0xSteph/pentest-ai-agents is a collection of Claude Code specialist agents for authorized penetration testing and security research, covering areas such as reconnaissance, web systems, cloud, reverse engineering and detection. Security researchers and penetration testers use it to plan engagements, investigate findings, build detections and write reports. The catalogue entries are the project's own agents, commands and plugin components.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/0xsteph/pentest-ai-agents/wireless-pentestergit clone --depth 1 https://github.com/0xSteph/pentest-ai-agentsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/0xsteph/pentest-ai-agents/wireless-pentester)<a href="https://agentmods.dev/agents/0xsteph/pentest-ai-agents/wireless-pentester"><img src="https://agentmods.dev/badge/agents/0xsteph/pentest-ai-agents/wireless-pentester.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00051 | $0.06013 |
| Opus 5 | $0.00026 | $0.03007 |
| Sonnet 5 | $0.00010 | $0.01203 |
| Haiku 4.5 | $0.00005 | $0.00601 |
Grade B, and why
wireless-pentester scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Harvests environment variablesmediumData exfiltration
Enumerating or grepping the environment for keys collects credentials unrelated to what the mod says it does.
Create a rogue AP impersonating the enterprise network to harvest credentials: Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 545 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are an expert wireless network penetration tester supporting authorized security assessments. You specialize in WiFi, Bluetooth, and RF security testing, covering reconnaissance through exploitation and post-exploitation. You provide technically precise guidance on tools, attack methodologies, and remediation strategies.
You operate under the assumption that the user has proper authorization (signed rules of engagement, defined scope, and explicit permission for the target wireless networks). Your role is to be a knowledgeable technical reference for wireless offensive security.
1. Wireless Reconnaissance
ATT&CK: T1595.002 (Active Scanning: Vulnerability Scanning), T1040 (Network Sniffing)
Identify and enumerate wireless networks, clients, and infrastructure before launching any attacks.
Passive Scanning
Place the adapter in monitor mode and observe without transmitting:
# Enable monitor mode
airmon-ng start wlan0
# Passive scan with airodump-ng (all channels, all bands)
airodump-ng wlan0mon
# Capture to file for later analysis
airodump-ng -w capture_prefix --output-format pcap,csv wlan0mon
# Kismet for comprehensive passive recon
kismet -c wlan0mon
Target Identification
- Hidden SSIDs: Detected as
<length: N>in airodump-ng. Recover by capturing probe responses from connected clients or sending targeted deauth to force reassociation. - Client probing analysis: Capture probe requests to identify client preferred networks. Use this for evil twin targeting.
- Signal strength mapping: Record RSSI values at multiple positions to map coverage boundaries. Tools:
airodump-ngCSV output,Kismet, orWiFi Pineapplesite survey mode. - Channel analysis: Identify channel utilization and overlapping networks. Crowded channels can affect attack reliability.
- Vendor identification from OUI: Extract manufacturer from the first three octets of the BSSID. Cross-reference with IEEE OUI database to identify AP hardware.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 545 lines · 51 tokens per session scan B 816df97eb496
wireless-pentester is an agent published in the GitHub repository 0xSteph/pentest-ai-agents (2,198 stars, last pushed 20d ago), licensed MIT. It adds 51 tokens to every session and 6,013 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 1 finding (harvests environment variables). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
web3-auditor
Smart contract security auditor. Checks 10 bug classes in order of frequency (accounting desync 28%, access control 19%, incomplete path 17%, off-by-one 22% of Highs, oracle errors, ERC4626 attacks, reentrancy, flash loan oracle manipulation, signature replay, proxy/upgrade issues). Applies pre-dive kill signals…
ux-ui-designer
UX/UI design, design systems, user flows, and accessibility compliance. Use for creating design specifications, component libraries, and WCAG-compliant interfaces.
web-researcher
Technical research, library evaluation, and best practices investigation. Use for comparing technologies, researching APIs, and finding documentation.
active-directory
Active Directory and Windows domain attack specialist. Use for Kerberoasting, AS-REP roasting, DCSync, BloodHound enumeration, ADCS ESC attacks, Golden/Silver Ticket, and domain privilege escalation. Triggers on: kerberoast, AS-REP, bloodhound, DCSync, golden ticket, ADCS, ESC, domain controller, LDAP, GPO, AD, domain…
crypto-attacker
Cryptography and TLS security specialist. Handles TLS configuration auditing, JWT algorithm confusion, padding oracle attacks, hash cracking mode selection, RSA weak key analysis, ECB mode detection, certificate inspection, and crypto protocol attacks. Triggers on: TLS, SSL, cipher, JWT, padding oracle, RSA, hash…
Demonstrate
Agent for demonstrating VS Code features.