| name | mao-pentest |
| description | Autonomous penetration testing via Shannon — a white-box security testing framework that executes real attacks and reports only confirmed exploits. Pairs with mao-security (static analysis) to provide full security coverage: static review on every PR, dynamic pentest before major releases. Requires Docker and Shannon installed: npx skills add unicodeveloper/shannon
|
| argument-hint | [target-url] [workspace-name] |
| allowed-tools | Bash |
MAO Pentest — Autonomous Security Testing
Dynamic security testing that proves vulnerabilities rather than suggesting them.
Shannon executes real attacks in Docker containers and reports only what it can exploit.
When to use this skill:
- Before promoting to production after a major feature release
- After significant auth, API, or database changes
- When
mao-security static review found HIGH/CRITICAL findings (confirm exploitability)
- Quarterly security audits on staging environments
When NOT to use this skill:
- On every PR (use
mao-security for that — it's fast and free)
- Against production (staging only)
- Without explicit written authorization for the target system
Prerequisites
npx skills add unicodeveloper/shannon
docker info
Usage
/shannon http://localhost:3000 myapp
/shannon --scope=xss,injection http://localhost:8080 frontend-api
/shannon --workspace=audit-q1 http://staging.example.com backend-api
/shannon --avoid=/logout,/admin/delete http://localhost:3000 myapp
/shannon status
/shannon results
What Shannon Tests (50+ vulnerability types)
| Category | Coverage |
|---|
| Injection | SQL (union, blind, time-based), command injection, SSTI, NoSQL |
| XSS | Reflected, stored, DOM-based, file upload, mutation XSS |
| SSRF | Internal services, cloud metadata (AWS/GCP/Azure), DNS rebinding, protocol smuggling |
| Broken Authentication | Default credentials, JWT flaws (none alg, weak signing), session fixation, CSRF, MFA bypass |
| Broken Authorization | IDOR, privilege escalation, path traversal, forced browsing, mass assignment |
The 5-Phase Pipeline
Phase 1: Pre-Recon — Static source analysis + Nmap/Subfinder/WhatWeb
Phase 2: Recon — Live attack surface mapping via headless browser
Phase 3: Analysis — 5 parallel agents (injection/xss/ssrf/auth/authz)
Phase 4: Exploitation — Dedicated exploit agent per finding, real attacks
Phase 5: Reporting — Executive summary + reproducible PoC per finding
Runtime: ~1–1.5 hours | Cost: ~$50 (Claude Sonnet)
Security Contract
Shannon enforces an authorization gate at every invocation — it will prompt
you to confirm you own or have explicit written authorization for the target.
All attack tools execute inside Docker containers. Nothing runs on your host.
Only run against systems you own or have explicit written authorization to test.
Integration with MAO Security Stack
Every PR: mao-security (static) → fast, free, catches patterns
Pre-release: mao-pentest (dynamic) → confirms exploitability, proves findings
Use mao-security-reviewer agent for code-level review.
Use mao-pentest skill for runtime proof-of-exploit against staging.
The output of mao-pentest feeds directly into correction tasks:
- Each confirmed exploit → HIGH/CRITICAL issue
- Correction task gets: exact PoC, affected endpoint, remediation steps
- Re-run pentest after fixes to confirm resolution
What Shannon Does NOT Cover
Complement with these tools for full coverage:
- Dependency CVEs:
npm audit, pip-audit, trivy
- Container image vulnerabilities:
trivy image <name>
- Secrets in code/history:
trufflehog, gitleaks
- Infrastructure misconfig:
checkov, tfsec
Report Output
Shannon generates a report with:
- Executive summary (severity distribution, risk score)
- Per-finding: description, affected endpoint, HTTP request/response proof, remediation
- All findings are confirmed exploits — no false positives
View with: /shannon results
