Updated 1w ago
by Netw0rkNoob
VulnClaw
基于 AI Agent + MCP 工具链 + 渗透 Skill 编排, 配合大语言模型, 自然语言输入 → 自动完成「信息收集 → 漏洞发现 → 漏洞利用 → 报告生成」全流程。
3.9k GitHub stars (3,883)
+391 in 30 days
| Period | New stars |
|---|---|
| Oct 1 | +2 |
| Oct 2 | +3 |
| Oct 3 | +5 |
| Oct 4 | +2 |
| Oct 5 | +3 |
| Oct 6 | +3 |
| Oct 7 | +2 |
| Oct 8 | +6 |
| Oct 9 | +9 |
| Oct 10 | +9 |
| Oct 11 | +10 |
| Oct 12 | +7 |
| Oct 13 | +80 |
| Oct 14 | +51 |
| Oct 15 | +26 |
| Oct 16 | +24 |
| Oct 17 | +21 |
| Oct 18 | +2 |
| Oct 19 | +9 |
| Oct 20 | +8 |
| Oct 21 | +11 |
| Oct 22 | +2 |
| Oct 23 | +6 |
| Oct 24 | +12 |
| Oct 25 | +10 |
| Oct 26 | +4 |
| Oct 27 | +11 |
| Oct 28 | +7 |
| Oct 29 | +5 |
| Oct 30 | +10 |
| Oct 31 | +6 |
| Nov 1 | +6 |
| Nov 2 | +5 |
| Nov 3 | +7 |
| Nov 4 | +9 |
| Nov 5 | +12 |
| Nov 6 | +6 |
- 30 skills (30 skills found in its SKILL.md files)
- 542 forks (542 forks)
- 1w ago last update (Last updated 1w ago)
Install
Skills CLI
npx skills add Netw0rkNoob/VulnClaw
Asks which skills and agents to install. Just one: npx skills add Netw0rkNoob/VulnClaw --skill ai-mcp-security — add -g for every project.
Claude Code
git clone https://github.com/Netw0rkNoob/VulnClawcp -r "VulnClaw/vulnclaw/skills/specialized/ai-mcp-security" ~/.claude/skills/
Copies the ai-mcp-security skill into ~/.claude/skills/ for every project (use .claude/skills/ for one project). Repeat for the other skills listed below.
Plugin
/plugin marketplace add Netw0rkNoob/VulnClaw
Run inside Claude Code if the repository ships a plugin marketplace, then pick plugins from /plugin.
Skills can run code on your machine — read the SKILL.md first.
What it does
In the author's own words, from each skill's SKILL.md — showing the first 30 of 50 files.
-
ai-mcp-security
AI与MCP安全评估 — Prompt注入、工具滥用、MCP信任边界、Agent权限逃逸、数据泄露、模型风险、GAARM风险矩阵
vulnclaw/skills/ on GitHub (opens in a new tab)specialized/ ai-mcp-security/ SKILL.md -
android-pentest
安卓应用渗透测试 — APK分析、Hook、自动化测试、运行态驱动、签名恢复、抓包分析
vulnclaw/skills/ on GitHub (opens in a new tab)specialized/ android-pentest/ SKILL.md -
client-reverse
客户端逆向与Burp重放 — 复杂客户端签名恢复、加密还原、请求链追踪、稳定重放,适用于已授权安卓App渗透测试、浏览器JS签名、桌面客户端逆向
vulnclaw/skills/ on GitHub (opens in a new tab)specialized/ client-reverse/ SKILL.md -
crypto-toolkit
编码解码与加解密工具 — base64/URL/Hex/HTML实体编码解码,MD5/SHA哈希,AES/DES/RSA加解密,JWT解析,Caesar/ROT13密码,栅栏/Vigenere密码,Unicode转义,Morse电码等
vulnclaw/skills/ on GitHub (opens in a new tab)specialized/ crypto-toolkit/ SKILL.md -
ctf-crypto
CTF密码学攻击知识库 — RSA攻击(小指数/共模/Wiener/Coppersmith)、AES攻击(Padding Oracle/ECB字节翻转/GCM nonce重用)、ECC攻击、LFSR/LCG/PRNG攻击、古典密码、LWE格攻击
vulnclaw/skills/ on GitHub (opens in a new tab)specialized/ ctf-crypto/ SKILL.md -
ctf-misc
CTF杂项知识库 — Python Jail逃逸、Bash Jail逃逸、编码链识别与解码、QR/音频/图像隐写、游戏VM逆向、CTFd API导航、Linux提权
vulnclaw/skills/ on GitHub (opens in a new tab)specialized/ ctf-misc/ SKILL.md -
ctf-web
CTF Web攻击知识库 — PHP弱比较绕过、命令注入空格绕过、eval回显技巧、SSTI注入链、反序列化利用链、PHP代码审计checklist、常见flag位置
vulnclaw/skills/ on GitHub (opens in a new tab)specialized/ ctf-web/ SKILL.md -
cve-triage
CVE lookup and triage — map discovered services/versions to known CVEs via the cve_lookup tool, score by CVSS/exploitability, and prioritize what to verify first.
vulnclaw/skills/ on GitHub (opens in a new tab)specialized/ cve-triage/ SKILL.md -
hackerone
HackerOne bounty program scope-guard workflow — reads program scope, enforces scope and program rules, then hands each in-scope asset to pentest-flow
vulnclaw/skills/ on GitHub (opens in a new tab)specialized/ hackerone/ SKILL.md -
intranet-pentest-advanced
内网渗透高级 — 横向移动、凭据窃取、提权、持久化、隧道代理、AD攻击、ADCS滥用、Exchange/SharePoint攻击
vulnclaw/skills/ on GitHub (opens in a new tab)specialized/ intranet-pentest-advanced/ SKILL.md -
osint-recon
OSINT 开源情报收集知识库 — 四维信息收集模型(服务器→网站→域名→人员),维度四(人员信息)条件触发
vulnclaw/skills/ on GitHub (opens in a new tab)specialized/ osint-recon/ SKILL.md -
pentest-tools
渗透工具速查 — 编码解码、反向Shell、红队工具、漏洞利用、密码攻击、内网工具、凭据窃取、提权、隧道代理、系统命令、信息收集、域渗透、Web工具、Windows工具
vulnclaw/skills/ on GitHub (opens in a new tab)specialized/ pentest-tools/ SKILL.md -
rapid-checklist
渗透速查与Payload — 快速Payload家族、绕过提醒、验证顺序、常见测试卡片,适用于已知测试方向后快速查找
vulnclaw/skills/ on GitHub (opens in a new tab)specialized/ rapid-checklist/ SKILL.md -
redteam-ad-detail-pack
Domain routing and boundary guidance for authorized Active Directory red-team security testing, including Kerberos attacks, domain privilege escalation, lateral movement, and GPO abuse. Use when a task belongs to the AD testing domain and needs scope, evidence, pivot, or exit criteria.
vulnclaw/skills/ on GitHub (opens in a new tab)specialized/ redteam-ad-detail-pack/ SKILL.md -
redteam-api-detail-pack
Domain routing and boundary guidance for authorized API security testing, including BOLA/IDOR, authentication bypass, mass assignment, missing rate limits, and GraphQL issues. Use when a task belongs to the API testing domain and needs scope, evidence, pivot, or exit criteria.
vulnclaw/skills/ on GitHub (opens in a new tab)specialized/ redteam-api-detail-pack/ SKILL.md -
redteam-auth-detail-pack
Domain routing and boundary guidance for authorized authentication, authorization, and session security testing, including password policy, JWT/token, OAuth, and MFA bypass issues. Use when a task belongs to the auth testing domain and needs scope, evidence, pivot, or exit criteria.
vulnclaw/skills/ on GitHub (opens in a new tab)specialized/ redteam-auth-detail-pack/ SKILL.md -
redteam-cache-poison-detail-pack
Domain routing and boundary guidance for authorized web cache poisoning testing, including unkeyed headers, unkeyed parameters, cache deception, and CDN-specific behavior. Use when a task belongs to the cache poisoning domain and needs scope, evidence, pivot, or exit criteria.
vulnclaw/skills/ on GitHub (opens in a new tab)specialized/ redteam-cache-poison-detail-pack/ SKILL.md -
redteam-clickjacking-detail-pack
Domain routing and boundary guidance for authorized clickjacking testing, including missing X-Frame-Options, CSP frame-ancestors bypasses, and drag-and-drop hijacking. Use when a task belongs to the clickjacking domain and needs scope, evidence, pivot, or exit criteria.
vulnclaw/skills/ on GitHub (opens in a new tab)specialized/ redteam-clickjacking-detail-pack/ SKILL.md -
redteam-cloud-detail-pack
Domain routing and boundary guidance for authorized cloud security testing, including IAM misconfiguration, exposed storage, metadata services, and serverless injection. Use when a task belongs to the cloud testing domain and needs scope, evidence, pivot, or exit criteria.
vulnclaw/skills/ on GitHub (opens in a new tab)specialized/ redteam-cloud-detail-pack/ SKILL.md -
redteam-cmdi-detail-pack
Domain routing and boundary guidance for authorized operating system command injection testing, including direct injection, blind injection, out-of-band callbacks, and argument injection. Use when a task belongs to the command injection domain and needs scope, evidence, pivot, or exit criteria.
vulnclaw/skills/ on GitHub (opens in a new tab)specialized/ redteam-cmdi-detail-pack/ SKILL.md -
redteam-code-audit-detail-pack
Domain routing and boundary guidance for authorized source code security review, including dangerous function tracing, data-flow analysis, logic flaw detection, and dependency review. Use when a task belongs to the code audit domain and needs scope, evidence, pivot, or exit criteria.
vulnclaw/skills/ on GitHub (opens in a new tab)specialized/ redteam-code-audit-detail-pack/ SKILL.md -
redteam-container-detail-pack
Domain routing and boundary guidance for authorized container and orchestration security testing, including Docker escape, Kubernetes privilege escalation, image vulnerabilities, and service mesh bypasses. Use when a task belongs to the container testing domain and needs scope, evidence, pivot, or exit criteria.
vulnclaw/skills/ on GitHub (opens in a new tab)specialized/ redteam-container-detail-pack/ SKILL.md -
redteam-cors-miscfg-detail-pack
Domain routing and boundary guidance for authorized CORS misconfiguration testing, including reflected origins, null origins, subdomain trust, and credential exposure. Use when a task belongs to the CORS testing domain and needs scope, evidence, pivot, or exit criteria.
vulnclaw/skills/ on GitHub (opens in a new tab)specialized/ redteam-cors-miscfg-detail-pack/ SKILL.md -
redteam-crypto-detail-pack
Domain routing and boundary guidance for authorized cryptography weakness testing, including weak algorithms, padding oracles, key management errors, insecure randomness, and hash collision risks. Use when a task belongs to the cryptography testing domain and needs scope, evidence, pivot, or exit criteria.
vulnclaw/skills/ on GitHub (opens in a new tab)specialized/ redteam-crypto-detail-pack/ SKILL.md -
redteam-csrf-detail-pack
Domain routing and boundary guidance for authorized CSRF testing, including token bypasses, SameSite bypasses, and JSON CSRF. Use when a task belongs to the CSRF testing domain and needs scope, evidence, pivot, or exit criteria.
vulnclaw/skills/ on GitHub (opens in a new tab)specialized/ redteam-csrf-detail-pack/ SKILL.md -
redteam-cve-lookup
CVE lookup and applicability assessment domain card. Use after reconnaissance has identified products, versions, services, or fingerprints and red-team mode needs evidence-based CVE matching before deeper testing.
vulnclaw/skills/ on GitHub (opens in a new tab)specialized/ redteam-cve-lookup/ SKILL.md -
redteam-cve-validation
CVE validation domain card. Use after CVE lookup has produced applicable or candidate CVEs and red-team mode needs scoped evidence to decide whether to continue, pivot, or report.
vulnclaw/skills/ on GitHub (opens in a new tab)specialized/ redteam-cve-validation/ SKILL.md -
redteam-deserialize-detail-pack
Domain routing and boundary guidance for authorized insecure deserialization testing, including Java, PHP, Python, .NET, and gadget-chain analysis. Use when a task belongs to the deserialization testing domain and needs scope, evidence, pivot, or exit criteria.
vulnclaw/skills/ on GitHub (opens in a new tab)specialized/ redteam-deserialize-detail-pack/ SKILL.md -
redteam-evasion-detail-pack
Domain routing and boundary guidance for authorized defense evasion and bypass testing, including WAF bypass, AV/EDR evasion, logging considerations, and traffic obfuscation. Use when a task belongs to the evasion domain and needs scope, evidence, pivot, or exit criteria.
vulnclaw/skills/ on GitHub (opens in a new tab)specialized/ redteam-evasion-detail-pack/ SKILL.md -
redteam-file-detail-pack
Domain routing and boundary guidance for authorized file operation vulnerability testing, including path traversal, arbitrary file read/write/upload, and LFI/RFI. Use when a task belongs to the file vulnerability domain and needs scope, evidence, pivot, or exit criteria.
vulnclaw/skills/ on GitHub (opens in a new tab)specialized/ redteam-file-detail-pack/ SKILL.md
No skill matches that filter.
Review before you install
A skill is a set of instructions and scripts your agent will follow, and it can run code on your machine. Read the SKILL.md and any scripts first — this listing is not a security review.