Autonomous AI security pen testing. Executes real exploits against web applications to find SQL injection, XSS, SSRF, authentication flaws, and IDOR vulnerabilities. Reports only confirmed, reproducible findings — no false positives.
中文简介正在准备中。当前显示原文说明。
实测评分 未实测
查看安装方法安装前可以查看交给 AI 代理的指令内容。
Shannon is a white-box security testing framework that analyses source code, maps attack surfaces, and executes real attacks. Use it against development and staging environments before deploying to production.
IMPORTANT — Authorization Gate: Shannon executes real attacks. You must have explicit written authorisation to test the target system. Shannon confirms this before every run. Never target production systems or systems you do not own.
npx skills add unicodeveloper/shannon
Prerequisites: Docker (all attack tools run in containers) and an Anthropic API key.
# Full pentest of a local app
/shannon http://localhost:3000 myapp
# Target specific vulnerability categories
/shannon --scope=xss,injection http://localhost:8080 frontend
# Named workspace (allows resuming if interrupted)
/shannon --workspace=audit-q1 http://staging.example.com backend-api
# Check status of a running pentest
/shannon status
# View the latest report
/shannon results
Shannon covers 50+ specific vulnerability types across 5 OWASP categories:
none algorithm, weak signing)Shannon runs these phases automatically, in parallel where safe:
| Phase | What happens |
|---|---|
| Pre-Recon | Static source code analysis + external scans (Nmap, Subfinder, WhatWeb) |
| Recon | Live attack surface mapping via headless browser |
| Vulnerability Analysis | 5 parallel specialist agents (injection, XSS, SSRF, auth, authorisation) |
| Exploitation | Each agent spawns a dedicated exploit agent; real attacks executed |
| Reporting | Executive summary + reproducible PoC for every confirmed finding |
# Limit to specific vulnerability categories
/shannon --scope=xss,injection http://localhost:3000 app
# Exclude sensitive paths
/shannon --avoid=/logout,/admin/delete http://localhost:3000 app
# Test only authenticated endpoints (provide session cookie)
/shannon --cookie="session=abc123" http://localhost:3000 app
--avoid to protect specific paths (e.g., /logout, data-deletion endpoints)Shannon's report includes only confirmed exploits — if it can't prove a vulnerability, it doesn't report it.
Each finding includes:
/api/*) — most exploitable surface for web apps--workspace to name runs so you can compare results across deployments还没有评价。欢迎分享你的使用感受。
无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
Creating algorithmic art using p5.js with seeded randomness and interactive parameter exploration. Use this when users request creating art using code, generative art, algorithmic art, flow fields, or particle systems. Create original algorithmic art rather than copying existing artists' work to avoid copyright violations.
中文简介正在准备中。当前显示原文说明。
Applies Anthropic's official brand colors and typography to any sort of artifact that may benefit from having Anthropic's look-and-feel. Use it when brand colors or style guidelines, visual formatting, or company design standards apply.
中文简介正在准备中。当前显示原文说明。
Control a headless browser to navigate URLs, click elements, fill forms, extract content from JavaScript-rendered pages, take screenshots, and automate end-to-end web workflows.
中文简介正在准备中。当前显示原文说明。
Create beautiful visual art in .png and .pdf documents using design philosophy. You should use this skill when the user asks to create a poster, piece of art, design, or other static piece. Create original visual designs, never copying existing artists' work to avoid copyright violations.
中文简介正在准备中。当前显示原文说明。
Review code for quality, simplicity, and maintainability. Identifies unnecessary abstractions, duplicated logic, oversized functions, missing error handling, and naming issues — then fixes them automatically before presenting the result.
中文简介正在准备中。当前显示原文说明。
WooCommerce store operations through NV oOS Pro — product research, catalog cross-referencing, inventory lookups, and Shopify or Flowhub comparisons where integrations are configured.
中文简介正在准备中。当前显示原文说明。