Autonomous AI security pen testing. Executes real exploits against web applications to find SQL injection, XSS, SSRF, authentication flaws, and IDOR vulnerabilities. Reports only confirmed, reproducible findings — no false positives.
インストールする前に、エージェントに与えられる指示の中身を確認できます。
Shannon is a white-box security testing framework that analyses source code, maps attack surfaces, and executes real attacks. Use it against development and staging environments before deploying to production.
IMPORTANT — Authorization Gate: Shannon executes real attacks. You must have explicit written authorisation to test the target system. Shannon confirms this before every run. Never target production systems or systems you do not own.
npx skills add unicodeveloper/shannon
Prerequisites: Docker (all attack tools run in containers) and an Anthropic API key.
# Full pentest of a local app
/shannon http://localhost:3000 myapp
# Target specific vulnerability categories
/shannon --scope=xss,injection http://localhost:8080 frontend
# Named workspace (allows resuming if interrupted)
/shannon --workspace=audit-q1 http://staging.example.com backend-api
# Check status of a running pentest
/shannon status
# View the latest report
/shannon results
Shannon covers 50+ specific vulnerability types across 5 OWASP categories:
none algorithm, weak signing)Shannon runs these phases automatically, in parallel where safe:
| Phase | What happens |
|---|---|
| Pre-Recon | Static source code analysis + external scans (Nmap, Subfinder, WhatWeb) |
| Recon | Live attack surface mapping via headless browser |
| Vulnerability Analysis | 5 parallel specialist agents (injection, XSS, SSRF, auth, authorisation) |
| Exploitation | Each agent spawns a dedicated exploit agent; real attacks executed |
| Reporting | Executive summary + reproducible PoC for every confirmed finding |
# Limit to specific vulnerability categories
/shannon --scope=xss,injection http://localhost:3000 app
# Exclude sensitive paths
/shannon --avoid=/logout,/admin/delete http://localhost:3000 app
# Test only authenticated endpoints (provide session cookie)
/shannon --cookie="session=abc123" http://localhost:3000 app
--avoid to protect specific paths (e.g., /logout, data-deletion endpoints)Shannon's report includes only confirmed exploits — if it can't prove a vulnerability, it doesn't report it.
Each finding includes:
/api/*) — most exploitable surface for web apps--workspace to name runs so you can compare results across deploymentsまだレビューはありません。使ってみた感想をお寄せください。
概要と使いどころ
Creating algorithmic art using p5.js with seeded randomness and interactive parameter exploration. Use this when users request creating art using code, generative art, algorithmic art, flow fields, or particle systems. Create original algorithmic art rather than copying existing artists' work to avoid copyright violations.
日本語の概要は準備中です。原文の説明を表示しています。
Applies Anthropic's official brand colors and typography to any sort of artifact that may benefit from having Anthropic's look-and-feel. Use it when brand colors or style guidelines, visual formatting, or company design standards apply.
日本語の概要は準備中です。原文の説明を表示しています。
Control a headless browser to navigate URLs, click elements, fill forms, extract content from JavaScript-rendered pages, take screenshots, and automate end-to-end web workflows.
日本語の概要は準備中です。原文の説明を表示しています。
Create beautiful visual art in .png and .pdf documents using design philosophy. You should use this skill when the user asks to create a poster, piece of art, design, or other static piece. Create original visual designs, never copying existing artists' work to avoid copyright violations.
日本語の概要は準備中です。原文の説明を表示しています。
Review code for quality, simplicity, and maintainability. Identifies unnecessary abstractions, duplicated logic, oversized functions, missing error handling, and naming issues — then fixes them automatically before presenting the result.
日本語の概要は準備中です。原文の説明を表示しています。
WooCommerce store operations through NV oOS Pro — product research, catalog cross-referencing, inventory lookups, and Shopify or Flowhub comparisons where integrations are configured.
日本語の概要は準備中です。原文の説明を表示しています。