{
  "markdown": "# Shannon Skill for Claude Code\n\nAutonomous AI pentester as a Claude Code skill. Wraps [KeygraphHQ/Shannon](https://github.com/KeygraphHQ/shannon) — the white-box security testing framework that analyzes source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.\n\n**96.15% exploit success rate** on the [XBOW security benchmark](https://github.com/KeygraphHQ/shannon#benchmarks) (100/104 exploits).\n\n## Install\n\n```bash\nnpx skills add unicodeveloper/shannon\n```\n\nOr install globally:\n\n```bash\nnpx skills add unicodeveloper/shannon -g -y\n```\n\n## Quick Start\n\nOnce installed, run from Claude Code:\n\n```\n/shannon http://localhost:3000 myapp\n```\n\nShannon will:\n1. Confirm you have authorization to test the target\n2. Clone/update the Shannon framework if not already installed\n3. Link your source code into Shannon's workspace\n4. Check Docker and API credentials\n5. Launch a full autonomous pentest across 5 OWASP categories\n6. Report findings with reproducible proof-of-concept exploits\n\n## Usage Examples\n\n### Full pentest of a local app\n\n```\n/shannon http://localhost:3000 myapp\n```\n\n### Pentest a staging environment with a named workspace\n\n```\n/shannon --workspace=audit-q1 http://staging.example.com backend-api\n```\n\n### Target specific vulnerability categories\n\n```\n/shannon --scope=xss,injection http://localhost:8080 frontend\n```\n\n### Check running pentests\n\n```\n/shannon status\n```\n\n### View latest report\n\n```\n/shannon results\n```\n\n### Stop a running pentest\n\n```\n/shannon stop\n```\n\n## Prerequisites\n\n### Required\n\n- **Docker** (or Podman) — Shannon runs entirely in containers\n  - Install: [docker.com/products/docker-desktop](https://docker.com/products/docker-desktop)\n- **Git** — to clone the Shannon framework\n- **AI provider credentials** (one of the following):\n\n| Provider | Environment Variable |\n|----------|---------------------|\n| Anthropic API (recommended) | `ANTHROPIC_API_KEY` |\n| Anthropic OAuth | `CLAUDE_CODE_OAUTH_TOKEN` |\n| AWS Bedrock | `CLAUDE_CODE_USE_BEDROCK=1` + AWS credentials |\n| Google Vertex AI | `CLAUDE_CODE_USE_VERTEX=1` + GCP service account |\n\n### Recommended\n\n```bash\nexport CLAUDE_CODE_MAX_OUTPUT_TOKENS=64000\n```\n\n## What Shannon Tests\n\nShannon covers **50+ vulnerability types** across 5 OWASP categories, all tested with real exploits:\n\n| Category | What's Tested |\n|----------|---------------|\n| **Injection** | SQL injection (union, blind, time-based), command injection, server-side template injection (SSTI), NoSQL injection, LDAP injection |\n| **Cross-Site Scripting** | Reflected XSS, stored XSS, DOM-based XSS, XSS via file upload, mutation XSS |\n| **SSRF** | Internal service access, cloud metadata extraction (AWS/GCP/Azure), DNS rebinding, protocol smuggling |\n| **Broken Authentication** | Default credentials, JWT vulnerabilities (none algorithm, weak signing), session fixation, CSRF, MFA bypass, brute force, account lockout flaws |\n| **Broken Authorization** | IDOR, horizontal/vertical privilege escalation, path traversal, forced browsing, mass assignment, insecure direct object references |\n\n## How It Works\n\nShannon operates as a multi-agent system with 5 phases:\n\n```\nShannon Pipeline\n━━━━━━━━━━━━━━━━\n\nPhase 1: Pre-Recon\n├── Static source code analysis\n└── External scans (Nmap, Subfinder, WhatWeb)\n\nPhase 2: Recon\n└── Live attack surface mapping via headless browser\n\nPhase 3: Vulnerability Analysis (5 parallel agents)\n├── Injection agent\n├── XSS agent\n├── SSRF agent\n├── Authentication agent\n└── Authorization agent\n\nPhase 4: Exploitation (parallel)\n├── Each vuln agent spawns an exploitation agent\n└── Real attacks executed to validate findings\n\nPhase 5: Reporting\n├── Executive summary\n└── Reproducible PoC for every finding\n```\n\n**No exploit, no report** — Shannon only reports vulnerabilities it can prove with a working proof-of-concept. This minimizes false positives.\n\n### Integrated Security Tools (bundled in Docker)\n\n- **Nmap** — port scanning and service detection\n- **Subfinder** — subdomain enumeration\n- **WhatWeb** — web technology fingerprinting\n- **Schemathesis** — API schema-based fuzzing\n- **Chromium/Playwright** — headless browser for automated exploitation\n\n### Runtime\n\n- **Duration**: ~1–1.5 hours for a full pentest\n- **Cost**: ~$50 using Claude Sonnet\n\n## Authentication Configuration\n\nFor targets that require login, the skill helps you create a YAML config:\n\n```yaml\n# configs/target-config.yaml\nauthentication:\n  type: form                    # \"form\" or \"sso\"\n  login_url: \"http://localhost:3000/login\"\n  credentials:\n    username: \"testuser\"\n    password: \"testpass123\"\n    totp_secret: \"BASE32SECRET\"  # optional, for 2FA\n  flow: \"Navigate to login page, enter username and password, click Sign In\"\n  success_condition:\n    url_contains: \"/dashboard\"\n\nrules:\n  avoid:\n    - \"/logout\"\n    - \"/admin/dangerous-action\"\n  focus:\n    - \"/api/\"\n    - \"/auth/\"\n\npipeline:\n  max_concurrent_pipelines: 5   # 1-5, default 5\n  retry_preset: subscription    # extended backoff for rate-limited API plans\n```\n\n## Testing Local Applications\n\nShannon runs inside Docker, so `localhost` on your machine isn't reachable from the container. The skill automatically handles this, but for reference:\n\n| Platform | Use This Instead of localhost |\n|----------|------------------------------|\n| macOS / Windows | `http://host.docker.internal:PORT` |\n| Linux | `http://host.docker.internal:PORT` (may need `--add-host` flag) |\n\n## Skill Structure\n\n```\nshannon-skill/\n├── SKILL.md                    # Skill definition (metadata + Claude instructions)\n├── CLAUDE.md                   # Project contributor instructions\n├── README.md                   # This file\n└── scripts/\n    ├── setup-shannon.sh        # Installs/updates Shannon, checks prerequisites\n    └── sync.sh                 # Deploys skill to ~/.claude, ~/.agents, ~/.codex\n```\n\n## Development\n\n### Deploy locally after edits\n\n```bash\nbash scripts/sync.sh\n```\n\nThis syncs the skill to:\n- `~/.claude/skills/shannon/`\n- `~/.agents/skills/shannon/`\n- `~/.codex/skills/shannon/`\n\n### Run the setup script standalone\n\n```bash\nbash scripts/setup-shannon.sh\n```\n\nChecks Docker, Git, clones Shannon, and validates API credentials.\n\n## Safety\n\nShannon executes **real attacks** against targets. The skill enforces safety at every step:\n\n- **Authorization gate** — asks for confirmation before every pentest\n- **Environment check** — warns against production targets\n- **Scope control** — lets you limit which vulnerability categories to test\n- **Avoid rules** — config option to exclude sensitive paths (e.g., `/logout`, `/admin/delete`)\n- **Containerized** — all attack tools run inside Docker, not on your host\n\n**Never run Shannon against systems you don't own or have explicit written authorization to test.**\n\n## Credits\n\n- **Shannon** by [KeygraphHQ](https://github.com/KeygraphHQ/shannon) — the autonomous pentesting engine (AGPL-3.0)\n- **Skill wrapper** — converts Shannon into a Claude Code `/shannon` slash command\n\n## License\n\nAGPL-3.0 — same as Shannon itself.\n",
  "bytes": 7073,
  "sha": "b4710992dcc0045e9c6e0418045c8fdc08db180991adacb8fa2c013058793bfe",
  "repo_slug": "unicodeveloper/shannon",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/skl_unicodeveloper_shannon_shannon_e814cfee/readme"
}