Guide · Agent skill
How to use the Internal Network Penetration Test agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains how to install and use the conducting-internal-network-penetration-test agent skill, a playbook that guides an AI agent through an internal network penetration test from the point of view of an attacker who has already reached one ordinary employee computer. It is written for security professionals with authorization, students working in a lab, and blue teams who want to see attacker paths. By the end you will know what the skill covers, how to add it to your agent, how to ask for it, and what you need before running anything against a real network.
Internal Network Penetration Testmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download the skill ZIP. Get the ZIP file for conducting-internal-network-penetration-test from the directory page.
- 2Install the skill folder. Unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills in the Claude apps.
- 3Prepare your environment. Set up Kali Linux or a similar distribution with nmap, Impacket, Responder, NetExec, BloodHound, bloodhound-python and hashcat, plus Python 3 with ldap3.
- 4Confirm authorization and scope. Have signed Rules of Engagement, your network position on the internal VLAN, and the coordination with IT and SOC in place before running anything.
- 5Ask the agent in plain language. Describe the scope, your starting access and the outcome you want, such as attack paths to domain admin, and ask it to follow the playbook.
- 6Review commands and record results. Check each command before it runs, respect lockout limits, and log output so you can build the report from the template.
What this skill makes the agent do
Agent skills are folders of instructions and supporting files that an AI agent can load when a task matches them. This skill is a detailed penetration testing playbook for an internal network. It assumes the tester starts from a standard domain workstation or a network jack, as a malicious insider or post-breach attacker would, and asks how far that single device could reach.
The playbook is organised into phases: network discovery and enumeration, credential attacks, exploitation and lateral movement, and data access to demonstrate impact. Each phase gives step-by-step guidance and command examples. Topics include discovering hosts and services, enumerating Active Directory, capturing and cracking credentials, moving between machines and escalating privileges.
- Discovery: host discovery across internal ranges, port scans and service-specific scans
- Active Directory: domain enumeration, LDAP queries, BloodHound data collection
- Credentials: network capture with Responder, hash cracking with hashcat, Kerberoasting and AS-REP Roasting
- Movement and escalation: Impacket tools, Evil-WinRM, SSH pivoting, privilege escalation checks
- Impact: access to file shares and databases to show what is exposed
Install the skill in Claude or Claude Code
Download the ZIP file for this skill from the directory page. Unzip it so the skill folder sits in one of two places. For a personal skill available across your projects, use ~/.claude/skills/. For a skill limited to one project, place it in that project's .claude/skills/ folder.
In the Claude apps you can instead upload the skill under Settings → Capabilities → Skills. Choose whichever route matches how you work. Once installed, the agent can load the skill when a request matches its description.
- Personal use across projects: unzip into ~/.claude/skills/
- Single project: unzip into the project's .claude/skills/ folder
- Claude apps: upload under Settings → Capabilities → Skills
Ask for it with natural requests
You do not need special syntax. The skill's description covers executing an internal network penetration test that simulates an insider threat or post-breach attacker, so ask for that kind of work in plain language. Name the scope and the access model you have been given, and say that the test is authorized.
Good requests state the goal, the starting position and the constraints. For example, you might say that you have signed Rules of Engagement covering an internal range, that you hold a standard domain user account, and that you want to find lateral movement paths to domain admin. Mention any limits, such as no password spraying during business hours, so the agent can plan around them.
- Give the scope: which subnets and which AD domain are in bounds
- Give the starting position: network drop, VPN, or a standard domain user
- Ask for a specific outcome: attack paths, exposed shares, Kerberoastable accounts
- Ask for report output: the skill includes a report template with an executive summary and technical findings
What you need before you start
The skill assumes a working penetration testing environment and an authorized test. The source lists the following requirements. Check each one before you begin, because the playbook does not verify them for you.
The skill has no authorization checks of its own. Written permission and signed Rules of Engagement are your responsibility. The skill also states that its content assumes familiarity with Kali Linux, nmap, Impacket and Active Directory, so reading the underlying tool documentation will help.
- Kali Linux or a similar penetration testing distribution
- nmap, Impacket, Responder, NetExec (the CrackMapExec successor), BloodHound and bloodhound-python, hashcat
- Python 3 with ldap3 for the process.py helper
- Authorized domain test credentials; the examples use placeholder credentials
- Signed Rules of Engagement and a physical or VPN network position on the internal VLAN
- Coordination with IT and SOC teams for monitoring and emergency contacts
Safety notes for the scripts and network activity
The skill runs scripts and uses the network. The two Python helpers, scripts/agent.py and scripts/process.py, are designed to run scanning tools such as nmap and produce output for reporting. Scans, password spraying and credential attacks can cause account lockouts, outages or alerts, so run them only on networks you are authorized to test and only after agreeing timing with IT and the SOC.
Review the commands before the agent runs them. The source includes examples that use placeholder credentials and a sample password spray. Replace placeholders with your own authorized values, and follow the lockout policy you have agreed with the client.
- Test only networks you own or have written permission to test; unauthorized use is illegal
- Coordinate scans and credential attacks with IT and SOC teams before starting
- Respect lockout policies when using password spraying
- Keep test credentials and captured hashes secured and handled according to your Rules of Engagement
- Use assets/template.md to record findings and the scope of what you did
Tips for getting useful results
Start with discovery and the Active Directory enumeration section. The attack path analysis in BloodHound, which the playbook describes as importing JSON files into the BloodHound GUI, often shows the most useful routes early. Work from what you learn rather than running every technique in the playbook.
Keep a record of each step, including the scope it was run against and the output it produced. The report template groups results into severity levels and an attack path summary, so notes taken as you go make the final write-up much easier.
- Begin with network discovery, then move to Active Directory enumeration
- Use BloodHound output to plan attack paths rather than guessing
- Record scope, timing and output at every step
- Use the standards reference to map findings to frameworks such as MITRE ATT&CK and NIST SP 800-115
nmap -sn 192.168.0.0/16 -oG internal_hosts_192.gnmapWhat people use it for
- A security team runs an authorized assumed-breach test to see how far one compromised workstation can reach in the Active Directory domain.
- A student works through the lateral movement and Active Directory sections in a lab built for training to learn how these attacks work.
- A blue team uses the attack path steps to check whether its detections fire during an agreed test window.
- A consultant uses the report template to structure findings, severity levels and an attack path summary for a client.
Frequently asked questions
Is the internal network penetration test skill free?
The source gives the skill's licence as Apache-2.0 and does not state a price. Check the licence terms on the directory page before using or redistributing it. The tools it depends on, such as nmap and Impacket, are separate projects with their own licences.
What do I need to install and use this skill?
You need Kali Linux or a similar penetration testing distribution, the listed tools including nmap, Impacket, Responder, NetExec, BloodHound and hashcat, Python 3 with ldap3, authorized test credentials, signed Rules of Engagement, and a network position on the internal VLAN. The skill assumes you already know these tools.
Where do I put the skill so Claude can use it?
Unzip the downloaded ZIP into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder for one project. In the Claude apps you can also upload it under Settings → Capabilities → Skills.
Can I use this skill to test a network I do not own?
No. Testing any network you do not own or lack written permission to test is illegal. The skill has no authorization checks of its own, so you must confirm permission and signed Rules of Engagement before you start.
Will the scans break anything on a production network?
They can. Scans, password spraying and credential attacks can cause lockouts, outages or alerts. Coordinate timing and scope with IT and SOC teams, and avoid production networks until that coordination is in place.
How does this compare with other penetration testing playbooks?
This skill is focused on the internal network from an assumed-breach position, covering Active Directory, credential attacks and lateral movement. It assumes you already know Kali Linux and the named tools, so it suits experienced testers and trainees more than beginners looking for a simple scanner.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits security professionals running authorized internal penetration tests under signed Rules of Engagement, students learning Active Directory attacks in a lab, and blue teams mapping attacker paths. It is not suitable for anyone without written permission to test a network, for production networks without IT and SOC coordination, or for non-technical users who want a simple tool.
Download the skill