Agent skill · security · aradotso
shannon-ai-pentester
Autonomous white-box AI pentester for web applications and APIs using source code analysis and live exploit execution
Why this skill is useful
Adds executable scripts for automated pentesting, including vulnerability scanning and exploit execution that are not commonly available in public tools.
What it needs
Requires docker installed locally. Requires anthropic, aws, google account access. About 5k tokens when loaded. Last updated 2026-07-09. 70 stars on the source repository.
What this skill does
Shannon AI Pentester Skill by ara.so — Daily 2026 Skills collection. Shannon is an autonomous, white-box AI pentester for web applications and APIs. It reads your source code to identify attack vectors, then executes real exploits (SQLi, XSS, SSRF, auth bypass, authorization flaws) against a live running application — only reporting vulnerabilities with a working proof-of-concept. How It Works 1. Reconnaissance — Nmap, Subfinder, WhatWeb, and Schemathesis scan the target 2. Code Analysis — Shannon reads your repository to map attack surfaces 3. Parallel Exploitation — Concurrent agents attempt live exploits across all vulnerability categories 4. Report Generation — Only confirmed, reproducible findings with copy-paste PoCs are included Installation & Prerequisites Docker (required — Shannon runs entirely in containers) An Anthropic API key, Claude Code OAuth token, AWS Bedrock credentials, or Google Vertex AI credentials Quick Start Shannon builds containers, starts the workflow in the background, and returns a workflow ID. Key CLI Commands Configuration Environment Variables .env File Example Usage Examples Basic Web App Pentest Testing Against OWASP Juice Shop (Demo) Authenticated Testing with 2FA AWS Bedrock Provider Google Vertex AI Provider Workspace and Resume Pattern Workspaces allow you to pause and resume long-running pentests: Output and Reports Reports are written to the workspace directory (default: ./workspaces/<workflow-id>/): The report includes: Vulnerability title and CVSS-style severity Affected endpoint and parameter Root cause with source code reference Step-by-step reproduction instructions Copy-paste curl/HTTP PoC Vulnerability Coverage Shannon currently tests for: Category Examples --- --- Injection SQL injection, command injection, LDAP injection XSS Reflected, stored, DOM-based SSRF Internal network access, cloud metadata endpoints Broken Authentication Weak tokens, session fixation, auth bypass Broken Authorization IDOR, privilege escalatio …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/shannon-ai-pentester