shannon-ai-pentester

Shannon AI Pentester is a catalogue entry that sets up and drives Shannon, an autonomous white-box AI penetration-testing tool for web applications and APIs, distributed as an upstream open-source project. The skill itself is a single SKILL.md that documents cloning the external Shannon repository, configuring credentials, and running its CLI; the actual offensive engine lives upstream and runs in Docker containers. Shannon reads an application's source code to map attack surfaces and then executes real, live exploits against a running target, only reporting findings that come with a working proof-of-concept.

The documented workflow runs reconnaissance (Nmap, Subfinder, WhatWeb, Schemathesis), analyzes the repository, launches concurrent agents that attempt live exploitation across injection, cross-site scripting, server-side request forgery, broken authentication, and broken authorization categories, and generates a report containing copy-paste proof-of-concept exploits, affected endpoints, and reproduction steps. The skill covers CLI commands (start, logs, status, resume, stop, report), workspace-based pause/resume, multiple AI provider back-ends (Anthropic, Bedrock, Vertex), and a CI/CD integration pattern. It also documents supplying target credentials, including username, password, and a TOTP secret, so Shannon can perform authenticated testing and handle two-factor authentication automatically. Because it automates real attacks and stores target credentials, this is offensive/dual-use security tooling whose safe use depends entirely on the operator having authorization to test the target.

Target users are security engineers, application-security teams, and developers who want automated white-box penetration testing of applications they own or are authorized to assess. Use cases include auditing a web app or API for confirmed vulnerabilities, integrating security testing into a CI pipeline, and generating reproducible exploit reports.