offensive-persistence
offensive-persistence is a Penetration testing & red team skill for AI agents, published by SnailSploit in the Claude-Red repository on GitHub. Skillspace rates offensive-persistence F (15/100) and the safety scan rated it unsafe; the rating is based on static analysis only.
Unsafe. This skill has patterns associated with malicious or dangerous behaviour. We do not recommend running it.
Comprehensive persistence tradecraft for authorized red team engagements covering Windows and Linux mechanisms. Windows techniques include registry Run/RunOnce keys, scheduled tasks, WMI event subscriptions, DLL search order hijacking, COM object hijacking, Startup folder drops, service creation, Security Support Provider (SSP) DLL injection, and Active Directory persistence (AdminSDHolder abuse, DCShadow, Golden Ticket, Silver Ticket, Skeleton Key, SID History injection). Linux techniques include cron and at jobs, systemd timers and services, SSH authorized_keys injection, shell profile backdoors (.bashrc/.bash_profile), PAM module backdoors, LD_PRELOAD hijacking, kernel module rootkits, web shells, and Git hook abuse. Provides operator-ready command sequences for SharPersist, Impacket ticketer, schtasks, sc.exe, crontab, and systemctl with OPSEC considerations for each method. Maps to MITRE ATT&CK T1547 (Boot or Logon Autostart), T1053 (Scheduled Task/Job), T1546 (Event Triggered…
- Grade
- F
- Quality
- 15 / 100
- Safety
- Unsafe
- GitHub stars
- 3,959
Unproven: rated by static analysis only, not yet compared head-to-head.
This rating describes the version of the repository we crawled; it may have changed since.
Our review
- Architecture
- 76 / 100
- Maturity
- Basic: a single SKILL.md
- Security scan
- Critical-risk patterns
- License
- Not declared. Check the repository before reusing it.
What the scanner flagged
- pipe remote script to shell
- accesses sensitive system files
- mentions secrets in text
Not checked yet
- Category is a classifier prediction; no model has read this skill yet
- Not judged on the rubric yet (not a contender in its category)
- No blind task eval yet
- Scope (portable / vendor / repo-internal) not assessed; only the top of each category is read for scope
- Sibling files (scripts, references) not fetched; security scan covers SKILL.md only
Skillspace indexes and rates this skill; it does not host or endorse it. Run third-party skills at your own risk.