# shannon-ai-pentester

A white-box pentester that reads your source, runs live exploits against a running app, and reports only findings it can reproduce.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 1700 installs · ★ 88
- Author: reason-machines
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/trending-skills/tree/HEAD/skills/shannon-ai-pentester/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/shannon-ai-pentester

## What it does

This skill brings Shannon, an autonomous pentester for web apps and APIs, into your project. It starts with recon through Nmap, Subfinder, WhatWeb and Schemathesis, then maps attack surfaces from the repository while parallel agents try exploits across categories: injection, XSS, SSRF, broken authentication and authorization. Each entry in the final report comes with a working proof of concept.

Everything runs in containers, so Docker is required. Model access comes from one of several sources: an Anthropic API key, a Claude OAuth token, AWS Bedrock, or Google Vertex AI, selected with `SHANNON_AI_PROVIDER`. For authenticated runs set `TARGET_USERNAME`, `TARGET_PASSWORD` and `TARGET_TOTP_SECRET` — Shannon handles 2FA on its own. Skip Docker or model credentials and nothing starts.

Results land in the workspace directory: `report.md` with severity, affected endpoint and reproduction steps, `findings.json` for tooling, plus per-agent logs. Long runs can be paused and picked up again by workspace name, and the workflow fits a CI job — the repository ships a GitHub Actions example.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/trending-skills --skill shannon-ai-pentester -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/shannon-ai-pentester/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/shannon-ai-pentester/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/trending-skills --skill shannon-ai-pentester -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/shannon-ai-pentester/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/trending-skills --skill shannon-ai-pentester -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/shannon-ai-pentester/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/trending-skills shannon-ai-pentester
```

2. **Manually: put the files in place**
- File: `.github/skills/shannon-ai-pentester/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/trending-skills --skill shannon-ai-pentester -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/trending-skills --path skills/shannon-ai-pentester
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/shannon-ai-pentester/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/trending-skills --skill shannon-ai-pentester -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/trending-skills/tree/HEAD/skills/shannon-ai-pentester/SKILL.md

## When to use it
- check an API for SQL injection and auth bypass
- get a report with reproducible PoCs instead of a list of guesses
- run a pentest against staging before a release
- test an app behind a login with two-factor enabled
- add a security check to a CI pipeline

## Example prompts
- Scan my API for vulnerabilities and show me the report with PoCs
- Set up Shannon for authenticated testing — TARGET_USERNAME and TARGET_TOTP_SECRET are already in the environment

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [reason-machines/trending-skills](https://affpapa.org/en/nevibecode/by/reason-machines/trending-skills.md) — 139 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md