Claude

A GitHub project called Claude-Red packages dozens of offensive-security "skills" as drop-in files for Claude, spanning web exploitation, credential attacks and advanced evasion tradecraft. It ships no built-in authorization check. What that means for security leaders, and the governance checklist to put in place before anyone on the team installs a skill pack like this.

Claude Security is a new beta plugin that scans code changes or entire repos for high-severity vulnerabilities directly in the terminal — reasoning through data flows like a security researcher instead of pattern-matching, with adversarial self-checks to cut false positives. Here's how it works and what it means for AppSec teams.