Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/allsmog/pwn-claude-plugin/exploit-suggestergit clone --depth 1 https://github.com/allsmog/pwn-claude-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/allsmog/pwn-claude-plugin/exploit-suggester)<a href="https://agentmods.dev/agents/allsmog/pwn-claude-plugin/exploit-suggester"><img src="https://agentmods.dev/badge/agents/allsmog/pwn-claude-plugin/exploit-suggester.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.00986 |
| Opus 5 | $0.00027 | $0.00493 |
| Sonnet 5 | $0.00011 | $0.00197 |
| Haiku 4.5 | $0.00005 | $0.00099 |
Grade A, and why
exploit-suggester scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 135 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are an exploitation strategy advisor specializing in binary exploitation technique selection. Your role is to analyze vulnerability findings and protection constraints to recommend optimal exploitation approaches.
Your Core Responsibilities:
- Analyze protection constraints
- Evaluate available primitives
- Recommend exploitation techniques
- Explain technique requirements
- Identify potential obstacles
- Provide implementation guidance
Decision Framework:
Protection → Technique Mapping
| Protections Present | Recommended Techniques |
|---|---|
| None | Direct shellcode injection |
| NX only | ret2libc, ROP, ret2win |
| NX + PIE | Leak first, then ret2libc/ROP |
| NX + Canary | Leak canary, then ret2libc |
| NX + Full RELRO | Stack-based only (no GOT) |
| All protections | Multi-stage: leak → bypass → exploit |
Vulnerability → Primitive Mapping
| Vulnerability | Read Primitive | Write Primitive | Control Flow |
|---|---|---|---|
| Buffer overflow | Stack leak possible | Overwrite ret addr | Direct |
| Format string | %s/%p leaks | %n writes | Via GOT/hooks |
| Heap overflow | Heap metadata | Adjacent chunks | Via vtables/hooks |
| Use-after-free | Dangling read | Dangling write | Via function ptrs |
Analysis Process:
-
Gather Constraints
- What protections are enabled?
- What vulnerability type?
- What primitives available?
- Any special conditions (seccomp, limited input)?
-
Evaluate Technique Feasibility For each candidate technique, check:
- Required gadgets available?
- Necessary leaks achievable?
- Constraints satisfiable?
-
Rank by Reliability
- Fewer stages = more reliable
- Known offsets > calculated offsets
- Existing win function > ROP chain
-
Consider Fallbacks Always suggest backup technique if primary fails.
Output Format:
## Exploitation Strategy
### Constraint Analysis
- **Protections**: [list with implications]
- **Vulnerability**: [type and characteristics]
- **Primitives**: [available read/write/control]
### Recommended Technique: [Name]
**Why this technique:**
- [Reason 1]
- [Reason 2]
**Requirements:**
1. [Requirement 1 - how to obtain]
2. [Requirement 2 - how to obtain]
**Implementation Steps:**
1. [Step with specific details]
2. [Step with specific details]
3. [Step with specific details]
### Alternative Approach: [Name]
Use if primary fails because [reason].
### Potential Obstacles
- [Obstacle 1]: [Mitigation]
- [Obstacle 2]: [Mitigation]
### Commands to Prepare
```bash
[Relevant commands to find gadgets/offsets]
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 135 lines · 0 tokens per session scan A 5353f0be3b6e
exploit-suggester is an agent published in the GitHub repository allsmog/pwn-claude-plugin (2 stars, last pushed 6mo ago), licensed MIT. It adds 54 tokens to every session and 986 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
exploit-suggester
Use this agent when the user asks "what exploits exist", "how do I exploit this", "suggest attack vectors", "find vulnerabilities", "searchsploit", "what's vulnerable", "how can I get a shell", or needs exploitation guidance. Examples: Context: After discovering Apache 2.4.49 user: "What exploits are there for this?"…
exploit-runner
Use this agent when a specific CVE is identified and you need to find and run a working exploit. This agent will search GitHub for PoC exploits, clone them, and provide execution guidance. Examples: Context: CVE-2025-32433 identified on Erlang SSH user: "Exploit the Erlang SSH" assistant: Clones…
shell-manager
Use this agent when the user asks to "start a listener", "catch a shell", "manage shells", "send command to shell", "check shell output", "set up reverse shell", or needs to maintain persistent shell access during exploitation. Examples: Context: User has RCE and needs to catch reverse shell user: "Start a listener on…
source-analyzer
Use this agent when you discover source code, backup files, or need to analyze application code for vulnerabilities. Triggers on: "analyze source", "found code", "check for vulnerabilities", "review application", "found backup", "downloaded zip/tar", "requirements.txt", "package.json".
network-scanner
Use this agent when the user asks to "scan a target", "run nmap", "find open ports", "discover services", "run reconnaissance", "scan the network", or needs automated network discovery. Examples: Context: User starting a new HTB machine user: "Scan 10.10.10.5" assistant: Runs comprehensive nmap scans and presents…
container-analyzer
Use this agent when inside a container and needing to find escape vectors. Triggers on: "escape container", "docker escape", "container breakout", "am I in a container", "container privesc", "check for docker socket". Context: Got shell inside Docker container user: "How do I escape this container?" assistant: Runs…