If you are an AI agent: read AGENTS.md (or README_AI.md for the short bootstrap) and follow it strictly — this repo is designed to be operated by you, not just read by humans.

Benchmarked, not just claimed. That replay is a real run: against OWASP Juice Shop (116 challenges, running locally), an agent with these skills solved 9 challenges in 10 minutes — SQLi auth bypass, UNION credential dump, XXE, JWT algorithm confusion, BOLA — each with a written finding. Scoring comes from the target's own solve log, never from what the agent claims. Full A/B (skills vs none) and how to reproduce it yourself: bench/RESULTS.md.

What it is

Your AI agent is a strong generalist, but it doesn't know the exact method for a specific job — say, testing an API for access-control bugs. SploitAgent is that missing know-how: a binder of 206 short "how to do this one technique" pages the agent flips to when it needs one.

It's not a replacement for your toolkit, either: the skills teach your agent when and how to drive the tools you already have — sqlmap, nmap, ffuf, nuclei, Burp Suite, Ghidra, Frida, hashcat, Impacket — with the exact commands, follow-ups, and verification steps each job calls for. And a machine-readable routing table (data/routing.json — 483 trigger cases, CI-verified) lets any agent or integration pick the right skill deterministically, no prompt guesswork.

You describe the task in plain English → it picks the right page, runs it, proves the bug, and writes it up → and it never touches anything outside the scope you set.

Pick your door

Same library, five ways in. Everything below runs in your terminal — install once (Quickstart), then talk to your agent.

Quickstart

Need: an AI agent — Claude Code, OpenCode, Codex, Gemini, or your own API script — plus git and a terminal. python3 only for the optional console.

# 1 · install once — links the skills into your agent + puts `sploit` on PATH
$ git clone https://github.com/NoorQureshi/security-skills && cd SploitAgent
$ ./sploit install

# 2 · make a workspace for your target (anywhere) and set the boundary
$ sploit new acme.com ~/work/acme
$ cd ~/work/acme
$ nano scope.txt                     # your authorized target(s) — nothing else gets touched

# 3 · (optional) watch the agent work, live, in your browser
$ sploit watch                       # runs in the background · stop: sploit watch --stop

# 4 · open your agent in the workspace and describe the task   ↓ (Claude Code / OpenCode below)

How the pieces fit: your terminal runs the agent; everything it decides, tries, and proves lands in the workspace folder (scope.txt · plan.md · notes.md · findings/) — the source of truth you can read, diff, and hand to a client. Same flow with any agent; none of it is Claude-specific.

Run it with your agent

Open your agent inside the workspace and describe the task in plain English — the matching skill loads itself. ./sploit install auto-configures every agent it detects on your machine — linking the skills where the agent has a native skills directory (Claude Code, Kimi Code, Cursor) and adding a small, clearly-marked pointer block to the agent's global instructions file otherwise (Codex, Gemini, OpenCode). Re-run it anytime; it's idempotent and --uninstall removes exactly what it added.

~/work/acme $ claude          # skills are already in ~/.claude/skills — auto-discovered everywhere

> Start an authorized assessment of acme.com. Confirm scope, then recon.

  ● tradecraft-scope-roe        loaded · scope confirmed (*.acme.tld)
  ● recon-subdomain-enum        14 hosts · api.acme.tld live
  ● api-bola                    testing object references on /api/v1/orders
      ✓ cross-tenant read confirmed with 2 accounts
  ✔ wrote findings/idor-orders.md

./sploit install linked the skills into ~/.claude/skills/ (and wired every other detected agent the same way — native skills dirs where they exist, a managed pointer block in the global instructions file otherwise), so Claude Code finds them in any folder and loads the one that fits your request.

~/work/acme $ opencode        # launches the TUI in this folder, using your own model/API key

> Use the SploitAgent skills in ./skills. Start an authorized assessment of
  acme.com — confirm scope from scope.txt, then recon the attack surface.

  → reads AGENTS.md + ./skills · loads recon-* then routes by what it finds

No install step: OpenCode reads AGENTS.md and the ./skills folder in the workspace automatically. (First time: opencode auth login to set your provider/API key.)

~/work/acme $ codex           # or: gemini  — run inside the workspace

> Use the SploitAgent skills here. Start an authorized assessment of acme.com,
  confirm scope from scope.txt, then recon.

Any agent works: point it at the workspace with read access to AGENTS.md and ./skills, or paste a single SKILL.md into the chat for a one-off. Nothing to wire up.

The terminal is the whole workflow — but if you want a live, read-only view of what the agent is doing, sploit watch opens a small dashboard at http://127.0.0.1:8787. It just reads the workspace on disk, so it works the same whichever agent you run.

• Attack Map — the whole engagement as a decision graph: what was proved, ruled out, blocked, and skipped — and why.
• Findings — each confirmed issue rendered and ready to submit · Activity — a live, filterable timeline with the reasoning · Plan / Notes — the strategy and running log.

Under Claude Code a bundled hook records commands automatically, so the console fills in even if the agent doesn't log by hand.

Ask it anything

What's inside

206 skills across 20 domains. 🔎 Search them all · or browse CATALOG.md.

web · api · cloud · ad · network · wireless · recon · mobile · ai-ml · code-review · reverse-engineering · ctf · hardware · cryptography · exploit-dev · privesc · payloads · tools · defense · reporting · automation · tradecraft · social-eng

Authorized use only

For security work you're permitted to do — a signed pentest scope, a bug-bounty program that lists the target, or systems you own. The first skill every engagement loads is tradecraft-scope-roe: it confirms authorization and refuses anything not in your scope.txt. See SECURITY.md to report a vulnerability in SploitAgent itself.

Contribute

A contribution is a single Markdown file — no code:

$ cp skills/_templates/technique.md skills/<domain>/<slug>/SKILL.md
$ python3 tools/catalog.py     # regenerate the indexes + stamp counts
$ ./tools/check.sh             # run everything CI runs, before you push

Wanted skills: ROADMAP.md · full guide: CONTRIBUTING.md · Code of Conduct.

License

MIT. Built for authorized security work.