By Glyph-Software — a companion plugin to the sentinel agent harness.
A Claude Code plugin that gives Claude working knowledge of the core Kali / red-team toolset as skills (progressive-disclosure references), scripts (safe, tested helpers), and slash commands (engagement workflows).
Authorized testing only. Everything here assumes a signed SOW/ROE, a lab you own, or a CTF/training platform's terms. The
offsec-engagement-rulesskill is a hard gate the other skills defer to: scope, window, authorization, OPSEC posture, evidence, and rollback.
Reconnaissance (nmap, masscan, rustscan, naabu) · Active Directory (NetExec/nxc, ldapsearch, bloodyAD, enum4linux-ng, kerbrute, certipy) · BloodHound CE + SharpHound / bloodhound-python / RustHound · Responder, mitm6, and Impacket ntlmrelayx + coercion (PetitPotam, PrinterBug, DFSCoerce, Coercer) · Impacket (secretsdump, wmiexec/psexec/smbexec/atexec/dcomexec, GetUserSPNs, GetNPUsers, getTGT/getST, ticketer) · hashcat 7.x + John · Mimikatz / pypykatz / nanodump / Rubeus and the .NET post-ex arsenal · Sliver C2 and the Metasploit Framework · Burp Suite + the web CLI chain (httpx, ffuf, nuclei, sqlmap) · pivoting (Ligolo-ng, Chisel, sshuttle, proxychains).
.claude-plugin/plugin.json # manifest
.claude-plugin/marketplace.json # single-plugin marketplace for local install
commands/ # /engagement-start /scope-check /ad-recon /crack /report-finding
scripts/ # scope_check, engagement_init, nmap_parse, spray_guard,
# loot_index, hashcat_helper, http_probe
skills/ # 12 skills, each with a SKILL.md + references/
| Skill | Covers |
|---|---|
offsec-engagement-rules |
Authorization gate, scope, OPSEC posture, evidence, escalation checkpoints |
recon-and-scanning |
nmap three-pass model, masscan/rustscan, NSE, service triage |
ad-enumeration |
NetExec, LDAP, spraying, shares, ADCS, delegation |
bloodhound-attack-paths |
Collection (SharpHound/python/RustHound), Cypher, edge-abuse playbook |
impacket-toolkit |
Kerberos, exec methods, secretsdump/DCSync, tickets, RBCD/S4U |
ntlm-relay-and-poisoning |
Responder, ntlmrelayx, mitm6, coercion, ESC8 chains |
credential-cracking |
hashcat modes/strategy, John, lockout-safe spraying |
windows-post-exploitation |
Mimikatz, safe LSASS dumping, privesc, .NET arsenal, persistence |
c2-operations |
Sliver (beacon/session/armory/pivots), Metasploit + meterpreter |
web-app-testing |
Burp workflow, httpx/ffuf/nuclei/sqlmap |
pivoting-and-tunneling |
Ligolo-ng, Chisel, sshuttle, proxychains, C2 pivots |
reporting-and-evidence |
Loot tracking, rollback log, findings, attack-path narrative |
| Script | Purpose |
|---|---|
engagement_init.sh |
Scaffold the engagement working tree + engagement.yaml |
scope_check.py |
Fail-closed target validation against scope (CIDR/range/domain glob) |
nmap_parse.py |
nmap XML → inventory / open ports / per-service host lists / triage |
spray_guard.py |
Compute a lockout-safe spray schedule from --pass-pol output |
loot_index.py |
Track credentials, compromised hosts, and reversible changes in loot.json |
hashcat_helper.sh |
Identify a hash file and print a cracking escalation plan |
http_probe.sh |
Web recon chain (httpx/whatweb/TLS/ffuf), degrades if a tool is absent |
Scripts reference ${CLAUDE_PLUGIN_ROOT} so they work from any engagement directory.
From a Claude Code session, add the marketplace from GitHub and install:
/plugin marketplace add Glyph-Software/sigil/plugin install sigil@sigil-marketplaceLocal development — install from a working copy instead of GitHub:
/plugin marketplace add ./sigil-plugin/plugin install sigil@sigil-marketplaceThen start with /engagement-start <name> and let the skills load as the work dictates.
This plugin documents dual-use security tooling for authorized penetration testing, red-team engagements, CTFs, and defensive research. It intentionally builds in a scope gate, OPSEC posture, change tracking, and cleanup discipline. Use it only where you have explicit written authorization.