# shannon

The skill wires up Shannon: it reads your source code, maps attack vectors and runs real exploits to prove a vulnerability exists.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 2900 installs · ★ 56
- Author: KeygraphHQ
- License: AGPL-3.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/unicodeveloper/shannon/tree/HEAD/SKILL.md
- Updated: 2026-03-09
- HTML: https://affpapa.org/en/nevibecode/skills/shannon

## What it does

This is white-box testing. You hand over a target URL and the folder holding your code, and Shannon ties a flaw in the source to a live request against the running app. It works through OWASP Top 10 categories such as injection, XSS, SSRF and broken access control. What comes back is evidence, not a guess.

The skill is a wrapper around a Docker tool. It clones or pulls the Shannon repo into `~/shannon`, links your code under `repos/{REPO_NAME}`, then checks that `docker`, `git` and `ANTHROPIC_API_KEY` are present. Targets behind a login need a YAML config describing the sign-in form plus focus and avoid rules; without one, authenticated pages stay out of view.

Those exploits mutate the target, so pointing it at production is a mistake. Nothing in the skill stops you. Before each run it asks you to confirm authorization and reminds you that a human has to review the report.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add unicodeveloper/shannon --skill shannon -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/shannon/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/shannon/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add unicodeveloper/shannon --skill shannon -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/shannon/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add unicodeveloper/shannon --skill shannon -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/shannon/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install unicodeveloper/shannon shannon
```

2. **Manually: put the files in place**
- File: `.github/skills/shannon/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add unicodeveloper/shannon --skill shannon -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/unicodeveloper/shannon
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/shannon/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add unicodeveloper/shannon --skill shannon -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/unicodeveloper/shannon/tree/HEAD/SKILL.md

## When to use it
- find flaws in your own code before release
- prove an XSS actually fires with a working exploit
- test access control on endpoints that are easy to miss
- run an assessment across OWASP Top 10 categories
- resume an interrupted pentest in the same workspace

## Example prompts
- Pentest `http://localhost:3000` using the code in `./myapp`
- Run only `xss` and `injection` against `http://localhost:8080`, source lives in `frontend`
- Show me the latest Shannon report

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md