From redcap
Red-team / red-hat skill suite dispatcher for offensive and defensive device research. Use when the user wants to unlock engineering or factory modes on devices they own, extract or analyze device firmware, audit a device against its advertised specs (5G capability, FCC filing, feature toggles), reverse engineer an app or binary, find an offensive payload, run an autonomous pentest on an authorized target, or compare a system to a hardening baseline. Routes to six siblings: redcap-payloads, redcap-imhex, redcap-droid, redcap-gpt, redcap-kernel, redcap-compliance.
How this skill is triggered — by the user, by Claude, or both
Slash command
/redcap:redcapThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Named for the folklore redcap: a murderous goblin that dips its hat in the blood of its victims. This suite is the Claude-Code analog — it dips its pointer into whichever sibling skill best fits the task.
Named for the folklore redcap: a murderous goblin that dips its hat in the blood of its victims. This suite is the Claude-Code analog — it dips its pointer into whichever sibling skill best fits the task.
Claude reaches for the meta when the request is red-team / device-research flavored but the specific sibling isn't obvious, or when a task needs multiple siblings in sequence. For a direct request ("find me an XSS payload", "decompile this APK"), Claude should invoke the relevant sibling directly without bouncing through the meta.
| Sibling | Invoke when the task is... |
|---|---|
redcap-payloads | Looking up a specific exploit payload — SQL injection, XSS, SSTI, LDAP, XXE, CSRF, CRLF, SSRF, deserialization, auth bypass, WAF bypass, CVE-specific payloads |
redcap-imhex | Parsing or decoding a binary — firmware blob, file format, proprietary container, embedded config — especially when a structured pattern language helps |
redcap-droid | Decompiling an Android APK / XAPK / JAR / AAR, extracting HTTP API endpoints, tracing call flows, locating compile-time gates in bytecode |
redcap-gpt | Running an autonomous pentest on an authorized CTF / HTB machine / target, where persistent enumeration and reasoning-tree output beat manual direction |
redcap-kernel | Analyzing a firmware dump or kernel tree — unpacking partitions, hunting for compile-time feature flags, comparing advertised features to compile-time gates, detecting FCC-filing gaps |
redcap-compliance | Comparing a system or device config to a hardening baseline — SCAP, STIG, CIS, PCI-DSS, OSPP — or finding compliance deviations on an owned device |
redcap-payloads for web admin JSON-RPC fuzz payloads →redcap-droid for decompiling admin JARs to locate the feature gate →redcap-kernel for partition-level analysis of a firmware dump →redcap-imhex for raw binary structures (scatter.txt, preloader, bootloader) →redcap-gpt for autonomous reasoning over remaining attack axes →redcap-compliance as a sanity-check baseline against advertised / expected behavior.This suite is for lawful uses:
You are responsible for ensuring your use complies with applicable laws and terms of service. Unauthorized reverse engineering or network access against systems you do not own or do not have permission to test may violate computer-fraud statutes, terms of service, or regulations.
If a user asks for help against a target whose ownership or authorization is ambiguous, ASK before proceeding.
A driving use case for this suite is surfacing manufacturer-vs-reality gaps on devices the user owns:
When Claude uses these skills to investigate a device the user owns, framing the output as a fact-based gap audit (not "defeating security") both matches the real intent and avoids publishing patterns that read as attack disclosures.
Each sibling auto-triggers on its own description keywords. Invoke redcap-payloads directly by asking about payloads; Claude will match. The meta is only needed when the intent is ambiguous or when the task spans multiple siblings.
Each sibling is a dispatchable work-unit. Ultraplan decomposes a mission by:
A single sibling invocation is one work-unit; multi-sibling chains are pipelines. The meta-skill itself is rarely a work-unit — it's a routing aid, not a doer.
/plugin marketplace add GITDIDDY69/redcap
/plugin install redcap@redcap
/plugin install redcap-payloads@redcap
/plugin install redcap-imhex@redcap
/plugin install redcap-droid@redcap
/plugin install redcap-gpt@redcap
/plugin install redcap-kernel@redcap
/plugin install redcap-compliance@redcap
Install only the siblings you want.
Most siblings expect a local clone of their upstream reference fork:
| Sibling | Expected local path |
|---|---|
redcap-payloads | ~/Documents/GitHub/PayloadsAllTheThings |
redcap-imhex | ~/Documents/GitHub/ImHex + optional built binary |
redcap-droid | self-contained (jadx + Java JDK; auto-install scripts included) |
redcap-gpt | ~/Documents/GitHub/PentestGPT (Python env set up per its README) |
redcap-kernel | at least one kernel tree in ~/Documents/GitHub/ — linux (ADI) as a starter corpus; expand as you target new devices |
redcap-compliance | ~/Documents/GitHub/content (ComplianceAsCode) |
Clone all (once):
cd ~/Documents/GitHub
gh repo clone GITDIDDY69/PayloadsAllTheThings
gh repo clone GITDIDDY69/ImHex
gh repo clone GITDIDDY69/PentestGPT
gh repo clone GITDIDDY69/linux # large (~4 GB)
gh repo clone GITDIDDY69/content # ComplianceAsCode fork
npx claudepluginhub gitdiddy69/redcap --plugin redcapProvides CDSS development patterns for drug interaction checking, dose validation, clinical scoring (NEWS2, qSOFA), and alert classification integrated into EMR workflows.