, and it assumes working knowledge of networking and of the tools it names.
- Channel families: DNS, HTTPS, ICMP, cloud storage, email, steganography, encoding and encryption, covert channels
- Staging and transfer concepts: compression, splitting, encryption
- Verification concept: hash comparison between source and receiving end
- Mapped to MITRE ATT&CK exfiltration techniques
Install the skill from the ZIP
Download the ZIP for this skill from this page and unzip it. The skill is a folder containing SKILL.md. To make it available to Claude Code for your user account, place the folder in ~/.claude/skills/. To make it available only inside one project, place it in that project's .claude/skills/ folder.
Check that SKILL.md sits directly inside the skill folder after unzipping, so the agent can find the file.
- Personal install: ~/.claude/skills/
- Project install: the project's .claude/skills/ folder
- Only SKILL.md is included in the package
Upload the skill in the Claude apps
If you use the Claude apps rather than Claude Code, open Settings, go to Capabilities, and use the Skills section to upload the skill from the same ZIP. Confirm the skill appears in the list before you rely on it.
Trigger the skill with clear requests
The skill loads when a request matches its description, which says it is for planning or executing data exfiltration during authorized red team engagements or post-exploitation. Name your context explicitly so the agent knows the scope. A request that states the engagement, the authorization, and the goal is more useful than a vague one.
Useful requests focus on planning, review, and detection. For example, you can ask the agent to explain how a given channel family works at a conceptual level for a report, or to list which telemetry would reveal it. Requests that ask for ready-to-run transfers against systems you have not been authorized to test are outside what this page supports.
- Name the engagement and the written authorization it operates under
- Ask for a planning summary, a report section, or a detection review
- Ask which logs, network sensors, or cloud audit trails would show each channel
Requirements and what you must provide
The source lists command-line tools the skill references, including dnscat2, iodine, dns2tcp, PacketWhisper, chisel, stunnel, icmpsh, ptunnel-ng, steghide, zsteg, and OpenStego. It also lists Python 3 with the dnspython and requests libraries, Ruby for dnscat2, an attacker-controlled domain and DNS server, and accounts or API tokens for Slack, GitHub, or Pastebin if those channels are used.
Installing the skill does not install these tools. Those requirements are listed so you understand what the methodology assumes. Do not set up infrastructure for any channel without written authorization for the target.
- Listed tools: dnscat2, iodine, dns2tcp, PacketWhisper, chisel, stunnel, icmpsh, ptunnel-ng, steghide, zsteg, OpenStego
- Runtime: Python 3 with dnspython and requests, Ruby for dnscat2
- Infrastructure: attacker-controlled domain and DNS server
- Accounts or tokens only if a listed external channel is used
Safety notes: scripts and network
The skill does not run scripts and does not use the network by itself. It is a text methodology. Any action taken on a real system happens only if you or the agent run commands in your own environment, and those commands are what carry risk.
The skill does not verify authorization. Nothing in the file checks that you have permission to test a target, so that responsibility rests entirely with you. The techniques are designed to avoid detection and bypass controls, so using them outside a sanctioned engagement is illegal in most jurisdictions and can cause serious harm.
- Scripts: none run by the skill itself
- Network: the skill does not make network calls
- Authorization: you must hold written permission for the specific target and scope
- Do not use it for routine backup, file transfer, or sharing work
Tips for blue teams and students
Detection engineers can use the skill as a map of what to monitor. Each channel family leaves different evidence, such as unusual DNS query volume or length, unexpected outbound TLS to CDN or SaaS endpoints, ICMP payloads larger than normal, large uploads to cloud storage, and unusual archive or image activity. Students can use the MITRE ATT&CK mapping to study how each technique is classified.
Keep a written record of the authorization, scope, and rules of engagement next to any output the agent produces, so your report can show what was tested and why.
- Map each channel family to the telemetry that would reveal it
- Review DNS, proxy, egress, and cloud audit logs for the listed patterns
- Use the MITRE ATT&CK IDs in your report for consistency
- Store authorization documents with engagement notes
What people use it for
- Explaining exfiltration channel families in a red team report with MITRE ATT&CK IDs
- Reviewing which DNS, proxy, and cloud audit logs would show the listed patterns
- Teaching a student how T1048, T1041, and T1567 differ
- Planning detection coverage for egress and cloud storage uploads
Frequently asked questions
Is the offensive data exfiltration skill free?
The source states the item is licensed under MIT. The page does not list any price, so check the ZIP's licence file and the source repository for terms before using it.
How do I install the offensive-data-exfiltration skill?
Download the ZIP from this page and unzip it. Put the folder in ~/.claude/skills/ for personal use or in a project's .claude/skills/ folder. In the Claude apps, upload it under Settings, then Capabilities, then Skills.
What do I need to use this skill?
The source lists tools such as dnscat2, iodine, and chisel, Python 3 with dnspython and requests, Ruby for dnscat2, and an attacker-controlled domain and DNS server. Installing the skill does not install these, and you need written authorization for any target.
Does the skill run scripts or use the network?
According to the source, it runs no scripts and makes no network calls on its own. Any real-world action depends on commands run in your environment, so the risk sits there.
Is this skill safe to use?
It is a dense offensive reference that does not verify authorization, so it is only appropriate for authorized engagements with written scope. Using it on systems you are not permitted to test is illegal in most places.
What are alternatives or how does this compare to other tools?
This page does not compare it with other tools, since the source does not do so. For detection-focused work, consider reviewing your own DNS, proxy, and cloud audit logs against the MITRE ATT&CK exfiltration techniques it references.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits security professionals on authorized red team or penetration testing engagements, blue team engineers mapping exfiltration telemetry, and students studying MITRE ATT&CK exfiltration. It is the wrong choice for anyone without written authorization, for routine backup or file transfer, or for non-technical users who want a simple file-sharing helper.
Download the skill