shannon — Claude Code skill: autonomous pentesting for web apps
The skill wires up Shannon: it reads your source code, maps attack vectors and runs real exploits to prove a vulnerability exists.
npx skills add unicodeveloper/shannon --skill shannon -a claude-codeWhat shannon does
This is white-box testing. You hand over a target URL and the folder holding your code, and Shannon ties a flaw in the source to a live request against the running app. It works through OWASP Top 10 categories such as injection, XSS, SSRF and broken access control. What comes back is evidence, not a guess.
The skill is a wrapper around a Docker tool. It clones or pulls the Shannon repo into ~/shannon, links your code under repos/{REPO_NAME}, then checks that docker, git and ANTHROPIC_API_KEY are present. Targets behind a login need a YAML config describing the sign-in form plus focus and avoid rules; without one, authenticated pages stay out of view.
Those exploits mutate the target, so pointing it at production is a mistake. Nothing in the skill stops you. Before each run it asks you to confirm authorization and reminds you that a human has to review the report.
What it helps with
- find flaws in your own code before release
- prove an XSS actually fires with a working exploit
- test access control on endpoints that are easy to miss
- run an assessment across OWASP Top 10 categories
- resume an interrupted pentest in the same workspace
Example prompts for the agent
- Pentest
http://localhost:3000using the code in./myapp - Run only
xssandinjectionagainsthttp://localhost:8080, source lives infrontend - Show me the latest Shannon report
How to install shannon
1Skills CLI (Vercel)
npx skills add unicodeveloper/shannon --skill shannon -a claude-code2Manually: put the files in place
~/.claude/skills/shannon/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/shannon/
1Skills CLI (Vercel)
npx skills add unicodeveloper/shannon --skill shannon -a codex2Manually: put the files in place
.agents/skills/shannon/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add unicodeveloper/shannon --skill shannon -a cursor2Manually: put the files in place
.cursor/skills/shannon/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install unicodeveloper/shannon shannon2Manually: put the files in place
.github/skills/shannon/SKILL.md1Skills CLI (Vercel)
npx skills add unicodeveloper/shannon --skill shannon -a gemini-cli2Platform CLI
gemini skills install https://github.com/unicodeveloper/shannonManually: put the files in place
.devin/skills/shannon/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add unicodeveloper/shannon --skill shannon -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about shannon
How do I install shannon in Claude Code?
Run npx skills add unicodeveloper/shannon --skill shannon -a claude-code. The skill lands at ~/.claude/skills/shannon/SKILL.md.
What does shannon do?
It runs a white-box security review of a web app or API: reads the source, locates attack vectors and executes real exploits to confirm the findings.
What does the skill need to run?
docker and git installed, plus an ANTHROPIC_API_KEY. Bedrock or Vertex mode can replace the key through environment variables.
