Run autonomous white-box pentests against web apps and APIs with Shannon
Analyze a web app's source code, execute real exploit attempts against the running target, and return proof-backed findings before release.
npx skills add agentskillexchange/skills --skill run-autonomous-white-box-pentests-against-web-apps-and-apis-with-shannon
Use Shannon when the job is to run an autonomous white-box pentest against a live web application or API using both the source repo and the running target. The upstream project is explicit about the operator loop: point Shannon at the app URL and repository, let it identify attack paths, execute exploit attempts, and save only proof-backed findings.
What this skill actually does
Invoke this instead of a normal DAST scanner or generic security dashboard when you need source-aware exploit validation before release, not just passive scanning or a product overview. The scope boundary is tight: Shannon performs authorization-sensitive pre-release pentesting of a specific web app or API. That keeps the entry skill-shaped and prevents it from collapsing into a generic security platform or framework listing.