Guide · Agent skill
How to use the Thick Client Security Testing agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The thick-client skill gives an AI agent a structured checklist for security testing desktop applications, including Windows, macOS and Linux GUI apps and apps that rely on a companion service. This guide explains what the skill makes the agent do, how to install it, how to ask for it in plain language, and what to check before you run it. It is meant only for authorized testing.
Thick Client Security Testingzhaoxuya520/reverse-skill · MIT Download the skill Quick start
- 1Download the ZIP. Get the ZIP for skills/thick-client from the directory page.
- 2Unzip the skill folder. Extract the thick-client folder so SKILL.md sits inside it.
- 3Place it where the agent can read it. Copy the folder to ~/.claude/skills/ for personal use or to the project's .claude/skills/ folder, or upload the ZIP under Settings → Capabilities → Skills.
- 4Gather scope and accounts. Note the installer source, test accounts and written authorization before testing begins.
- 5Install your analysis tools. Make Burp Suite or mitmproxy, Process Monitor, dnSpy, IDA or Ghidra available if your workflow needs them, since the skill does not install them.
- 6Ask for an authorized desktop assessment. Describe the target app and the topic, such as local storage or IPC, and say the test is authorized.
What an agent skill is and what this one does
An agent skill is a folder of instructions that an AI agent loads when a task matches the skill's description. The thick-client skill is built around one file, SKILL.md, plus a checklist in references/thick-client-checklist.md.
When the skill is active, the agent works through a fixed sequence: map the trust boundaries (process tree, listening ports, outbound domains and local sensitive paths), review the local attack surface, review the network surface, and then verify findings with reverse-engineering tools. It is designed for desktop thick clients, including client/server apps, Electron, Qt and .NET WinForms/WPF software.
- Local surface: plaintext config, hardcoded keys, debug switches, DLL search order on Windows, SQLite file permissions, and IPC access checks.
- Network surface: system proxy and custom TLS behaviour, certificate pinning, and client-side hidden management APIs.
- Verification: .NET targets go to the dotnet-reverse skill, native targets to ida-reverse or Ghidra, and Electron apps to asar extraction with js-reverse.
- Update and supply chain: update channels and code signing checks, with supply-chain-security as a companion.
Install the thick-client skill from a ZIP
Download the ZIP for skills/thick-client from the directory page. Unzip it so the folder named thick-client, containing SKILL.md, sits in one of these locations:
You can install it for yourself, in ~/.claude/skills/, or for one project, in the project's .claude/skills/ folder. You can also upload the ZIP in the Claude apps under Settings → Capabilities → Skills.
- Personal install: place the thick-client folder in ~/.claude/skills/.
- Project install: place the thick-client folder in the project's .claude/skills/ folder.
- Claude apps: upload the ZIP under Settings → Capabilities → Skills.
Check the requirements before you start
The skill itself installs nothing. It names analysis tools but the files do not provide them, so you need to have them available if the workflow calls for them.
The skill also refers to companion skills by path and to a field-journal file. Neither is included in the provided files, so the agent may not be able to follow those references unless you supply them.
- Analysis tools named in the workflow: Burp Suite or mitmproxy, Process Monitor, dnSpy, IDA or Ghidra.
- Companion skills referenced by path: dotnet-reverse, ida-reverse, js-reverse, api-security, protocol-reverse, supply-chain-security.
- A field-journal file (precedent-pentest.md), which is not included in the provided files.
- The skill does not run scripts and does not use the network.
Trigger the skill with a natural request
You do not need a special command. Describe the task in plain language, and say that it is an authorized assessment of a desktop application. The skill's description covers local storage, update channels, IPC, traffic and client-side trust boundaries, so requests that mention these topics are the most likely to load it.
The skill tells the agent to first confirm that the target is a desktop thick client and not a pure web application. Give the agent the target type and scope up front so it does not have to ask.
- Example: I am authorized to test our company's Windows desktop client. Review its local storage and IPC for weaknesses using the thick-client checklist.
- Example: Audit my own Electron app's local data files and update channel for security issues.
- Example: Assess how this .NET WinForms client handles certificate pinning and what traffic it sends.
- Example: Walk through the trust boundaries of this Qt application and list what should be checked next.
Set up scope before testing
The skill tells the agent to record scope before doing anything else. That means noting where the installer came from and which test accounts are in use. Have these ready so the agent can write them down at the start of the session.
The skill also asks the agent to set up tools in order: the Burp upstream proxy, process monitoring and reverse-engineering tools.
- Installer source and version as obtained (record what you have; do not assume).
- Test accounts and their permitted use.
- Written authorization for the target.
Work through the checklist
The checklist in references/thick-client-checklist.md covers installation and uninstallation leftovers, auto-start and services, credential storage (DPAPI, Keychain or plaintext), update URLs and signature checks, certificate pinning and proxy friendliness, hidden features and debug menus, and local ports bound to 0.0.0.0.
Ask the agent to report each item as checked, not applicable or finding, with evidence for each finding. The skill's self-check asks whether the trust boundary was drawn and whether both local and network surfaces were covered.
- Installation and uninstallation residue, and required permissions.
- Credential storage: DPAPI, Keychain or plaintext.
- Update URL and signature verification.
- Certificate pinning and proxy behaviour.
- Local port binding, including 0.0.0.0.
What people use it for
- Reviewing a desktop app's local config files and credential storage for plaintext secrets.
- Checking whether an IPC endpoint or named pipe verifies who connects to it.
- Auditing an Electron app's update channel and code signing checks.
- Assessing whether a .NET client's certificate pinning can be observed through a proxy during authorized testing.
- Creating a checklist for a developer who wants to audit their own app's local storage and updates.
Frequently asked questions
How do I install the thick-client agent skill?
Download the ZIP for skills/thick-client from the directory page and unzip it so the thick-client folder with SKILL.md is in ~/.claude/skills/ or a project's .claude/skills/ folder. In the Claude apps, you can upload the ZIP under Settings → Capabilities → Skills.
Is the thick-client skill free?
The skill is published under the MIT licence. Check the licence file in the source repository for the full terms.
What do I need to use this skill?
You need an AI agent that supports skills and analysis tools such as Burp Suite or mitmproxy, Process Monitor, dnSpy, IDA or Ghidra, because the skill names them but does not install them. The skill also references companion skills and a field-journal file that are not included in the provided files.
Can I use it to test a web application?
No. The skill states that pure web applications are out of scope, and the agent must confirm that the target is a desktop application before it continues.
Does the skill run scripts or send network requests?
No. The skill does not run scripts and does not use the network. The tools it refers to, such as proxies and debuggers, are run by you.
What should I do before testing a client I do not own?
Do not test it unless you have written permission. The skill is built for offensive techniques such as bypassing client-side checks and certificate pinning, so it is meant only for authorized testing of software you own or are permitted to assess.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are a security tester with written authorization to assess a desktop or Electron, Qt or .NET application, or a developer who wants a checklist for auditing your own app's local storage, updates and IPC. Pick something else for web applications, or if you need a tool that installs and runs the analysis software for you, since this skill only provides instructions.
Download the skill