How to use the Red-team OPSEC discipline agent skill (redteam-opsec)

What the redteam-opsec skill makes the agent do

The skill is a set of operational-security rules, written in Chinese, for staying hidden while testing a target's defenses. Its main topics are IP blacklist bypass, scan rate and timing, traffic blending, minimal footprint, anti-forensics and progressive exposure.

Once it is active, the agent will suggest tactics from the file when you ask about being blocked, slowing scans or covering traces. The file lists examples such as spoofing X-Forwarded-For style headers to get past IP blacklists, throttling and randomizing scan timing, mimicking normal browser traffic, running tools in memory, and deleting shell history and log entries.

The skill is advice only. Its single file, SKILL.md, contains no executable code, runs no scripts and makes no network calls.

• Topics covered: IP blacklist bypass, rate and timing, traffic blending, minimal footprint, anti-forensics, progressive exposure
• Files: SKILL.md only
• Runs scripts: no. Uses network: no. Listed requirements: none

Install the redteam-opsec skill

Download the ZIP for the skill from our page. Unzip it so that the redteam-opsec folder containing SKILL.md sits in one of the locations below.

For a personal install across all your projects, place it in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder. You can also upload the ZIP in the Claude apps under Settings → Capabilities → Skills.

• Personal: ~/.claude/skills/redteam-opsec/
• Project only: .claude/skills/redteam-opsec/ inside your project
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

How to trigger the skill with natural requests

You do not call the skill by name. The agent decides to use it when your request matches the skill's description, which says it applies when maintaining stealth, bypassing IP bans or planning covert red-team operations.

Describe your situation in plain terms and state the authorization context. The skill's own guidance focuses on checking how each action looks to defenders before you take it.

• 'My client's test IP just got blacklisted. What should I try first?'
• 'How do I slow my scans so they do not trip the WAF rate limits during our agreed covert exercise?'
• 'Plan a low-footprint approach for an authorized red-team engagement that avoids noisy scanning.'

What the guidance covers in practice

The file is organized as a checklist. Its opening rule is that getting in is not the same as staying in, and every action should be checked against how it looks to the defender.

Scan rate and timing examples in the file include the nuclei -rl, nmap -T2 --max-rate and ffuf -p delay options. Anti-forensics items include unset HISTFILE and set +o history, and the file warns that wiping an entire log file can itself trigger alerts. Progressive exposure means starting with passive reconnaissance before any active scanning.

• Start with passive reconnaissance such as certificate transparency, passive DNS and search engines
• Check for monitoring before active scanning
• Prefer in-memory execution and remove tools after use
• Avoid touching monitoring or audit services, since stopping them is itself an alert

Safety, scope and legal limits

Use this skill only with written authorization for the specific systems in scope. The skill is aimed at attacker-side evasion, including log tampering and bypassing bans, and these actions can be illegal without permission.

If you are a defender or a student, this skill is the wrong tool. It describes evasion, not detection or hardening. Use it to plan a sanctioned exercise, and keep your own records of scope, timing and approvals.

• Authorized penetration testers on a covert engagement the client has agreed to
• Red-team operators who need an evasion checklist for sanctioned exercises
• Not for testing systems you have no written authorization to test