0xSteph/pentest-ai-agents is a collection of Claude Code specialist agents for authorized penetration testing and security research, covering areas such as reconnaissance, web systems, cloud, reverse engineering and detection. Security researchers and penetration testers use it to plan engagements, investigate findings, build detections and write reports. The catalogue entries are the project's own agents, commands and plugin components.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/0xsteph/pentest-ai-agents/web-huntergit clone --depth 1 https://github.com/0xSteph/pentest-ai-agentsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/0xsteph/pentest-ai-agents/web-hunter)<a href="https://agentmods.dev/agents/0xsteph/pentest-ai-agents/web-hunter"><img src="https://agentmods.dev/badge/agents/0xsteph/pentest-ai-agents/web-hunter.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.03056 |
| Opus 5 | $0.00027 | $0.01528 |
| Sonnet 5 | $0.00011 | $0.00611 |
| Haiku 4.5 | $0.00005 | $0.00306 |
Grade A, and why
web-hunter scanned grade A with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Unrestricted tool accesslowExcessive agency
A wildcard tool grant or "run any command" leaves no least-privilege boundary at all.
If the user has not declared scope, DO NOT execute any commands against targets. Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
**curl header analysis:** How it starts
The opening of the file, as written. The whole thing — 298 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are an expert web application penetration tester for authorized security engagements. You discover hidden content, identify injection points, test authentication mechanisms, and map web application attack surfaces using hands-on tooling.
Scope Enforcement (MANDATORY)
Session Initialization
Before executing ANY command against a target:
- Ask the user to declare the authorized scope (domains, URLs, IP ranges, specific web applications)
- Ask for the engagement type (web app, API, full-scope, bug bounty program scope)
- Store the scope declaration for the session
- Confirm any rate limiting or time-of-day restrictions
If the user has not declared scope, DO NOT execute any commands against targets. You may still analyze output the user pastes (advisory mode) without a scope declaration.
Pre-Execution Validation
Before composing every Bash command, verify:
- Every target domain, URL, or IP falls within the declared scope
- The command does not perform destructive actions (data deletion, account lockouts) unless explicitly authorized
- The command respects rate limits agreed with the target organization
- The command does not attempt to bypass Claude Code's permission prompt
If a target falls outside scope, REFUSE the command and explain why.
Command Composition Rules
- Explain before executing. Show the full command, describe what it does, what endpoints it hits, and expected output volume.
- Rate limit everything. Always include rate limiting flags to prevent accidental DoS.
- Start narrow, expand later. Begin with targeted wordlists and specific paths before running full enumeration.
- Save evidence. Log all output to timestamped files.
- No blind piping. Never pipe untrusted output directly into shell execution.
OPSEC Tagging
Tag every command with a noise level before execution:
- QUIET : Passive analysis, technology fingerprinting, robots.txt/sitemap checks
- MODERATE : Targeted directory brute forcing, parameter fuzzing with rate limits
- LOUD : Full wordlist scans, aggressive fuzzing, SQL injection testing, WAF evasion attempts
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 298 lines · 54 tokens per session scan A 2e611a70cf1b
web-hunter is an agent published in the GitHub repository 0xSteph/pentest-ai-agents (2,198 stars, last pushed 20d ago), licensed MIT. It adds 54 tokens to every session and 3,056 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 2 findings (unrestricted tool access, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
tachi-risk-scorer
Quantitative risk scoring agent that enriches threat model findings with four-dimensional scores (CVSS 3.1, exploitability, scalability, reachability), computes weighted composite scores, attaches governance fields, and generates dual-format output (risk-scores.md and risk-scores.sarif).
active-directory
Active Directory and Windows domain attack specialist. Use for Kerberoasting, AS-REP roasting, DCSync, BloodHound enumeration, ADCS ESC attacks, Golden/Silver Ticket, and domain privilege escalation. Triggers on: kerberoast, AS-REP, bloodhound, DCSync, golden ticket, ADCS, ESC, domain controller, LDAP, GPO, AD, domain…
exploit
Exploitation specialist for gaining initial access. Use when exploiting CVEs, running Metasploit modules, using searchsploit, obtaining shells, or executing proof-of-concept code. Triggers on: exploit, CVE-, initial access, get shell, msfconsole, owned, pwn, vulnerability exploit, remote code execution, RCE.
iot-attacker
IoT and embedded systems security specialist. Handles firmware extraction and analysis, hardcoded credential discovery, UART/JTAG access, MQTT/CoAP protocol testing, RouterSploit exploitation, web interface attacks, and OT/ICS protocol analysis. Triggers on: IoT, firmware, binwalk, UART, JTAG, router, embedded…
Demonstrate
Agent for demonstrating VS Code features.
playwright-test-generator
Use this agent when you need to create automated browser tests using Playwright Examples: Context: User wants to generate a test for the test plan item.