shannon-ai-pentester — Claude Code skill: automated web app pentesting

What shannon-ai-pentester does

This skill brings Shannon, an autonomous pentester for web apps and APIs, into your project. It starts with recon through Nmap, Subfinder, WhatWeb and Schemathesis, then maps attack surfaces from the repository while parallel agents try exploits across categories: injection, XSS, SSRF, broken authentication and authorization. Each entry in the final report comes with a working proof of concept.

Everything runs in containers, so Docker is required. Model access comes from one of several sources: an Anthropic API key, a Claude OAuth token, AWS Bedrock, or Google Vertex AI, selected with SHANNON_AI_PROVIDER. For authenticated runs set TARGET_USERNAME, TARGET_PASSWORD and TARGET_TOTP_SECRET — Shannon handles 2FA on its own. Skip Docker or model credentials and nothing starts.

Results land in the workspace directory: report.md with severity, affected endpoint and reproduction steps, findings.json for tooling, plus per-agent logs. Long runs can be paused and picked up again by workspace name, and the workflow fits a CI job — the repository ships a GitHub Actions example.