Skip to content
Get packs

Guide · Agent skill

How to use the Offensive Wi-Fi Reconnaissance agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

The offensive-wifi-recon skill is a written methodology that teaches an AI agent how to run the first phase of an authorized wireless security assessment: picking a compatible Wi-Fi adapter, enabling monitor mode, setting the regulatory domain, passively sweeping 2.4, 5 and 6 GHz networks, and building a structured target list. It is aimed at security professionals and students who already have permission to test the networks in question. After reading this guide you will know how to install the skill, how to ask for it in plain language, and what hardware and safety conditions it depends on.

Offensive Wi-Fi ReconnaissanceSnailSploit/Claude-Red · MIT

Quick start

  1. 1Download and unzip. Download the offensive-wifi-recon ZIP from this page and unzip it so that SKILL.md sits in its own folder.
  2. 2Place the skill. Move the folder into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills in the Claude apps.
  3. 3Prepare the Linux host. Install or confirm aircrack-ng, iw and Kismet, and connect a monitor- and injection-capable USB adapter.
  4. 4Make a natural request. Describe your authorized wireless engagement, the bands in scope and that you want passive recon before any active attack.
  5. 5Set the regulatory domain and verify injection. Run the regdomain check and set the legal domain, then run the injection test and look for strong ack rates.
  6. 6Sweep and drill down. Run a passive all-band sweep saved to file, then pin the channel for each in-scope BSSID.
  7. 7Build the target list. Record BSSID, channel, encryption, PMF, client list and WPS status for each target before any active step.

What agent skills are and what this one makes the agent do

An agent skill is a folder containing a SKILL.md file with instructions that an AI agent loads when a task matches the skill's description. This skill's SKILL.md describes the reconnaissance workflow for Wi-Fi engagements: choose the right adapter for the target bands, verify monitor mode and injection, set the regulatory domain, sweep all bands passively, drill down on in-scope BSSIDs, and record everything before any active attack.

The skill covers identifying BSSID, ESSID, channel, encryption (WPA2-PSK, WPA2-Enterprise, WPA3-SAE, Open, WEP), PMF status, client devices, WPS status and vendor OUI. It names tools including airodump-ng, aireplay-ng, airmon-ng, iw, Kismet and Wigle. Its purpose is to build the target map that later attacks depend on.

  • Adapter selection by chipset, with notes on 2.4, 5 and 6 GHz support
  • Monitor mode and injection setup, including an injection test
  • Regulatory domain checks and settings
  • Passive multi-band sweeps and per-BSSID captures
  • Hidden SSID discovery, vendor OUI lookup and war-driving with Kismet

Install the skill by ZIP download

Download the skill ZIP from this page and unzip it. The skill folder contains SKILL.md. For a personal install, place the unzipped folder inside ~/.claude/skills/. To scope it to one project, place it inside that project's .claude/skills/ folder instead.

If you use the Claude apps rather than a local setup, you can upload the skill under Settings → Capabilities → Skills.

  • Personal install: ~/.claude/skills/ (available across your projects)
  • Project install: .claude/skills/ inside the project folder
  • Claude apps: Settings → Capabilities → Skills, then upload

Check your hardware and system before you start

The skill expects a Linux system with the aircrack-ng suite (airmon-ng, airodump-ng, aireplay-ng), iw, and Kismet. It also needs a USB Wi-Fi adapter that supports monitor mode and packet injection; the source gives the Alfa AWUS series as an example. Optional extras are the Wireshark manuf database for vendor lookups and a Wigle account if you submit data.

The skill's own adapter table lists chipset notes. For example, the Atheros AR9271 (Alfa AWUS036NHA) is 802.11n only, the Realtek RTL8812AU (AWUS036ACH) is dual-band with the driver aircrack-ng/rtl8812au, and 6 GHz work needs a 6E-capable adapter and an updated airodump-ng. The source also says the Wi-Fi 6 MediaTek MT7921AU needs patched drivers and that Wi-Fi 6E adapters are bleeding edge, so verify per release.

  • Linux host with aircrack-ng, iw and Kismet installed
  • Monitor- and injection-capable USB adapter matched to your target bands
  • Wireshark manuf database if you want OUI lookups
  • Wigle account only if the engagement allows submissions
lsusb | grep -iE "(atheros|realtek|mediatek|alfa)" iw dev iw list | grep -A 8 "Supported interface modes"

Trigger the skill with natural requests

You do not need special syntax. Describe the phase you are in and state that you have authorization. The skill's description says to use it at the start of any wireless engagement, before active attacks, so requests that name the reconnaissance phase tend to match best.

Good requests name the goal, the bands and the scope. Mention that the work is authorized and that you want passive recon before any deauth or handshake capture. The agent will then follow the workflow in order.

  • "I'm starting an authorized wireless pentest. Walk me through recon on wlan0, all bands, before any active attacks."
  • "Help me pick an adapter that can monitor 6 GHz for a Wi-Fi 6E test."
  • "Build a target list from my airodump CSV: BSSID, channel, encryption, PMF, WPS and client count."
  • "Set up monitor mode on wlan0 and run the injection test."

Run a passive multi-band sweep and capture the results

The core workflow starts with a passive sweep across all bands, saved to file for later analysis. The skill recommends setting the regulatory domain first so the legal channels are used. Once an in-scope BSSID is identified, it recommends pinning the radio to that BSSID's channel, because channel-hopping during a focused capture loses frames.

The skill's cheatsheet also notes that pure passive recon, with no probes from your radio, is invisible to most WIDS deployments, so it advises staying passive until you are committed to the active phase.

  • Set the regulatory domain before scanning
  • Sweep with --band abg, --band a or --band ax depending on the bands you need
  • Pin the channel with -c and --bssid for targeted capture
sudo iw reg set US sudo airodump-ng wlan0mon --band abg --write recon --output-format pcap,csv sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w target wlan0mon

Use the safety settings: authorization, regulatory domain and scripts

This skill is written as offensive-security guidance. Its own text says to operate within the regulatory domain you are authorized to use, and to deauth only with explicit authorization. Hidden SSID discovery in the skill can use a deauth, which the source says should only be done with explicit authorization and points to a separate offensive-deauth-disassoc skill for that step.

The source lists this skill as not running scripts and not using the network. The commands it contains run on your own machine against radio traffic, so the authorization decision rests with you. Check the rules of engagement before submitting anything to Wigle, since the skill notes that Wigle aggregates observations geographically and that its API terms should be read before automated submissions.

  • Only test networks you own or have written authorization to test
  • Respect the regulatory domain you are permitted to use
  • Check rules of engagement before any Wigle submission
  • Stay passive until the active phase is approved

Tips for getting useful results

Run the injection test first. The skill says 30/30 ack rates against nearby access points indicate a working setup, and lower scores point to driver, antenna or position problems. Record each target's fields in a structured list before moving on, because later attacks need the exact BSSID, channel and encryption.

For long captures, the skill suggests running Kismet headless under tmux instead of with the ncurses interface. Vendor identification from the OUI prefix can inform likely default credentials, known firmware bugs and WPS exposure, so treat those as leads to verify rather than conclusions.

  • Expect 30/30 ack rates from a healthy injection test
  • Record BSSID, channel, width, band, encryption, PMF, RSSI, client list and WPS status per target
  • Use tmux for long Kismet runs
  • Verify OUI-based guesses before acting on them

What people use it for

  • Building a target map at the start of an authorized penetration test across 2.4, 5 and 6 GHz
  • Checking whether a lab access point uses WPA3-SAE or WPA2-PSK with PMF enabled before planning further tests
  • Identifying client devices and vendors in an authorized student lab exercise
  • Preparing a structured airspace dataset to hand to a later active-attack phase
  • Mapping access points with Kismet during a sanctioned site survey that includes GPS

Frequently asked questions

How do I install the offensive-wifi-recon skill?

Download the skill ZIP from this page and unzip it. Place the folder in ~/.claude/skills/ for personal use or in a project's .claude/skills/ folder. In the Claude apps you can instead upload it under Settings → Capabilities → Skills.

What hardware do I need for this skill?

You need a Linux system and a USB Wi-Fi adapter that supports monitor mode and packet injection. The source uses the Alfa AWUS series as an example. Chipset support varies, and 6 GHz needs a Wi-Fi 6E-capable adapter.

Is the offensive-wifi-recon skill free and what is its licence?

The source lists the licence as MIT. The source does not state any price, so check the directory page for the current terms.

Which tools does this skill require?

The source lists the aircrack-ng suite (airmon-ng, airodump-ng, aireplay-ng), iw and Kismet. Wireshark's manuf database is optional for vendor lookups, and a Wigle account is optional for submissions.

Can this skill scan networks I do not own?

No. The skill is for authorized testing only. Its text says to operate within the regulatory domain you are authorized to use and to deauth only with explicit authorization, and the source warns that the commands would be illegal and harmful against networks without written permission.

Does this skill help with home Wi-Fi troubleshooting?

No. The skill targets offensive reconnaissance in authorized wireless penetration tests. It does not cover ordinary Wi-Fi setup or home network troubleshooting.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill is a good fit for security professionals running authorized wireless penetration tests, students working in a lab or with explicit permission, and red teamers building a target map before active testing. It is not suited to anyone without suitable USB adapters and a Linux setup, or to anyone who wants help with ordinary home Wi-Fi problems.

Download the skill