A penetration testing plugin that gives Claude Code skills for authentication testing, application security checks, CVE vulnerability testing and domain reconnaissance. Built for security testers who want Claude to run offensive assessments.
@stickman230Authentication testing skill - automates signup, login, 2FA bypass, CAPTCHA solving, and bot detection evasion using Playwright…
@stickman230Application security testing coordinator for common vulnerability patterns including XSS, injection flaws, and client-side…
@stickman230CVE vulnerability testing coordinator that identifies technology stacks, researches known vulnerabilities, and tests applications…
@stickman230Domain reconnaissance coordinator that orchestrates subdomain discovery and port scanning to build comprehensive domain attack…
@stickman230MKS (Metasploit-Kali Server) tool preference guide. Mount in Phase 0/1 alongside the primary skill. Provides URL resolution, REST…
@stickman230Penetration testing orchestrator that coordinates specialized attack agents. Provides attack indexes, methodology frameworks, and…
@stickman230Comprehensive web application reconnaissance and mapping coordinator that orchestrates passive browsing, active endpoint…
@stickman230Inspects Content Security Policy headers for policy weaknesses and tests bypass vectors including unsafe-inline, unsafe-eval,…
@stickman230Tests for CSRF vulnerabilities including missing tokens, weak validation, SameSite bypass, token reuse, and method override.…
@stickman230Identifies technology stacks, researches known CVEs in NVD/Exploit-DB/GitHub, adapts public PoC exploits, and validates…
@stickman230Performs comprehensive domain reconnaissance including passive and active subdomain discovery (subfinder, amass, certificate…
@stickman230Tests for SQL injection, NoSQL injection, and OS command injection across HTTP parameters, JSON bodies, and headers. Uses sqlmap…
@stickman230Discovers REST API endpoints, GraphQL schemas, SOAP/WSDL services, WebSocket connections, and API documentation…
@stickman230Runs active directory and file brute-forcing using ffuf, gobuster, feroxbuster, nikto, and dirsearch to discover directories,…
@stickman230Discovers JavaScript-rendered pages, SPA client-side routes, dynamically-loaded scripts, AJAX-triggered endpoints, and hidden…
@stickman230Identifies and catalogs all dependencies, frameworks, libraries, and versions across backend and frontend stacks. Generates a…
@stickman230Synthesizes outputs from all four mapping agents (software-catalog, directory-scanner, api-discovery, javascript-mapper) into a…
@stickman230On-demand PayloadsAllTheThings fetcher. Use when a pentest agent needs full payloads not in local payloads/ files. Input: PATT…
@stickman230Executes specific vulnerability tests. Follows 4-phase workflow (Recon → Experiment → Test → Verify), generates PoCs, captures…
@stickman230Activate pentest mode — displays ASCII art, configures session isolation, collects engagement scope, then OWNS the engagement:…
@stickman230Define the attack profile for an engagement — select which attack categories and skills to use. Saves to .pentest-attacks.json.…
@stickman230Close pentest session — summarizes findings, ensures outputs are saved, lifts isolation, and prompts for /clear
@stickman230Connect to a Metasploit-Kali Server (MKS) REST API — verifies connectivity, discovers available Kali tools, and configures agents…
@stickman230Define or update engagement scope — saves scope to disk without launching a pentest. Can be run before or during an engagement.…
@stickman230Is this you? Claim your profilePut a plugin at the top of Plugins, from $9
