Evil Twin Wi-Fi Attacks agent skill: install and use it safely

What the skill makes the agent do

The skill covers a family of rogue access point techniques: Evil Twin, KARMA, Mana, Known Beacons and captive portal pages. It also covers deauthentication used to push clients off a legitimate network, traffic interception after a device connects, and detection-evasion tactics. The source frames these as ways to coerce client devices onto an attacker-controlled access point, intercept their traffic, harvest credentials or deliver payloads.

Because the content is attack-oriented, the value of the skill for a legitimate tester is mainly in organizing a wireless assessment: reviewing which techniques are in scope, which tools the engagement names, and how results should be documented. The skill names tools such as hostapd, wifiphisher, airgeddon, eaphammer, bettercap and aireplay-ng.

Install the skill (ZIP or Claude app upload)

Download the skill ZIP from the directory page, then either unzip it into your personal skills folder at ~/.claude/skills/ or into a project's .claude/skills/ folder. The skill package contains a single file, SKILL.md.

You can also upload the ZIP in the Claude apps under Settings, then Capabilities, then Skills.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project folder
• Claude apps: Settings, Capabilities, Skills, then upload

What you need before using it

The source lists a Linux system with a wireless adapter that supports monitor and AP mode, plus several tools: hostapd, hostapd-mana, dnsmasq, iptables, the aircrack-ng suite, wifiphisher, airgeddon, eaphammer, mitmproxy, bettercap, hcxdumptool and Flask for Python. The skill itself runs no scripts and makes no network requests. Any real activity happens through tools you install and run yourself.

Hardware and tooling are not the main requirement. A signed scope document from the network owner is.

• Linux machine with a suitable wireless adapter
• Only the tools listed in the source, installed by you
• Own lab equipment, or written permission for the target network

How to trigger the skill with natural requests

Agents load a skill when your request matches its description. For this skill, the most useful requests are about planning and reviewing an authorized assessment, not about running attacks against a specific network. Name the engagement, the scope and the permission you hold.

Expect the agent to ask about authorization and scope before giving detailed guidance. That is intended behaviour for this kind of material.

• Help me write the rules of engagement for an approved wireless assessment of our office network.
• Summarize which evil twin variants a red team should consider when testing whether staff devices auto-connect to unknown networks.
• Draft a test plan and reporting template for a wireless engagement that we have written permission to run.
• List the detection signals a rogue access point test should document, for a lab built on our own equipment.

Safety, scope and legal limits

Use this skill only on networks you own or have written permission to test. The source itself says that targeting public, cafe, hotel or corporate Wi-Fi without permission is illegal interception and credential theft in most jurisdictions. Casual use to pick up other people's logins is outside the intended use.

Keep any lab completely isolated from real networks and real users. Record the scope, the authorization, the time windows and what was captured, and handle any captured credentials under your engagement's data rules.

• Get written authorization that names the networks, devices and dates
• Test only your own lab or the approved target
• Do not connect rogue equipment to public or third-party networks
• Document and delete captured data as the engagement requires

Tips for getting value from the skill

Ask for planning output rather than step-by-step attack execution. Good outputs include scope checklists, risk notes, defensive recommendations and report sections. If you are a defender, the source notes it is weighted toward attacker techniques and does not explain detection in depth, so pair it with dedicated wireless intrusion detection documentation.

• Start every request with the engagement name and authorization
• Ask for reporting and remediation advice alongside findings
• Pair with your organization's wireless security policy