ShakerScan agent skills

These skills give Codex, Claude Code, and other compatible coding agents concise, reusable ShakerScan workflows. The product-wide operating rules remain in AGENTS.md; skills add task-specific instructions without duplicating the full API.

Recommended setup

The hosted installer places the skills in ~/.shakerscan/skills. Launch the agent from that runtime so it can read the repository instructions and skill files:

shakerscan agent codex
shakerscan agent claude
shakerscan agent opencode

From a source checkout:

./scanner.sh start
codex   # or claude, or opencode

For a VPS accessed over Tailscale, start with ./scanner.sh start --remote. Remote mode may bind the API only to the Tailscale address, so use both URLs printed by ./scanner.sh status, even for API calls executed on the VPS. shakerscan agent ... exports those URLs to its project commands and session hook automatically.

Skill catalog

Skill	Use it for
`shakerscan`	General scans, targets, findings, Continuous ASM, AI Gate, Model Intake, workers, schedules, evidence, and operation routing
`ai-security-session`	Interactive Testing: browser exploration, auth workflows, endpoint replay, and BOLA/IDOR testing
`js-analyze`	Frontend routes, browser-captured APIs, libraries, source-map hints, and secret candidates
`content-discovery`	High-signal route/file seeds, `custom_list`, and `custom_endpoints`
`hunt`	Canonical target-kind-aware investigation with bounded semantic capabilities, evidence, and deterministic promotion
`research-agent`	Compatibility entry point for older Deep Hunt wording; delegates to canonical Hunt
`device-hunt`	Compatibility entry point for older Device Hunt wording; delegates to canonical Hunt with a device target
`review-skills`	Audit the skills, slash commands, and specialized agents

The web directory is the server-shipped Hunt methodology catalog: web-testing playbooks plus native service/device investigation, with routing metadata and explicit execution gaps. It is not a skill to load wholesale. Start with the objective and retained evidence, receive compact suggestions, and read a relevant method when needed. Useful partial methods can be bound; reference guidance stays readable. Binding never changes the run's scope, capabilities or budgets. Missing executor and withheld-capability lists explain untested techniques without discarding the whole method or treating a skipped check as a finding or clean result.

Each modern skill is a directory with:

SKILL.md for trigger metadata and operating instructions
agents/openai.yaml for skill-list metadata
optional references/ containing detailed schemas loaded only when needed

Optional global installation

Agents launched by shakerscan agent ... can read these files in place. To make one skill available outside the ShakerScan runtime, copy its entire directory rather than a single Markdown file.

Codex:

mkdir -p ~/.codex/skills
cp -R skills/shakerscan ~/.codex/skills/

Claude Code:

mkdir -p ~/.claude/skills
cp -R skills/shakerscan ~/.claude/skills/

Repeat for any specialized skills you want globally.

Claude Code commands and agents

Project-local Claude Code entry points live under .claude/:

Commands: canonical deterministic Scan, status, findings, workers, subdomains, AI Gate, Interactive Testing, manual findings, JS analysis, content discovery, Hunt, compatibility research, and skill review.
Specialized agents: JS analysis, content discovery, and skill-system review

The commands delegate to the same skills and API safety rules. They are conveniences, not separate product implementations.

Coverage and maintenance

The general skill covers the full operator workflow by routing complex tasks to the appropriate specialized skill or current API reference. The exhaustive list of REST operations, UI pages, CLI commands, scanner modules, skills, slash commands, and agents is generated in the public functionality reference. A source checkout also has it at docs/functionality-reference.md; the minimal hosted-install runtime does not include the full docs/ tree.

After changing a skill, command, agent, API, CLI, or UI surface:

python3 scripts/generate_capability_inventory.py

Validate the shipped methodology integration from a source checkout with:

python3 scripts/check_hunt_methodologies.py

Do not put credentials, target-specific secrets, benchmark answer keys, or unverified vulnerability claims in a skill.

This page is rendered from skills/README.md in the open-source repository at v2.5.4. When documentation and implementation disagree, the code, database schema, and tests at that tag are authoritative.