From cybersec-toolkit
Walks through adding a new cybersecurity tool to the installer: selecting the module, choosing an install method, editing config files, and running validators.
How this skill is triggered — by the user, by Claude, or both
Slash command
/cybersec-toolkit:add-toolThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Use this when the user wants to add a new tool. Follow these steps in order. **Do not skip validation.**
Use this when the user wants to add a new tool. Follow these steps in order. Do not skip validation.
Match the tool to one of the 18 modules:
| Module | Prefix | Tools |
|---|---|---|
misc.sh | MISC_ | General CLI helpers, utilities |
networking.sh | NET_ | Scanners, sniffers, proxies |
recon.sh | RECON_ | OSINT, subdomain enum, fingerprinting |
web.sh | WEB_ | Web app testing, fuzzing, scanners |
crypto.sh | CRYPTO_ | Crypto attack tools, analysis |
pwn.sh | PWN_ | Binary exploitation, debuggers, fuzzers |
reversing.sh | RE_ | Disassemblers, decompilers |
forensics.sh | FORENSICS_ | Disk/memory/file forensics |
enterprise.sh | ENTERPRISE_ | AD, Kerberos, post-exploit |
wireless.sh | WIRELESS_ | Wi-Fi, Bluetooth |
cracking.sh | CRACKING_ | Password cracking, hash tools |
stego.sh | STEGO_ | Steganography |
cloud.sh | CLOUD_ | AWS/GCP/Azure tooling |
containers.sh | CONTAINER_ | Docker, k8s |
blueteam.sh | BLUETEAM_ | Detection, IR, hardening |
mobile.sh | MOBILE_ | APK, iOS analysis |
blockchain.sh | BLOCKCHAIN_ | Smart contracts, EVM |
llm.sh | LLM_ | AI/LLM testing |
Preferred order: apt > pipx > go > cargo > binary release > gem > Docker > git clone > build from source
Add to the matching array in modules/<module>.sh:
| Method | Array | Format |
|---|---|---|
| apt | <PREFIX>_PACKAGES | "package-name" |
| pipx | <PREFIX>_PIPX | "pypi-name" |
| Go | <PREFIX>_GO + <PREFIX>_GO_BINS | "github.com/owner/repo/cmd@latest" + "binary-name" |
| Cargo | <PREFIX>_CARGO | "crate-name" |
| Gem | <PREFIX>_GEMS | "gem-name" |
| Git | <PREFIX>_GIT + <PREFIX>_GIT_NAMES | "name=https://github.com/owner/repo" + "name" |
| Binary release | BINARY_RELEASES_<MODULE> in lib/installers.sh | "owner/repo|binary|pattern|dest_dir" |
| Docker | ALL_DOCKER_IMAGES in lib/installers.sh | "image|label" + add docker_pull call in module install function |
| Build from source | build_from_source call in install_module_*() + <PREFIX>_BUILD_NAMES | inline |
If apt package name differs across distros, add a row to lib/distro_compat.tsv (columns: debian | dnf | pacman | zypper | pkg). Use - to skip a distro, empty for passthrough, a+b for multi-package expand.
tools_config.jsonAppend an entry:
{
"name": "tool-name",
"method": "apt|pipx|go|cargo|gem|binary|docker|git|build",
"module": "module-name",
"url": "https://upstream/url"
}
python3 scripts/validate_tools_config.py
If URLs are missing, populate them automatically:
python3 scripts/validate_tools_config.py --sync
If the tool was added to a data source mirrored in the MCP server:
mcp_server/tools_db.py DOCKER_IMAGESmcp_server/tools_db.py PIPX_BIN_NAMES (mirror of scripts/verify.sh _PIPX_BIN_NAMES)lib/common.sh MODULE_DESCRIPTIONS AND mcp_server/tools_db.py MODULE_DESCRIPTIONSThen validate sync:
python3 scripts/validate_mcp_sync.py
shellcheck --severity=warning install.sh lib/*.sh modules/*.sh scripts/*.sh
bash -n install.sh lib/*.sh modules/*.sh scripts/*.sh
scripts/verify.sh, scripts/update.sh, scripts/remove.sh all source modules and pick up array changes automatically — no edits needed there.
./install.sh --module <module-name> --dry-run
npx claudepluginhub 26zl/cybersec-toolkit --plugin cybersec-toolkitGenerates boilerplate for a new module file, including array prefix, install function, and integration with install.sh, profiles, and MCP server. Useful when adding a new tool category.
Audits installed infrastructure tools (MCPs, CLIs, Claude Code plugins), checks authentication state, searches for new official tools, recommends installations, and generates tooling manifest.
Installs, updates, audits, and recommends CLI tools. Resolves 'command not found' errors and suggests modern alternatives (e.g., ripgrep, fd, jq, bat).