skills.rest
unicodeveloper
unicodeveloperCOMMUNITY
Explore all skills by this author →
Website𝕏@unicodeveloperGitHub

shannon

Runs autonomous white-box pentests against web apps and APIs using Docker-based exploit agents.

51|7|Updated Mar 9, 2026
Search Tags:#security#vulnerability#owasp#docker#web security#exploit#pentest
One-click install
npx skills add https://github.com/unicodeveloper/shannon --skill shannon-unicodeveloper
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: shannon
Source: https://github.com/unicodeveloper/shannon
Command: npx skills add https://github.com/unicodeveloper/shannon --skill shannon-unicodeveloper

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve? Manual penetration testing is slow and expensive, and automated scanners produce false positives without proof. This Skill orchestrates Shannon to analyze source code, identify attack vectors, and execute real exploits that prove vulnerabilities before they reach production. ## Core Features & Use Cases - Autonomous multi-phase pentesting: Runs a 5-phase pipeline (pre-recon, recon, vulnerability analysis, exploitation, reporting) with parallel agents covering Injection, XSS, SSRF, Broken Authentication, and Broken Authorization. - Proof-of-concept validation: Only reports vulnerabilities it can prove with a working exploit, minimizing false positives. - Authenticated target support: Generates YAML configs for form/SSO login flows, TOTP, focus/avoid rules, and concurrency control. - Use Case: Point it at a local or staging app with its source code, and receive a report of critical findings with reproducible PoC exploits after a ~1-1.5 hour run. ## Quick Start Ask the assistant to run a Shannon pentest against your local app, for example by saying: run shannon against http://localhost:3000 using the source in my myapp folder.

Frequently Asked Questions about shannon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run an automated pentest against my local web app?▼

Invoke the skill with your target URL and source folder name, such as /shannon http://localhost:3000 myapp. The skill clones Shannon, links your source code, verifies Docker and API credentials, then launches a full pentest across 5 OWASP categories.

What vulnerability types does Shannon test for?▼

Shannon covers 50+ vulnerability types across 5 OWASP categories: Injection (SQLi, command injection, SSTI), XSS (reflected, stored, DOM-based), SSRF (cloud metadata, protocol smuggling), Broken Authentication (JWT flaws, MFA bypass), and Broken Authorization (IDOR, privilege escalation).

Can Shannon pentest applications that require login?▼

Yes, Shannon supports authenticated targets through a YAML config defining form or SSO login flows, credentials, optional TOTP secrets, and success conditions. You can also set focus and avoid rules to control which paths are tested.

Why can't Shannon reach my localhost app from Docker?▼

Shannon runs inside Docker containers, so localhost refers to the container itself. Use http://host.docker.internal:PORT instead, which works automatically on macOS and Windows with Docker Desktop; Linux may need an --add-host flag.

Is it safe to run Shannon against production systems?▼

No, Shannon executes real exploits with mutative effects and must never target production. The skill enforces an authorization gate before every run and should only be used on systems you own or have explicit written permission to test.

How long does a Shannon pentest take and what does it cost?▼

A full pentest takes approximately 1 to 1.5 hours and costs around $50 using Claude Sonnet. You can monitor progress with /shannon status, view reports with /shannon results, and stop runs with /shannon stop.

Related Skills

Explore More Software Engineering Skills→
nguynbon03nguynbon03

deploy-docker

Automate Docker deployment of Python applications with multi-stage builds and dev/prod compose files.

Community
Advanced
AbdelrhmanUZakiAbdelrhmanUZaki
2

run-poc

Generates proof-of-concept exploit reasoning to verify security fix effectiveness.

Community
Intermediate
DxTaDxTa

Security Test Scanner

Scans applications for OWASP Top 10 and other security vulnerabilities via static and dynamic analysis, dependency scanning, and CI/CD integration.

Community
Intermediate
xalgordxalgord
954

performing-web-application-vulnerability-triage

Triage DAST and SAST findings using OWASP risk rating to prioritize remediation.

Community
Intermediate