How to use the Offensive TLS Attacks agent skill

What the skill makes the agent do

A skill is a folder containing a SKILL.md file with instructions that an agent reads when a task matches its description. This one covers TLS/SSL testing across network services and mobile applications. Its workflow is to enumerate supported protocols, cipher suites and certificate chains, identify deprecated protocols such as SSLv2, SSLv3, TLS 1.0 and TLS 1.1, and check for known weaknesses including POODLE, DROWN, FREAK, BEAST and Heartbleed.

The description also covers compression oracles (CRIME and BREACH), certificate validation and pinning, HSTS bypass, TLS 1.3 0-RTT replay, mutual TLS attacks and Certificate Transparency log monitoring. The excerpt of SKILL.md used for this page ends partway through the compression section, so check the full file for the detail on each of these topics.

The skill maps its findings to CWE-295, CWE-319 and CWE-757, and recommends testssl.sh, sslyze, sslscan and tlsx as its primary scanners.

How to install the skill

Download the skill ZIP from the download link on this page. Then choose one of the two methods below.

For Claude Code, unzip the file into your personal skills folder ~/.claude/skills/, or into a project's .claude/skills/ folder if you want the skill available only inside that project. Make sure the offensive-tls-attacks folder containing SKILL.md sits directly inside the skills folder.

In the Claude apps, you can instead upload the ZIP under Settings → Capabilities → Skills.

• Personal install: ~/.claude/skills/offensive-tls-attacks/
• Project install: .claude/skills/offensive-tls-attacks/ inside your project
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

How to trigger the skill with natural requests

You do not need a special command. Describe the task in plain language that mentions TLS, SSL, certificates or the named attacks, and the agent can match the request to the skill. Name the target you are authorised to test so the agent knows its scope.

Useful requests look like these: check which TLS protocols and ciphers example.com still accepts; test whether my server is vulnerable to POODLE, DROWN or FREAK; check the certificate chain and hostname validation for this API; find hosts in this list that still accept TLS 1.0. Ask for a written findings summary with remediation priorities at the end.

• Check which protocols and ciphers my server at target.com:443 accepts and flag anything deprecated.
• Test target.com for POODLE, DROWN, FREAK, BEAST and Heartbleed and show the evidence.
• Review the certificate validation of this Android app and tell me whether pinning is enforced.
• Summarise the findings and rank remediation by priority.

Example: a basic protocol and cipher check

The skill tells the agent to start with testssl.sh because it needs nothing beyond bash and OpenSSL. The commands below are the ones given in the skill for a quick check and for a vulnerability-specific check. Run them only against hosts you are authorised to test.

The agent reads the output, reports which protocols and ciphers are accepted, and lists any vulnerability flags that appear. For a JSON or HTML report, the skill's full-scan example writes results to files named by you.

What you need before you start

The skill depends on several external tools. The agent can recommend them, but you must have them available on the machine where it runs. The skill lists testssl.sh, sslyze (Python), sslscan, tlsx, nmap and the OpenSSL command-line tools. For mobile certificate pinning work it also needs Frida and Objection.

The skill itself does not run scripts. It does use the network, so every scan it performs sends traffic to the targets you name.

• testssl.sh (needs bash and OpenSSL)
• sslyze (Python)
• sslscan
• tlsx
• nmap
• OpenSSL command-line tools
• Frida and Objection, for mobile pinning work only

Safety notes: scripts and network use

The skill is framed as offensive. It probes live infrastructure, so use it only on systems you own or have written permission to test. Probing third-party infrastructure may be illegal.

Avoid large unco-ordinated scans. The skill itself warns that production scanning of large host lists can disrupt services and trigger alerts. Agree timing and scope with the system owner first, and use tools like tlsx at scale only in coordinated windows.

Because the skill makes network connections, review the commands the agent proposes before it runs them against anything sensitive.

• Confirm written authorisation and scope before any scan.
• Coordinate large host lists with the operations team.
• Keep client certificates and private keys used in sslyze runs under your own control.

Tips for better results

Give the agent the exact host and port, for example target.com:443 or a list of hosts in a file. Say whether you want a quick cipher enumeration or a full audit, since they use different tools.

For defensive work on your own servers, say so. The skill's own guidance says a standard hardening guide is faster and carries less risk when the question is only about TLS configuration.

Ask for evidence next to each finding, such as the scanner line that flagged it, so you can verify it independently.

• Name the host, port and scope in every request.
• Ask for the scanner output that supports each finding.
• For simple hardening questions, a configuration guide may be the better first stop.