Guide · Agent skill
How to use the CyberStrike Eino Demo Skill agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The CyberStrike Eino Demo Skill (skill name cyberstrike-eino-demo) is a sample agent skill package from the CyberStrike project. It shows how a skill folder can hold a SKILL.md instruction file alongside optional scripts, references and assets, and it gives an agent a structured checklist for authorized security testing. This guide explains what it does, how to install and trigger it, what it needs, and where its limits are, so you can decide whether it fits your work.
CyberStrike Eino Demo SkillAIPentest/CyberStrikeAI · Apache-2.0 Download the skill Quick start
- 1Download the ZIP. Get the cyberstrike-eino-demo ZIP from the page where you found this guide.
- 2Unzip the package. Extract the folder so that SKILL.md sits inside a cyberstrike-eino-demo directory.
- 3Place it in a skills folder. Move the folder to ~/.claude/skills/ for personal use or to .claude/skills/ inside a project.
- 4Or upload it in the Claude apps. Go to Settings → Capabilities → Skills and upload the package there.
- 5Make a request that matches the skill. Ask for an authorized testing checklist, workflow or report structure, and state your scope.
- 6Review before running scripts. Read scripts/check-env.sh first; run it manually in a bash shell only if you need to.
What is an agent skill, and what does this one do?
An agent skill is a folder that an AI agent can load when a task matches the skill's description. The core file is SKILL.md, which starts with a short metadata header (name and description) and then holds the instructions. Other files in the folder can be read on demand.
When this skill is active, the agent gets a workflow for authorized penetration testing: confirm scope, record a baseline, test by vulnerability category, collect evidence and reports, then clean up. The skill also lists sample payloads, which are labeled as teaching placeholders, and recommended tools such as Burp Suite and ffuf.
- Scope and written authorization checks before any testing
- Five-stage workflow: scope, baseline, testing, evidence and reporting, cleanup
- Placeholder payload examples for SQL injection, XSS and path traversal probes
- A tool list covering proxies, scanners and report templates
Install the skill from the ZIP download
Download the cyberstrike-eino-demo ZIP from the page where you found this guide. Unzip it so that the folder containing SKILL.md ends up in one of these locations:
For a personal install, place it in ~/.claude/skills/. For a single project, place it in the project's .claude/skills/ folder. Alternatively, in the Claude apps you can upload the package under Settings → Capabilities → Skills.
- Personal: ~/.claude/skills/cyberstrike-eino-demo/
- Project: .claude/skills/cyberstrike-eino-demo/ inside your project
- Claude apps: Settings → Capabilities → Skills, then upload the package
~/.claude/skills/cyberstrike-eino-demo/SKILL.mdTrigger the skill with natural requests
You do not need a special command. Ask for something that matches the skill's description: a checklist for an authorized engagement, the steps for reviewing a scope, or how to structure evidence for a report. The agent decides whether to load the skill based on that description.
Be explicit that the work is authorized. The skill's own text requires written permission, and a request that states the scope and time window will get a more useful answer than a vague one.
- "Using the cyberstrike-eino-demo skill, give me the authorized testing workflow for a web app with a scope of app.example.com."
- "Make a pre-engagement checklist for an authorized API test, including what to record as a baseline."
- "Show me the report template structure for findings from an authorized test."
- "List the recommended tools for proxying and replaying requests during an authorized assessment."
What the skill needs to run
The skill itself is text and reference files. The source says it needs a CyberStrike server or an Eino-based agent runtime to load the package. If you run scripts/check-env.sh by hand, you need a bash shell.
The package runs scripts and does not use the network, according to its listing. The bundled script only prints information. It does not perform security checks.
- A CyberStrike server or an Eino-based agent runtime to load the package
- A bash shell, only if you run scripts/check-env.sh manually
- No network access is required by the package
bash scripts/check-env.shKnow the files and their safety limits
The package includes SKILL.md, FORMS.md, REFERENCE.md, references/citations.md, assets/README.txt, scripts/check-env.sh, scripts/payloads.txt and scripts/report-snippet.json. FORMS.md and REFERENCE.md hold supporting detail, while the references and assets folders are used to check that non-script subfolders load correctly.
Treat the payload examples with care. The source labels them as teaching placeholders that must be replaced with real context and must not be used on systems without authorization. The payload list also includes an SSRF probe that the file says is only valid if scope explicitly allows loopback. Read scripts before running anything, and only run them in environments you control.
- Payloads are placeholders for authorized labs only; do not aim them at systems you have no written permission to test
- Review scripts/check-env.sh before running it
- The package is a demo, not an automated scanner
Tips for getting value from it
Use the skill as a checklist and reference, not as an automated tester. Its main value for many teams is in the structure: a clear workflow, a place to record scope, and a report snippet template. If you are building your own skills, it is also a working example of a multi-file folder layout.
Keep the written authorization and test window saved alongside your notes, since the workflow's first step and final checklist both depend on them.
- Use it as a pre-engagement and reporting checklist
- Copy the folder layout when you build your own skill package
- Pair the recommended tools list with your own approved test plan
What people use it for
- Building a pre-engagement checklist for an authorized web application test
- Structuring evidence and remediation notes for a security report
- Testing how a multi-file skill folder is indexed and loaded in CyberStrike or an Eino-based agent
- Using the recommended tools list as a starting point for an approved assessment plan
Frequently asked questions
Is the CyberStrike Eino Demo Skill free to use?
The source identifies the project's licence as Apache-2.0. Check the repository's licence file for the full terms before reuse or redistribution.
What do I need to run the cyberstrike-eino-demo skill?
You need a CyberStrike server or an Eino-based agent runtime to load the package. A bash shell is only needed if you run scripts/check-env.sh manually.
Where do I install an agent skill like this?
Place the unzipped folder in ~/.claude/skills/ for personal use or in a project's .claude/skills/ folder. In the Claude apps you can instead upload it under Settings → Capabilities → Skills.
Does this skill run automated security scans?
No. The skill is a demonstration with placeholder payloads and no automation, and the bundled script only prints information rather than performing checks.
Does the skill need internet access?
The package is listed as not using the network. It is a set of instruction and reference files plus a simple script.
Is this skill a good alternative to Burp Suite or ffuf?
No, it is not a replacement. It lists Burp Suite, ffuf and other tools as recommendations and provides a checklist and report structure, while those tools do the actual testing.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Choose this skill if you are building or testing skill packages for CyberStrike or an Eino-based agent, or if you want a reference checklist for authorized testing engagements. Pick a different tool if you need a finished security scanner or automated checks, since this package is a demonstration with placeholder payloads and no automation.
Download the skill