Guide · Agent skill
How to use the offensive-wifi agent skill for Wi-Fi testing
Updated · written with AI from the project's own documentation and checked against our catalogue data
The offensive-wifi skill is a reference playbook for AI agents that gives them a structured methodology for 802.11 (Wi-Fi) security assessments. This guide explains what the skill changes about the agent's behaviour, how to install it, how to ask for it in plain language, and the safety rules you must follow. By the end you will know how to plan an authorized wireless engagement with the agent's help.
Offensive Wi-Fi Testing MethodologySnailSploit/Claude-Red · MIT Download the skill Quick start
- 1Download and unzip the skill. Download the offensive-wifi ZIP from this page and unzip it. You should find the SKILL.md file inside the folder.
- 2Place it where your agent looks. Copy the folder to ~/.claude/skills/ for personal use, or to .claude/skills/ in your project. Alternatively, upload it under Settings, Capabilities, Skills in the Claude apps.
- 3Install the required tools. The skill does not install them. Make sure your Linux host has the aircrack-ng suite, hcxdumptool, hcxpcapngtool, hashcat, reaver or bully, eaphammer, wifiphisher, hostapd-mana, mdk4 and tshark.
- 4Confirm adapter support. Check that your adapter supports monitor mode and injection, using the skill's airmon-ng and aireplay-ng test commands on hardware you own.
- 5State scope and authorization. Tell the agent which networks you are authorized to test and what the engagement covers before asking for any attack steps.
- 6Run passive recon first. Ask for a passive airodump-ng survey and record BSSID, ESSID, channel, encryption, PMF status and clients before any active step.
What the offensive-wifi skill makes the agent do
An agent skill is a folder containing instructions that an AI agent reads when a task matches the skill's description. This one is a single file, SKILL.md, that sets out a wireless attack methodology for red team engagements and wireless security assessments.
Once loaded, the agent can guide you through adapter selection, passive reconnaissance, capturing WPA/WPA2-PSK handshakes and PMKIDs, cracking offline, and testing WPA3 SAE, WPA-Enterprise (802.1X/EAP), WPS, evil-twin and KARMA/Mana setups, captive-portal phishing, KRACK and FragAttacks, deauthentication, rogue access points, and some BLE, Zigbee and 802.15.4 topics. It also covers Wi-Fi 6, 6E and 7 considerations.
How do you install the offensive-wifi skill?
Download the ZIP file for the skill from this page and unzip it. For a personal install, place the offensive-wifi folder in ~/.claude/skills/. For a single project, place it in the project's .claude/skills/ folder.
If you use the Claude apps instead, open Settings, go to Capabilities, then Skills, and upload the skill there.
- Personal install folder: ~/.claude/skills/
- Project install folder: .claude/skills/ inside your project
- Claude apps: Settings → Capabilities → Skills, then upload
What do you need before you start?
The skill does not install anything. It names the tools its methodology relies on, so you must have them available on a Linux machine: the aircrack-ng suite, hcxdumptool and hcxpcapngtool, hashcat, reaver or bully, eaphammer, wifiphisher, hostapd-mana, mdk4, and tshark.
You also need a Wi-Fi adapter that supports monitor mode and packet injection. The skill's hardware table lists example chipsets, including Atheros AR9271, Realtek RTL8812AU, MediaTek MT7612U and MT7921AU, and Alfa AWUS036 models. Check the table notes, because some entries need specific drivers or are described as limited or bleeding edge.
Finally, you need written authorization for every target network. The skill is not meant for use without it.
- Linux host with the tools listed above
- Adapter with monitor mode and injection support
- Written authorization for each target network
How do you trigger the skill with natural requests?
You do not need special syntax. Describe the job in plain language and mention the wireless context. The skill's description lists the situations it fits: scoping a wireless pentest, war-driving an estate, or testing corporate wireless segmentation.
Good requests name the goal, the network you are authorized to test and the attack family you want to consider. Ask for a plan before any transmission, because the skill's workflow starts with passive recon.
- I am authorized to test the corporate Wi-Fi at our office. Scope a wireless assessment and start with passive recon.
- Walk me through checking whether our WPA2-PSK network is exposed to handshake capture, step by step.
- We are testing 802.1X on our WPA-Enterprise SSID. Which EAP methods should I fingerprint first?
- Help me choose a Linux-compatible adapter that supports monitor mode and injection for 2.4 GHz and 5 GHz testing.
Example: the passive-first workflow
The skill's quick workflow is: pick the right adapter, recon the airspace passively, choose an attack, crack offline, and pivot if the network is WPA-Enterprise. It warns never to deauthenticate before you know the topology.
Passive recon uses airodump-ng on a monitor-mode interface. The skill records BSSID, ESSID, channel, encryption, PMF status, client list, signal strength and vendor OUI for each target. Handshake capture and PMKID collection come only after that record is complete.
The skill's example commands for checking monitor mode and injection are shown below. Run them only on hardware you are authorized to use.
sudo airmon-ng check kill
sudo airmon-ng start wlan0
sudo aireplay-ng --test wlan0mon
iw list | grep -A 8 "Supported interface modes"What about WPA-Enterprise, WPS and other attack families?
For WPA-Enterprise, the skill tells you to identify the inner EAP method first, using tshark on the monitor interface. Its table maps each method to a typical attack, such as offline cracking of MSCHAPv2 challenges or a rogue RADIUS server capturing cleartext GTC passwords.
For WPS, the skill describes an offline Pixie Dust attempt with reaver or bully and treats online PIN brute forcing as a last resort. It also covers KARMA and Mana evil twin behaviour, MAC randomization, and checks for KRACK and FragAttacks, with the matching scripts referenced in the file.
- WPA-Enterprise: identify the inner method, then choose the matching attack
- WPS: try Pixie Dust before any online PIN attempts
- Evil twin and KARMA: test client behaviour against a rogue access point
- Patch checks: KRACK and FragAttacks test scripts are referenced in the file
Safety notes: scripts and network use
The skill itself contains no scripts and makes no network connections. It is one Markdown file of methodology with example command lines. Those commands, however, transmit on radio and some point to outside repositories, such as git clone lines for reference implementations. Any transmission, and any download you run, is your responsibility.
The file says broadcast deauthentication and flooding are for explicit authorization only. Treat every example as a potential service disruption on a live network and confirm scope before running it.
- The skill ships with no scripts and uses no network itself
- Example commands transmit on real radio channels
- Deauth and flood commands can disrupt clients and access points
- Only test networks you own or have written permission to test
Tips for getting useful results
Ask the agent to write down your scope, adapter and target list before you begin. Keep your captures and notes in the engagement folder, since the workflow depends on recording identifiers accurately. Use the agent for planning and method selection, and check every command against the tool's own documentation before you run it.
Remember that the methodology is a playbook, not a guarantee. Some attacks depend on firmware, patch level and configuration, so verify each finding on the actual target.
- State your scope and written authorization at the start of each session
- Ask for the passive recon plan before any active attack
- Verify each command against the tool documentation
- Record BSSIDs, channels and encryption for every target
What people use it for
- Scoping a wireless penetration test by planning adapter choice, recon and attack order before touching the air
- Auditing a corporate WPA-Enterprise setup by identifying which EAP method is in use and what the skill says to test
- Checking WPS exposure on access points during an authorized assessment, starting with offline Pixie Dust
- Reviewing a war-driving survey of an estate to inventory BSSIDs, channels, encryption and PMF status
Frequently asked questions
How do I install the offensive-wifi agent skill?
Download the ZIP from this page and unzip it. Place the offensive-wifi folder in ~/.claude/skills/ for personal use or in a project's .claude/skills/ folder, or upload it in the Claude apps under Settings, Capabilities, Skills.
What do I need to run the offensive-wifi skill?
You need a Linux machine with the aircrack-ng suite, hcxdumptool and hcxpcapngtool, hashcat, reaver or bully, eaphammer, wifiphisher, hostapd-mana, mdk4 and tshark. You also need a Wi-Fi adapter that supports monitor mode and injection, and written authorization for the target networks. The skill does not install these tools for you.
Is the offensive-wifi skill free to use?
The skill is published under the MIT licence, as stated on this page. Check the licence file in the repository for the full terms before you reuse or redistribute it.
Does the skill run scripts or use the network?
No. The skill is a single SKILL.md file with methodology and example command lines, and it runs no scripts itself. The commands it shows will transmit on Wi-Fi when you run them, and some reference git clone lines that download code from outside sources.
Can I use this skill to test a network I do not own?
No. The content gives operational attack steps and should only be used on networks you own or have written permission to test. Using it otherwise is illegal in many places.
Is this a good alternative to a hardening guide for my home Wi-Fi?
Not really. The skill is aimed at penetration testers, security teams and students in labs they own. If you want to secure your own router, a hardening guide that covers settings like strong passphrases and disabling WPS will fit better.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Choose this skill if you are a penetration tester, a security team auditing corporate Wi-Fi, or a student working in a lab you own, and you already have Linux, compatible hardware and written authorization. Pick a hardening guide instead if you only want to secure your home router, and do not use it at all if you lack the hardware, training or permission, because the commands can disrupt networks.
Download the skill