Guide · Agent skill
How to use the component-vuln-intel agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
component-vuln-intel is an agent skill, a set of written instructions that an AI agent loads and follows, for the step right after it identifies a web framework, component or version during a test. It tells the agent to stop local scanning and run a fixed list of online searches for known vulnerabilities, public proof-of-concept code and internet-exposed hosts. This guide explains what the skill does, how to install it, how to trigger it and what it needs, with safety notes you should read before use.
Component Vulnerability IntelligenceAIPentest/CyberStrikeAI · Apache-2.0 Download the skill Quick start
- 1Download the ZIP. Get the component-vuln-intel skill ZIP from the item page on this directory.
- 2Install the skill. Unzip it into ~/.claude/skills/ for all projects, or into a project's .claude/skills/ folder, or upload the ZIP under Settings, Capabilities, Skills in the Claude apps.
- 3Install the prerequisites. Make sure Python 3 is on your command line and searchsploit from the Exploit-DB tools is installed, and that the agent has terminal and browser access.
- 4Confirm your authorization. Make sure you have written permission to assess the target before you start any research run.
- 5Make a natural request. Tell the agent the component name, the version you identified and that the work is authorized.
- 6Review the leads. Read the sources the agent returns and treat every result as a lead to verify.
- 7Verify and document. Check each lead against the official advisory and record which sources were checked, including negative results.
What does the component-vuln-intel skill make the agent do?
Once the agent identifies a framework, component or version, this skill requires it to research that component online before attempting anything else. The source describes a sequence of steps: query CVE vulnerability databases, run searches on Google, Baidu, Bing and DuckDuckGo, check Chinese security blogs and communities, search GitHub for proof-of-concept code, query internet asset search engines such as FOFA, Shodan, ZoomEye and Censys, and check social and news feeds.
The skill also covers dependency lists, so after searching a component the agent extracts its dependency manifests and repeats the checks for each dependency. If searches are blocked, it lists fallback tactics such as changing the user-agent, using a reader service, reading cached or archived pages, switching search engines and using a proxy. The skill states that every result is a lead to verify, not a confirmed fact.
- Searches CVE databases and advisory pages for the component and version
- Runs search engine queries and Chinese security community searches
- Searches GitHub repositories and code for proof-of-concept material
- Queries asset search engines for similar exposed systems
- Extracts dependency files and repeats the checks for each dependency
- Records a negative finding when all channels return no public vulnerability
How do you install the component-vuln-intel skill?
Download the skill ZIP from the item page on this directory. The skill is distributed as a folder containing a SKILL.md file. Unzip it into one of two places. For a personal setup, put it in your user skills folder at ~/.claude/skills/. For a single project, put it in that project's .claude/skills/ folder.
If you use the Claude apps instead of a local folder, you can upload the skill there. Open Settings, go to Capabilities, then choose Skills and upload the ZIP. Check that the skill appears in your list before you rely on it.
- Option A: unzip into ~/.claude/skills/ for all your projects
- Option B: unzip into the project's .claude/skills/ folder for one project only
- Option C: upload through Settings, Capabilities, Skills in the Claude apps
What do you need before the skill works?
The skill depends on several tools and permissions. Terminal access is needed for searchsploit and curl commands. Python 3 must be available on the command line because the skill uses it to parse JSON output. searchsploit, the Exploit-DB command line tools, must be installed. The agent also needs a browser navigation tool to open search and asset-engine pages.
The skill refers to two other skills, proxy-tool-bootstrap and zero-day-discovery. Those are not included in the files on this page, so the proxy fallback and the zero-day handoff will not work unless you have them separately. The skill also needs live internet access for nearly every step.
- Terminal access for searchsploit and curl
- Python 3 on the command line
- searchsploit (Exploit-DB tools) installed
- A browser navigation tool
- Internet access; the skill does not work offline
- Note: proxy-tool-bootstrap and zero-day-discovery are referenced but not included
searchsploit {C} {V}How do you trigger the skill with a natural request?
The skill is meant to load when the agent has identified a framework, component or version and needs to research it before any exploitation. Its own description says to use it when a component and version are identified and must be searched before an exploit. You do not need a special command. Describe the target and the goal in plain words, and make clear that the work is authorized.
A useful request names the component, the version you found and the purpose. For example, you might write that you found a specific version of a web framework during an authorized engagement and want the agent to search public vulnerabilities and proof-of-concept code for it. Include the scope so the agent knows what it may test.
- Name the component and the exact version you identified
- State that the engagement is authorized and say who owns the target
- Ask for documentation of what public sources say, if that is your goal
- Ask the agent to treat results as leads that need verification
What does a typical run look like?
After you give the request, the agent works through the sequence in order. It runs searchsploit with the component and version, queries a CVE API, opens GitHub advisory and CVE pages in the browser, and then runs several search engine queries. It then checks Chinese security sites, GitHub repositories and code, asset search engines and recent feeds.
The output is a list of leads with sources. The skill tells the agent to label these as tentative. Your job is to check each lead against the vendor advisory, the affected version range and the proof-of-concept code before you rely on it in a report.
- Expect many browser tabs and terminal calls, one per source
- Expect a list of CVE IDs, repository names and links
- Expect each result marked as a lead, not a confirmed fact
- Verify every lead against the official advisory before reporting it
What safety rules should you know before running it?
This skill runs scripts and uses the network. The terminal commands call external services, and the browser opens third-party sites. The skill's stated aim includes finding and using exploits against identified targets and finding internet-facing assets. That makes it a tool for authorized testing only. Use it only on systems you own or have written permission to assess.
The fallback steps include changing the user-agent, using a reader service, reading archived copies and using a proxy to retry blocked searches. Think about what data leaves your machine and which third-party services see your queries before you enable those steps. If every channel is blocked, the skill says to record a negative finding and hand off to the zero-day-discovery skill, which is not included here.
- Use only against systems you own or have written permission to test
- Expect outbound requests to CVE, search, GitHub and asset-engine services
- Review the fallback steps, which include third-party reader, cache and proxy services
- Treat results as leads and verify them before any action
- The zero-day handoff depends on a skill that is not included in these files
What tips help you get useful results?
Give the most exact component name and version you can. The searches are built from those two values, so a vague name returns noisy results. Keep a written log of every source you checked, including the ones that came back empty, because the skill is designed to document what public sources say.
Check the licence before reuse. The item is listed under Apache-2.0. Read the SKILL.md file yourself before installing so you know exactly what the agent will be told to do.
- Use the exact product name and version string
- Keep a log of sources checked, including empty results
- Read SKILL.md before installing
- Verify each lead against the official advisory
What people use it for
- Building a repeatable reconnaissance checklist for an authorized web application penetration test
- Documenting what public sources say about a specific component version for a client report
- Teaching students how public vulnerability research is gathered from CVE databases, advisories and community blogs
- Checking the dependency list of a project for known public vulnerabilities as part of an authorized review
Frequently asked questions
How do I install the component-vuln-intel skill?
Download the skill ZIP from the item page and unzip it into ~/.claude/skills/ for all your projects, or into a project's .claude/skills/ folder for one project. In the Claude apps you can instead upload the ZIP under Settings, Capabilities, Skills.
Is component-vuln-intel free?
The item is listed under the Apache-2.0 licence. This page does not state any price, so check the licence text in the repository before reusing or redistributing the skill.
What does the skill require to run?
It needs terminal access, Python 3 on the command line, searchsploit from the Exploit-DB tools, a browser navigation tool and live internet access. It also refers to two other skills, proxy-tool-bootstrap and zero-day-discovery, which are not included in the files.
Can I use component-vuln-intel for hacking systems I do not own?
No. The skill is for authorized penetration tests and red-team engagements. It aims at finding and using exploits against identified targets, so testing systems without written permission could be unauthorized intrusion.
Does component-vuln-intel work offline?
No. Nearly every step needs live internet access to query CVE databases, search engines, GitHub and asset search services.
What should I do when searches are blocked?
The skill lists a fallback sequence: change the user-agent, use a reader service, check cached or archived copies, switch search engines and, as a last option, use a proxy. If everything fails, it says to record a negative finding and hand off to the zero-day-discovery skill.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Choose this skill if you run authorized penetration tests or red-team work and want an agent to follow the same written reconnaissance checklist every time, including documenting what public sources say. Pick something else if you need a read-only research tool, offline work, or a tool that will not actively search for exploit code and exposed hosts.
Download the skill