Shannon

Shannon runs autonomous penetration tests against web apps by analyzing your source code and executing real exploits to prove vulnerabilities exist. It's Docker-based, covers OWASP Top 10 (injection, XSS, SSRF, broken auth), and claims a 96% exploit success rate on the XBOW benchmark. You point it at a local or staging environment with the corresponding source code, and it spends about 90 minutes finding and exploiting attack vectors. The skill handles the orchestration: cloning the repo, setting up configs for authenticated flows, and parsing reports. This is actual offensive security testing, not static analysis, so the obvious warning applies: only run it against systems you own or have written authorization to test.

Install to Claude Code

npx -y skills add unicodeveloper/shannon --skill shannon --agent claude-code