By GamblerIX2
Autonomous white-box AI pentester as a Claude Code plugin — five-phase pipeline (pre-recon, recon, vuln analysis, exploitation, reporting).
Phase 4 of the pentest pipeline — attempt reproducible PoCs for candidate vulnerabilities. Invoked by pentest-orchestrator; skipped when scope.exploit is false.
Use when running /pentest — sequences the five pentest phases, owns run.json state, enforces the authorization gate and scope lock, and resumes interrupted runs.
Phase 1 of the pentest pipeline — white-box source-code analysis to build an architectural baseline. Invoked by pentest-orchestrator.
Phase 2 of the pentest pipeline — map the live attack surface from the pre-recon baseline. Invoked by pentest-orchestrator.
Phase 5 of the pentest pipeline — assemble the final security report from confirmed findings. Invoked by pentest-orchestrator.
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimBased on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
一个运行在 Claude Code 内部的自主白盒 AI 渗透测试插件。 灵感来自 KeygraphHQ/shannon,但完全以 Claude Code 原生方式(斜杠命令 + 技能)重写。
ShannonForClaudeCode 让你在自己的 Claude Code 会话里,对你拥有或已获授权的 Web 应用执行一次完整的白盒渗透测试。它结合源码分析与对运行中应用的真实验证,最终只输出可复现的、已被证实的漏洞。
在 Claude Code 中执行:
/plugin marketplace add GamblerIX2/ShannonForClaudeCode
/plugin install shannon-for-claude-code@shannon-for-claude-code
或克隆到本地后从本地市场安装:
git clone https://github.com/GamblerIX2/ShannonForClaudeCode
/plugin marketplace add ./ShannonForClaudeCode
/plugin install shannon-for-claude-code@shannon-for-claude-code
安装后,在目标项目的 Claude Code 会话里运行:
/pentest --code ./ --url https://localhost:3000 --classes injection,xss,auth,authz,ssrf --exploit true
参数说明:
| 参数 | 含义 | 默认值 |
|---|---|---|
--code | 目标应用的源码路径(必填) | — |
--url | 运行中应用的基础 URL(侦察/利用阶段需要) | — |
--classes | 要测试的漏洞类别 | injection,xss,auth,authz,ssrf |
--exploit | 是否执行真实利用;false = 仅分析 | true |
--roe | 自由文本形式的交战规则(Rules of Engagement) | 空 |
只做静态分析、不接触网络的最小用法:
/pentest --code ./ --exploit false
| 阶段 | 名称 | 产物 |
|---|---|---|
| 1 | 预侦察 (Pre-Recon) — 源码架构基线分析(无网络请求) | 01-pre-recon.md |
| 2 | 侦察 (Recon) — 从基线 + 运行应用映射攻击面 | 02-recon.md / attack-surface.json |
| 3 | 漏洞分析 (Vuln Analysis) — 逐类别枚举候选漏洞与假设 | 03-vuln-<class>.md / findings-candidates.json |
| 4 | 利用 (Exploitation) — 对候选漏洞尝试可复现 PoC(--exploit false 时跳过) | 04-exploit-<class>.md / findings-confirmed.json |
| 5 | 报告 (Reporting) — 汇总已证实漏洞生成报告 | report.md |
所有运行状态保存在 pentest-workspace/<run-id>/ 下。流程顺序执行且可恢复:中断后再次运行 /pentest 会从未完成的阶段继续,并锁定首次运行时的测试范围。
⚠️ 仅用于合法的防御性安全测试。
.env 读取,绝不提交到仓库。对未授权目标使用渗透测试工具可能违法,后果由使用者自行承担。
npx claudepluginhub gamblerix2/shannonforclaudecodeEnd-to-end automation of Shannon white-box pentests inside Claude Code: clone, configure, run, collect report, cleanup.
Comprehensive skill pack with 66 specialized skills for full-stack developers: 12 language experts (Python, TypeScript, Go, Rust, C++, Swift, Kotlin, C#, PHP, Java, SQL, JavaScript), 10 backend frameworks, 6 frontend/mobile, plus infrastructure, DevOps, security, and testing. Features progressive disclosure architecture for 50% faster loading.
Tools to maintain and improve CLAUDE.md files - audit quality, capture session learnings, and keep project memory current.
Unity Development Toolkit - Expert agents for scripting/refactoring/optimization, script templates, and Agent Skills for Unity C# development
Complete creative writing suite with 10 specialized agents covering the full writing process: research gathering, character development, story architecture, world-building, dialogue coaching, editing/review, outlining, content strategy, believability auditing, and prose style/voice analysis. Includes genre-specific guides, templates, and quality checklists.
Comprehensive .NET development skills for modern C#, ASP.NET, MAUI, Blazor, Aspire, EF Core, Native AOT, testing, security, performance optimization, CI/CD, and cloud-native applications
Complete collection of battle-tested Claude Code configs from an Anthropic hackathon winner - agents, skills, hooks, and rules evolved over 10+ months of intensive daily use