Offensive

Agent skill that walks an authorized web application test through the OWASP WSTG checklist and writes a findings report.

Can add autostart, users or keys · write outside the project · run shell commands or eval · +1 more · Approval: no evidence · not run yet · checked 2026-10-21

Its API listens on all network interfaces with no login and runs any shell command it receives.

Can write system paths · tunnel or exfiltrate · run shell commands or eval · Secrets, Approval: no evidence · not run yet · checked 2026-10-24

Open-source framework for building LLM-driven security-testing agents, with use cases for Linux privilege escalation and web API testing.

Can write outside the project · talk to any host · run shell commands or eval · +3 more · not run yet · checked 2026-10-19

Autonomous white-box AI penetration tester for web apps and APIs; reports only vulnerabilities it proves by exploitation.

Can bypass approval · write outside the project · talk to any host · +2 more · not run yet · checked 2026-10-19

Autonomous AI penetration-testing agents that run offensive tools in a container sandbox and validate findings with a proof of concept.

Can tunnel or exfiltrate · use sudo or the docker socket · add autostart, users or keys · +3 more · not run yet · checked 2026-10-19

Enumerates subdomains and open ports of a declared target and writes a Markdown report.

Can write outside the project · talk to any host · run shell commands or eval · ran once, 2026-10-10: did more than it said · checked 2026-10-14