skills.rest
0x0pointer0x0pointerOfficial·4 Agent Skills Included

agent-smith

Autonomous penetration testing, exploit chaining, and verified security reporting

Runs full penetration tests from recon through exploitation using 50+ sandboxed scanners like nmap, nuclei, sqlmap, and Metasploit. Chains specialized workflows for web apps, APIs, cloud, Active Directory, codebases, and LLM red-teaming without manual orchestration. Verifies every finding with proof-of-concept artifacts, out-of-band callbacks, and source traces, then generates reports, patches, and CVE packages.
99|10
↗
npx skills add 0x0pointer/agent-smith --all -g -y
Available:

Instructs the agent on how to call the five consolidated MCP security tools, invoke and chain pentest skills per client, and log findings, coverage, and decisions during a scan.

All Skills in This Repository (4)

Pure Emerald Level Indicators
📦 In Repo
0x0pointer0x0pointer

aikido-triage

Triage Aikido CSV security findings against a local codebase.

Official
Advanced
📦 In Repo
0x0pointer0x0pointer

threat-modeling

Model security threats with PASTA and Shostack methods, producing Mermaid diagrams and risk registers.

Official
Advanced
📦 In Repo
0x0pointer0x0pointer

analyze-cve

Trace code paths from user input to vulnerable sinks and generate exploit requests for Burp Suite.

Official
Advanced
📦 In Repo
0x0pointer0x0pointer

gh-export

Format penetration testing findings from JSON into GitHub issue markdown blocks.

Official
Intermediate

Frequently Asked Questions

FAQPage Schema
How to install agent-smith?▼

Run `npx skills add 0x0pointer/agent-smith --all -g -y` in your terminal to install all skills globally. Docker Desktop and one supported LLM client are required.

What does agent-smith do?▼

It runs autonomous or human-guided penetration tests, chaining 35+ security skills from recon to exploitation and producing verified findings, PoCs, patches, and CVE packages.

Which LLM clients work with agent-smith?▼

It works with Claude Code, OpenAI Codex, OpenCode, and any MCP-capable client, including fully local models via Ollama or vLLM.

Can agent-smith test web apps and APIs?▼

Yes. Skills like /web-exploit, /param-fuzz, and /business-logic systematically test injection, auth, and logic flaws, with a coverage matrix tracking every endpoint and parameter.

Is agent-smith safe to run on any target?▼

Only use it on systems you own or have written permission to test. All scanners run in sandboxed Docker containers with enforced cost, time, and call limits.

Related Repositories in Software Engineering

View All in Software Engineering→
openclawopenclaw
388.4k

openclaw

Run a personal AI assistant across your devices and chat apps

Official📦 120 Skills
obraobra
280.0k

superpowers

Gives coding agents a disciplined workflow from idea to merged code

Community📦 15 Skills
facebookfacebook
248.4k

react

AI agent skills for building, testing, and porting React core

Official📦 14 Skills