Autonomous AI security pen testing. Executes real exploits against web applications to find SQL injection, XSS, SSRF, authentication flaws, and IDOR vulnerabilities. Reports only confirmed, reproducible findings — no false positives.
The English summary is being prepared. Showing the original description.
Run score Not tested
See how to installReview the instructions the agent will receive before you install.
Shannon is a white-box security testing framework that analyses source code, maps attack surfaces, and executes real attacks. Use it against development and staging environments before deploying to production.
IMPORTANT — Authorization Gate: Shannon executes real attacks. You must have explicit written authorisation to test the target system. Shannon confirms this before every run. Never target production systems or systems you do not own.
npx skills add unicodeveloper/shannon
Prerequisites: Docker (all attack tools run in containers) and an Anthropic API key.
# Full pentest of a local app
/shannon http://localhost:3000 myapp
# Target specific vulnerability categories
/shannon --scope=xss,injection http://localhost:8080 frontend
# Named workspace (allows resuming if interrupted)
/shannon --workspace=audit-q1 http://staging.example.com backend-api
# Check status of a running pentest
/shannon status
# View the latest report
/shannon results
Shannon covers 50+ specific vulnerability types across 5 OWASP categories:
none algorithm, weak signing)Shannon runs these phases automatically, in parallel where safe:
| Phase | What happens |
|---|---|
| Pre-Recon | Static source code analysis + external scans (Nmap, Subfinder, WhatWeb) |
| Recon | Live attack surface mapping via headless browser |
| Vulnerability Analysis | 5 parallel specialist agents (injection, XSS, SSRF, auth, authorisation) |
| Exploitation | Each agent spawns a dedicated exploit agent; real attacks executed |
| Reporting | Executive summary + reproducible PoC for every confirmed finding |
# Limit to specific vulnerability categories
/shannon --scope=xss,injection http://localhost:3000 app
# Exclude sensitive paths
/shannon --avoid=/logout,/admin/delete http://localhost:3000 app
# Test only authenticated endpoints (provide session cookie)
/shannon --cookie="session=abc123" http://localhost:3000 app
--avoid to protect specific paths (e.g., /logout, data-deletion endpoints)Shannon's report includes only confirmed exploits — if it can't prove a vulnerability, it doesn't report it.
Each finding includes:
/api/*) — most exploitable surface for web apps--workspace to name runs so you can compare results across deploymentsNo reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Creating algorithmic art using p5.js with seeded randomness and interactive parameter exploration. Use this when users request creating art using code, generative art, algorithmic art, flow fields, or particle systems. Create original algorithmic art rather than copying existing artists' work to avoid copyright violations.
The English summary is being prepared. Showing the original description.
Applies Anthropic's official brand colors and typography to any sort of artifact that may benefit from having Anthropic's look-and-feel. Use it when brand colors or style guidelines, visual formatting, or company design standards apply.
The English summary is being prepared. Showing the original description.
Control a headless browser to navigate URLs, click elements, fill forms, extract content from JavaScript-rendered pages, take screenshots, and automate end-to-end web workflows.
The English summary is being prepared. Showing the original description.
Create beautiful visual art in .png and .pdf documents using design philosophy. You should use this skill when the user asks to create a poster, piece of art, design, or other static piece. Create original visual designs, never copying existing artists' work to avoid copyright violations.
The English summary is being prepared. Showing the original description.
Review code for quality, simplicity, and maintainability. Identifies unnecessary abstractions, duplicated logic, oversized functions, missing error handling, and naming issues — then fixes them automatically before presenting the result.
The English summary is being prepared. Showing the original description.
WooCommerce store operations through NV oOS Pro — product research, catalog cross-referencing, inventory lookups, and Shopify or Flowhub comparisons where integrations are configured.
The English summary is being prepared. Showing the original description.