Guide · Agent skill
How to use the Network Penetration Test agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains the conducting-network-penetration-test agent skill, a set of instructions and helper files that teaches an AI agent to run a structured network penetration test. It is written for readers who have never used agent skills before. By the end you will know how to install the skill, how to ask for it in plain language, what it needs on your machine, and the authorization rules it expects you to follow.
Network Penetration Testmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Confirm authorization and scope. Get the signed Rules of Engagement, written authorization from the network owner and a scope document before any scan. The skill requires these first.
- 2Download and unzip the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder, or upload it under Settings, Capabilities, Skills in the Claude apps.
- 3Install Nmap and Python libraries. Install Nmap on the testing system and the python-nmap library for Python 3, since scripts/agent.py imports it as nmap.
- 4Ask for an authorized plan. Start a new conversation and describe the in-scope ranges and the goal, such as a discovery-only pass on a named subnet.
- 5Run discovery and scanning. Let the agent run layered host discovery, then port and service scans on the live hosts within the approved scope.
- 6Review vulnerabilities and act within limits. Review the findings and approve only the exploitation the RoE allows, documenting every attempt including failures.
- 7Clean up and report. Remove test artifacts, verify with a re-scan and have the agent draft the report with findings, CVSS scores and remediation priorities.
What the skill makes the agent do
An agent skill is a folder of instructions that an AI agent loads when a request matches the skill's purpose. This one gives the agent a playbook based on the PTES methodology, moving from reconnaissance through post-exploitation and reporting. The playbook covers finding live hosts, scanning open ports, identifying service versions and known vulnerabilities, attempting controlled exploitation, and documenting results.
The skill also includes a Python helper script, scripts/agent.py, that automates host discovery and port scanning with the Nmap tool. The skill is written for authorized security assessments and tells the agent to require written authorization and a scope document before it starts.
- Host discovery using ICMP, ARP, TCP SYN and UDP probes
- Full TCP and top UDP port scans, service version detection and OS fingerprinting
- Protocol checks for SMB, SNMP, DNS and LDAP
- Vulnerability correlation with NSE scripts, searchsploit, NVD and CVE records
- Controlled exploitation, post-exploitation, cleanup and reporting steps
Install the skill from the ZIP or the Claude apps
You can install the skill in one of two ways. For Claude Code, download the ZIP from the skill's page on this site and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder to share it with one codebase.
If you use the Claude apps, upload the ZIP under Settings, then Capabilities, then Skills. After installing, start a new conversation so the agent can see the skill.
- Personal install: unzip into ~/.claude/skills/
- Project install: unzip into the project's .claude/skills/ folder
- Claude apps: Settings, then Capabilities, then Skills, then upload the ZIP
How to trigger the skill with natural requests
You do not need a special command. The skill activates for requests about network pentesting, infrastructure security assessment, internal network testing or external perimeter testing. Say what you are authorized to test and what you want produced, so the agent can check scope before it runs anything.
Mention the authorization up front. The skill's own guidance tells the agent to confirm written authorization and scope first, so a request that includes that context gets a more useful response.
- Plan an authorized internal network test for the 10.10.0.0/24 range covered by our signed Rules of Engagement, and list the steps before running any scans.
- Run host discovery on our perimeter range and build a target list from the live hosts.
- Enumerate SMB and SNMP on the in-scope hosts from our scope document and summarize misconfigurations.
- Draft a penetration test report outline with executive summary, methodology and remediation priorities.
Run the Nmap helper script
The helper script scripts/agent.py runs discovery and scanning through the python-nmap library, which the script imports as nmap. Nmap must be installed on the system. The script's documented options include a target network, a port range, an output file and a discovery-only mode.
Only run it against systems in your approved scope.
- Requires Nmap installed on the system and Python 3 with the python-nmap library
- Host discovery uses ARP ping and ICMP echo with TCP ACK probes on common ports
- Port scanning uses a TCP SYN scan with service version detection, OS detection and banner grabbing
python agent.py --target 192.168.1.0/24 --ports 1-10000 --output report.jsonUnderstand what the workflow expects you to have
The workflow assumes a dedicated testing laptop, typically with Kali Linux or an equivalent toolset, plus VPN or direct access to the target scope. It references tools such as Metasploit, hydra, crackmapexec, impacket, linpeas, mimikatz, enum4linux and searchsploit. The skill assumes you already understand these tools, so it is not a beginner tutorial.
The most important requirement is not a software item. You need a signed Rules of Engagement document and a written authorization letter from the network owner. The skill's prerequisites also call for a scope document listing in-scope ranges, domains and excluded systems such as medical devices or SCADA.
- Signed Rules of Engagement with target ranges, excluded hosts, testing hours and emergency contacts
- Written authorization from the network owner
- An out-of-band channel to the client's incident response team
- Scope document listing in-scope IP ranges, domains and exclusions
Safety limits and when not to use it
The skill itself says not to use it for networks without explicit written authorization, for production systems without a pre-approved change window and rollback plan, or for denial-of-service testing unless it is explicitly scoped and authorized. Its exploitation, password spraying and credential theft steps can cause real harm and legal liability.
Scanning and exploitation can also crash services. The workflow asks you to respect lockout policies during credential attacks, to document every exploitation attempt, and to remove tools, accounts and configuration changes after testing. Treat those steps as requirements, not suggestions.
- Do not test networks you do not own or lack written permission to test
- Do not run it against production systems without an approved change window and rollback plan
- Respect account lockout policies during password spraying
- Do not exfiltrate real data; document access only
- Clean up uploaded tools, accounts and changes, then re-scan affected hosts
What people use it for
- Internal assessment of a corporate subnet to validate firewall rules and network segmentation before a deployment.
- Preparing evidence for a PCI-DSS, HIPAA, SOC 2 or ISO 27001 periodic penetration testing requirement.
- Testing whether IDS, IPS or SOC staff detect scanning and exploitation traffic in an authorized exercise.
- Practising network pentest methodology in an isolated lab built for that purpose.
Frequently asked questions
Is the conducting-network-penetration-test skill free?
The skill is published under the Apache-2.0 licence, as stated on this page. Check the licence file in the download for the full terms. The tools it references, such as Nmap and Metasploit, have their own licences that you should review separately.
What do I need installed to use this skill?
You need Nmap on the system and Python 3 with the python-nmap library for the helper script. The workflow also assumes Kali Linux or an equivalent toolset with tools such as Metasploit and hydra. You also need a signed Rules of Engagement and written authorization from the network owner.
Where do I put the skill folder in Claude Code?
Unzip the downloaded ZIP into ~/.claude/skills/ for a personal install, or into the project's .claude/skills/ folder to share it within one project. For the Claude apps, upload the ZIP under Settings, then Capabilities, then Skills.
Why won't the agent start scanning when I ask?
The skill asks the agent to confirm written authorization and a defined scope first. Include your Rules of Engagement details and the in-scope ranges in your request. If the agent still does not activate, make sure the skill folder is in the right location and start a new conversation.
Can a beginner use this skill to learn pentesting?
The skill is not a beginner tutorial. It assumes working knowledge of Nmap, Metasploit and Active Directory attacks. Beginners can use it in an isolated lab to see the methodology, but should learn the underlying tools first.
How does this compare with running Nmap by hand?
The skill gives the agent a structured sequence of discovery, scanning, vulnerability correlation and reporting steps, and includes a Python helper for Nmap discovery and scanning. Running Nmap by hand gives you full control over every command, which suits experienced testers who want to choose each step themselves.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are a security engineer or a team running an authorized internal or external network assessment, or preparing for a compliance-driven penetration test, and you already know Nmap and Metasploit. Pick something else if you are a beginner, if you lack written authorization, or if you need to test production systems without an approved change window and rollback plan.
Download the skill