VulnClaw is an AI-driven command-line penetration-testing agent that turns natural-language instructions into an automated workflow for reconnaissance, vulnerability discovery, exploitation, and report generation. It is intended for authorized penetration tests, CTF competitions, security teaching, and red-team exercises, using LLMs and MCP tools. The catalogue contains its specialized skills for security-testing tasks.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Netw0rkNoob/VulnClaw --skill hackeronegit clone --depth 1 https://github.com/Netw0rkNoob/VulnClawWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/netw0rknoob/vulnclaw/hackerone)<a href="https://agentmods.dev/skills/netw0rknoob/vulnclaw/hackerone"><img src="https://agentmods.dev/badge/skills/netw0rknoob/vulnclaw/hackerone/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/netw0rknoob/vulnclaw/hackerone"><img src="https://agentmods.dev/badge/skills/netw0rknoob/vulnclaw/hackerone.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.01864 |
| Opus 5.5 | $0.00014 | $0.00746 |
| Sonnet 5.5 | $0.00007 | $0.00373 |
| Haiku 4.5 | $0.00004 | $0.00186 |
Grade A, and why
hackerone scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 160 lines — stays where its author put it; the contents beside it link to each section on GitHub.
HackerOne Bounty Scope-Guard Skill
You are executing a HackerOne bug bounty workflow. This Skill is a
scope-guard wrapper: first parse and enforce the program scope and program
rules, then hand each in-scope asset to pentest-flow for the actual
security testing. Never touch an out-of-scope asset at any stage.
The launch argument is a HackerOne program link (<SCOPE LINK>), for example
hackerone.com/<handle> or .../policy_scopes. This Skill has no preset scan
target (requires_target: false in frontmatter); targets are discovered from
the program scope.
Startup and output contract
- Do not load or print the reference document during startup. It contains report-template material and examples; load it only when preparing a report or when parsing an ambiguous scope requires it.
- Resolve the supplied program link or obtain a pasted scope before claiming that scope is defined. Never treat example assets in this Skill or its references as observed program scope.
- Once scope is confirmed, keep the status concise:
Scope defined: <count> in-scope, <count> out-of-scope. Starting recon on <asset>. - Automatically begin recon on the first confirmed
URLorWILDCARDasset after you have printed that status in the same workflow that loaded scope. Do not pause for an asset-selection question unless scope is ambiguous, contains no directly supported assets, or the user explicitly asks to choose. - Mid-session user check-ins (e.g. "ready to begin?", "are we ready?") are not a green light by themselves: answer with scope summary, intended first asset, and any blockers first. Start or resume recon tools only after an explicit go-ahead or a clear recon/pentest command.
- Do not print raw HTML, full reference text, or raw tool output. If scope cannot be loaded, ask the user to paste the Scope tab and stop before testing.
- Never treat
hackerone.comas the recon/pentest target. The program link is only a discovery seed. Do not runjs_recon,dir_enum,subdomain_enum, or attack tooling against HackerOne itself.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +47 lines · -7 tokens per session 7e0d92757114
- 1mo ago First seen · 113 lines · 43 tokens per session scan A 6d89f7bb4313
hackerone is a skill published in the GitHub repository Netw0rkNoob/VulnClaw (3,785 stars, last pushed 12d ago), licensed MIT. It adds 36 tokens to every session and 1,864 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
seshat
Use Seshat MCP tools BEFORE writing or modifying any code. Triggers on: implementing features, fixing bugs, refactoring, modifying functions, creating files, editing files, choosing patterns, adding dependencies, building components, making any change to the codebase.
minecraft-async
Manage a preinstalled local Minecraft Java client asynchronously for CTF and automation workflows. Use when an agent needs to launch Minecraft in offline mode with alternate usernames, inspect Minecraft logs, focus or type into the X11 game window, send chat or slash commands quickly, or join a multiplayer server by…
sagemath
Run SageMath through an explicit override, a detected environment named sage, or a PATH-resolved command. Use for CTF and cryptography work involving asymmetric cryptography, finite fields, elliptic curves, lattices, polynomial algebra, modular arithmetic, discrete logs, small-root attacks, or PRNG cryptanalysis.
opencrow-crypto-toolbox
Use the best available portable Python runtime and installed crypto tooling for CTF tasks that fit normal Python or CLI cracking rather than SageMath. Prefer a detected ctf environment. Use when an agent needs z3, fpylll, pycryptodome, hashcat, john, or quick FactorDB lookups.
opencrow-reversing-toolbox
Use the best available portable Python runtime and installed reverse-engineering tooling for binary analysis, symbolic execution, disassembly, emulation, and binary patching. Prefer a detected ctf environment. Use when an agent needs angr, claripy, capstone, unicorn, ghidra-headless, radare2, objdump, strace, ltrace…
ssh-async
Maintain persistent asynchronous SSH sessions with bidirectional input/output across multiple commands. Use when an agent must keep an SSH shell open, send commands incrementally, inspect prompts or streamed output, reuse one authenticated connection for a task, or safely start/stop a long-lived remote session for…