# ShakerScan agent skills > ShakerScan documentation at v2.12.2. [Source](https://github.com/andriyze/shakerscan/blob/v2.12.2/skills/README.md) ยท [Web version](https://shakerscan.com/docs/open-source/skills) These skills give Codex, Claude Code, and other compatible coding agents concise, reusable ShakerScan workflows. The product-wide operating rules remain in [`AGENTS.md`](https://github.com/andriyze/shakerscan/blob/v2.12.2/AGENTS.md); skills add task-specific instructions without duplicating the full API. ## Recommended setup The hosted installer places the skills in `~/.shakerscan/skills`. Launch the agent from that runtime so it can read the repository instructions and skill files: ```bash shakerscan agent codex shakerscan agent claude shakerscan agent opencode shakerscan agent pi ``` From a source checkout, use the launcher there too. It sets the runtime URLs and planner identity for every agent and applies agent-specific setup (including Pi's explicit skills/templates): ```bash ./scanner.sh start ./scanner.sh agent # auto-detects codex, claude, opencode, then pi ``` For a VPS accessed over Tailscale, start with `./scanner.sh start --remote`. Remote mode may bind the API only to the Tailscale address, so use both URLs printed by `./scanner.sh status`, even for API calls executed on the VPS. `shakerscan agent ...` exports those URLs to its project commands and session hook automatically. ## Skill catalog | Skill | Use it for | | ---------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- | | [`shakerscan`](https://github.com/andriyze/shakerscan/blob/v2.12.2/skills/shakerscan/SKILL.md) | General scans, targets, findings, Continuous ASM, AI Gate, Model Intake, workers, schedules, evidence, and operation routing | | [`ai-security-session`](https://github.com/andriyze/shakerscan/blob/v2.12.2/skills/ai-security-session/SKILL.md) | Interactive Testing: browser exploration, auth workflows, endpoint replay, and BOLA/IDOR testing | | [`js-analyze`](https://github.com/andriyze/shakerscan/blob/v2.12.2/skills/js-analyze/SKILL.md) | Frontend routes, browser-captured APIs, libraries, source-map hints, and secret candidates | | [`content-discovery`](https://github.com/andriyze/shakerscan/blob/v2.12.2/skills/content-discovery/SKILL.md) | High-signal route/file seeds, `custom_list`, and `custom_endpoints` | | [`hunt`](https://github.com/andriyze/shakerscan/blob/v2.12.2/skills/hunt/SKILL.md) | Canonical target-kind-aware investigation with bounded semantic capabilities, evidence, and deterministic promotion | | [`research-agent`](https://github.com/andriyze/shakerscan/blob/v2.12.2/skills/research-agent/SKILL.md) | Compatibility entry point for older Deep Hunt wording; delegates to canonical Hunt | | [`device-hunt`](https://github.com/andriyze/shakerscan/blob/v2.12.2/skills/device-hunt/SKILL.md) | Compatibility entry point for older Device Hunt wording; delegates to canonical Hunt with a device target | | [`review-skills`](https://github.com/andriyze/shakerscan/blob/v2.12.2/skills/review-skills/SKILL.md) | Audit the skills, slash commands, and specialized agents | The [`web`](https://github.com/andriyze/shakerscan/blob/v2.12.2/skills/web/README.md) directory is the server-shipped Hunt methodology catalog: web-testing playbooks plus network discovery and TV, camera, router and native service investigation, with routing metadata and explicit execution gaps. It is not a skill to load wholesale. Start with the objective and retained evidence, receive compact suggestions, and read a relevant method when needed. Useful partial methods can be bound; reference guidance stays readable. Binding never changes the run's scope, capabilities or budgets. Missing executor and withheld-capability lists explain untested techniques without discarding the whole method or treating a skipped check as a finding or clean result. Each modern skill is a directory with: * `SKILL.md` for trigger metadata and operating instructions * `agents/openai.yaml` for skill-list metadata * optional `references/` containing detailed schemas loaded only when needed ## Optional global installation Agents launched by `shakerscan agent ...` can read these files in place. To make one skill available outside the ShakerScan runtime, copy its entire directory rather than a single Markdown file. Codex: ```bash mkdir -p ~/.codex/skills cp -R skills/shakerscan ~/.codex/skills/ ``` Claude Code: ```bash mkdir -p ~/.claude/skills cp -R skills/shakerscan ~/.claude/skills/ ``` Repeat for any specialized skills you want globally. ## Claude Code commands and agents Project-local Claude Code entry points live under `.claude/`: * Commands: canonical deterministic Scan, status, findings, workers, subdomains, AI Gate, Interactive Testing, manual findings, JS analysis, content discovery, Hunt, compatibility research, and skill review. * Specialized agents: JS analysis, content discovery, and skill-system review The commands delegate to the same skills and API safety rules. They are conveniences, not separate product implementations. ## Coverage and maintenance The general skill covers the full operator workflow by routing complex tasks to the appropriate specialized skill or current API reference. The exhaustive list of REST operations, UI pages, CLI commands, scanner modules, skills, slash commands, and agents is generated in [the public functionality reference](https://github.com/andriyze/shakerscan/blob/main/docs/functionality-reference.md). A source checkout also has it at `docs/functionality-reference.md`; the minimal hosted-install runtime does not include the full `docs/` tree. After changing a skill, command, agent, API, CLI, or UI surface: ```bash python3 scripts/generate_capability_inventory.py ``` Validate the shipped methodology integration from a source checkout with: ```bash python3 scripts/check_hunt_methodologies.py ``` Do not put credentials, target-specific secrets, benchmark answer keys, or unverified vulnerability claims in a skill.