shannon

Shannon is an autonomous AI-powered pentesting skill designed for web applications and APIs. It helps security engineers and developers identify and validate vulnerabilities before deployment by combining source code analysis with active exploit execution. The skill orchestrates a Docker-based security testing workflow that analyzes application code, maps potential attack vectors, and performs real exploit attempts to confirm the presence of vulnerabilities. Shannon is intended for white-box security assessments and is specifically designed to run only against systems that users own or have explicit authorization to test.

The skill supports testing for multiple OWASP Top 10 vulnerability categories, including injection flaws, cross-site scripting (XSS), server-side request forgery (SSRF), broken authentication, and broken authorization. It can perform full pentests or targeted scans focused on selected categories. Shannon also supports named workspaces for resumable assessments, configurable scopes, and custom YAML-based configurations for advanced authentication flows or testing rules. The workflow includes mandatory safety validation steps, environment checks, and authorization confirmation before any pentest execution begins. The tool relies on Docker and Git, and requires environment configuration such as an API key for operation.

Shannon is intended for application security engineers, penetration testers, developers, DevSecOps teams, and organizations conducting internal security assessments in local, staging, or sandboxed environments. Typical use cases include validating security controls during development, testing APIs before release, running security audits against staging systems, and reproducing exploit scenarios in controlled environments. Because the tool executes real attacks with mutative effects, it is explicitly not intended for production systems or unauthorized targets.