Updated 4d ago
by Netw0rkNoob
VulnClaw
基于 AI Agent + MCP 工具链 + 渗透 Skill 编排, 配合大语言模型, 自然语言输入 → 自动完成「信息收集 → 漏洞发现 → 漏洞利用 → 报告生成」全流程。
3.7k GitHub stars (3,714)
+242 in 16 days
| Period | New stars |
|---|---|
| Oct 1 | +2 |
| Oct 2 | +3 |
| Oct 3 | +5 |
| Oct 4 | +2 |
| Oct 5 | +3 |
| Oct 6 | +3 |
| Oct 7 | +2 |
| Oct 8 | +6 |
| Oct 9 | +9 |
| Oct 10 | +9 |
| Oct 11 | +10 |
| Oct 12 | +7 |
| Oct 13 | +80 |
| Oct 14 | +51 |
| Oct 15 | +26 |
| Oct 16 | +24 |
- 30 skills (30 skills found in its SKILL.md files)
- 524 forks (524 forks)
- 4d ago last update (Last updated 4d ago)
Install
Skills CLI
npx skills add Netw0rkNoob/VulnClaw
Asks which skills and agents to install. Just one: npx skills add Netw0rkNoob/VulnClaw --skill ai-mcp-security — add -g for every project.
Claude Code
git clone https://github.com/Netw0rkNoob/VulnClawcp -r "VulnClaw/vulnclaw/skills/specialized/ai-mcp-security" ~/.claude/skills/
Copies the ai-mcp-security skill into ~/.claude/skills/ for every project (use .claude/skills/ for one project). Repeat for the other skills listed below.
Plugin
/plugin marketplace add Netw0rkNoob/VulnClaw
Run inside Claude Code if the repository ships a plugin marketplace, then pick plugins from /plugin.
Skills can run code on your machine — read the SKILL.md first.
What it does
In the author's own words, from each skill's SKILL.md — showing the first 30 of 50 files.
-
ai-mcp-security
AI与MCP安全评估 — Prompt注入、工具滥用、MCP信任边界、Agent权限逃逸、数据泄露、模型风险、GAARM风险矩阵
vulnclaw/skills/specialized/ai-mcp-security/SKILL.md on GitHub (opens in a new tab) -
android-pentest
安卓应用渗透测试 — APK分析、Hook、自动化测试、运行态驱动、签名恢复、抓包分析
vulnclaw/skills/specialized/android-pentest/SKILL.md on GitHub (opens in a new tab) -
client-reverse
客户端逆向与Burp重放 — 复杂客户端签名恢复、加密还原、请求链追踪、稳定重放,适用于已授权安卓App渗透测试、浏览器JS签名、桌面客户端逆向
vulnclaw/skills/specialized/client-reverse/SKILL.md on GitHub (opens in a new tab) -
crypto-toolkit
编码解码与加解密工具 — base64/URL/Hex/HTML实体编码解码,MD5/SHA哈希,AES/DES/RSA加解密,JWT解析,Caesar/ROT13密码,栅栏/Vigenere密码,Unicode转义,Morse电码等
vulnclaw/skills/specialized/crypto-toolkit/SKILL.md on GitHub (opens in a new tab) -
ctf-crypto
CTF密码学攻击知识库 — RSA攻击(小指数/共模/Wiener/Coppersmith)、AES攻击(Padding Oracle/ECB字节翻转/GCM nonce重用)、ECC攻击、LFSR/LCG/PRNG攻击、古典密码、LWE格攻击
vulnclaw/skills/specialized/ctf-crypto/SKILL.md on GitHub (opens in a new tab) -
ctf-misc
CTF杂项知识库 — Python Jail逃逸、Bash Jail逃逸、编码链识别与解码、QR/音频/图像隐写、游戏VM逆向、CTFd API导航、Linux提权
vulnclaw/skills/specialized/ctf-misc/SKILL.md on GitHub (opens in a new tab) -
ctf-web
CTF Web攻击知识库 — PHP弱比较绕过、命令注入空格绕过、eval回显技巧、SSTI注入链、反序列化利用链、PHP代码审计checklist、常见flag位置
vulnclaw/skills/specialized/ctf-web/SKILL.md on GitHub (opens in a new tab) -
cve-triage
CVE lookup and triage — map discovered services/versions to known CVEs via the cve_lookup tool, score by CVSS/exploitability, and prioritize what to verify first.
vulnclaw/skills/specialized/cve-triage/SKILL.md on GitHub (opens in a new tab) -
hackerone
HackerOne bounty program scope-guard workflow — reads program scope, enforces scope and program rules, then hands each in-scope asset to pentest-flow
vulnclaw/skills/specialized/hackerone/SKILL.md on GitHub (opens in a new tab) -
intranet-pentest-advanced
内网渗透高级 — 横向移动、凭据窃取、提权、持久化、隧道代理、AD攻击、ADCS滥用、Exchange/SharePoint攻击
vulnclaw/skills/specialized/intranet-pentest-advanced/SKILL.md on GitHub (opens in a new tab) -
osint-recon
OSINT 开源情报收集知识库 — 四维信息收集模型(服务器→网站→域名→人员),维度四(人员信息)条件触发
vulnclaw/skills/specialized/osint-recon/SKILL.md on GitHub (opens in a new tab) -
pentest-tools
渗透工具速查 — 编码解码、反向Shell、红队工具、漏洞利用、密码攻击、内网工具、凭据窃取、提权、隧道代理、系统命令、信息收集、域渗透、Web工具、Windows工具
vulnclaw/skills/specialized/pentest-tools/SKILL.md on GitHub (opens in a new tab) -
rapid-checklist
渗透速查与Payload — 快速Payload家族、绕过提醒、验证顺序、常见测试卡片,适用于已知测试方向后快速查找
vulnclaw/skills/specialized/rapid-checklist/SKILL.md on GitHub (opens in a new tab) -
redteam-ad-detail-pack
Domain routing and boundary guidance for authorized Active Directory red-team security testing, including Kerberos attacks, domain privilege escalation, lateral movement, and GPO abuse. Use when a task belongs to the AD testing domain and needs scope, evidence, pivot, or exit criteria.
vulnclaw/skills/specialized/redteam-ad-detail-pack/SKILL.md on GitHub (opens in a new tab) -
redteam-api-detail-pack
Domain routing and boundary guidance for authorized API security testing, including BOLA/IDOR, authentication bypass, mass assignment, missing rate limits, and GraphQL issues. Use when a task belongs to the API testing domain and needs scope, evidence, pivot, or exit criteria.
vulnclaw/skills/specialized/redteam-api-detail-pack/SKILL.md on GitHub (opens in a new tab) -
redteam-auth-detail-pack
Domain routing and boundary guidance for authorized authentication, authorization, and session security testing, including password policy, JWT/token, OAuth, and MFA bypass issues. Use when a task belongs to the auth testing domain and needs scope, evidence, pivot, or exit criteria.
vulnclaw/skills/specialized/redteam-auth-detail-pack/SKILL.md on GitHub (opens in a new tab) -
redteam-cache-poison-detail-pack
Domain routing and boundary guidance for authorized web cache poisoning testing, including unkeyed headers, unkeyed parameters, cache deception, and CDN-specific behavior. Use when a task belongs to the cache poisoning domain and needs scope, evidence, pivot, or exit criteria.
vulnclaw/skills/specialized/redteam-cache-poison-detail-pack/SKILL.md on GitHub (opens in a new tab) -
redteam-clickjacking-detail-pack
Domain routing and boundary guidance for authorized clickjacking testing, including missing X-Frame-Options, CSP frame-ancestors bypasses, and drag-and-drop hijacking. Use when a task belongs to the clickjacking domain and needs scope, evidence, pivot, or exit criteria.
vulnclaw/skills/specialized/redteam-clickjacking-detail-pack/SKILL.md on GitHub (opens in a new tab) -
redteam-cloud-detail-pack
Domain routing and boundary guidance for authorized cloud security testing, including IAM misconfiguration, exposed storage, metadata services, and serverless injection. Use when a task belongs to the cloud testing domain and needs scope, evidence, pivot, or exit criteria.
vulnclaw/skills/specialized/redteam-cloud-detail-pack/SKILL.md on GitHub (opens in a new tab) -
redteam-cmdi-detail-pack
Domain routing and boundary guidance for authorized operating system command injection testing, including direct injection, blind injection, out-of-band callbacks, and argument injection. Use when a task belongs to the command injection domain and needs scope, evidence, pivot, or exit criteria.
vulnclaw/skills/specialized/redteam-cmdi-detail-pack/SKILL.md on GitHub (opens in a new tab) -
redteam-code-audit-detail-pack
Domain routing and boundary guidance for authorized source code security review, including dangerous function tracing, data-flow analysis, logic flaw detection, and dependency review. Use when a task belongs to the code audit domain and needs scope, evidence, pivot, or exit criteria.
vulnclaw/skills/specialized/redteam-code-audit-detail-pack/SKILL.md on GitHub (opens in a new tab) -
redteam-container-detail-pack
Domain routing and boundary guidance for authorized container and orchestration security testing, including Docker escape, Kubernetes privilege escalation, image vulnerabilities, and service mesh bypasses. Use when a task belongs to the container testing domain and needs scope, evidence, pivot, or exit criteria.
vulnclaw/skills/specialized/redteam-container-detail-pack/SKILL.md on GitHub (opens in a new tab) -
redteam-cors-miscfg-detail-pack
Domain routing and boundary guidance for authorized CORS misconfiguration testing, including reflected origins, null origins, subdomain trust, and credential exposure. Use when a task belongs to the CORS testing domain and needs scope, evidence, pivot, or exit criteria.
vulnclaw/skills/specialized/redteam-cors-miscfg-detail-pack/SKILL.md on GitHub (opens in a new tab) -
redteam-crypto-detail-pack
Domain routing and boundary guidance for authorized cryptography weakness testing, including weak algorithms, padding oracles, key management errors, insecure randomness, and hash collision risks. Use when a task belongs to the cryptography testing domain and needs scope, evidence, pivot, or exit criteria.
vulnclaw/skills/specialized/redteam-crypto-detail-pack/SKILL.md on GitHub (opens in a new tab) -
redteam-csrf-detail-pack
Domain routing and boundary guidance for authorized CSRF testing, including token bypasses, SameSite bypasses, and JSON CSRF. Use when a task belongs to the CSRF testing domain and needs scope, evidence, pivot, or exit criteria.
vulnclaw/skills/specialized/redteam-csrf-detail-pack/SKILL.md on GitHub (opens in a new tab) -
redteam-cve-lookup
CVE lookup and applicability assessment domain card. Use after reconnaissance has identified products, versions, services, or fingerprints and red-team mode needs evidence-based CVE matching before deeper testing.
vulnclaw/skills/specialized/redteam-cve-lookup/SKILL.md on GitHub (opens in a new tab) -
redteam-cve-validation
CVE validation domain card. Use after CVE lookup has produced applicable or candidate CVEs and red-team mode needs scoped evidence to decide whether to continue, pivot, or report.
vulnclaw/skills/specialized/redteam-cve-validation/SKILL.md on GitHub (opens in a new tab) -
redteam-deserialize-detail-pack
Domain routing and boundary guidance for authorized insecure deserialization testing, including Java, PHP, Python, .NET, and gadget-chain analysis. Use when a task belongs to the deserialization testing domain and needs scope, evidence, pivot, or exit criteria.
vulnclaw/skills/specialized/redteam-deserialize-detail-pack/SKILL.md on GitHub (opens in a new tab) -
redteam-evasion-detail-pack
Domain routing and boundary guidance for authorized defense evasion and bypass testing, including WAF bypass, AV/EDR evasion, logging considerations, and traffic obfuscation. Use when a task belongs to the evasion domain and needs scope, evidence, pivot, or exit criteria.
vulnclaw/skills/specialized/redteam-evasion-detail-pack/SKILL.md on GitHub (opens in a new tab) -
redteam-file-detail-pack
Domain routing and boundary guidance for authorized file operation vulnerability testing, including path traversal, arbitrary file read/write/upload, and LFI/RFI. Use when a task belongs to the file vulnerability domain and needs scope, evidence, pivot, or exit criteria.
vulnclaw/skills/specialized/redteam-file-detail-pack/SKILL.md on GitHub (opens in a new tab)
No skill matches that filter.
Review before you install
A skill is a set of instructions and scripts your agent will follow, and it can run code on your machine. Read the SKILL.md and any scripts first — this listing is not a security review.