Skip to content
Get packs

Guide · Agent skill

How to use the Wi-Fi Deauth Attack Playbook agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

The offensive-deauth-disassoc skill is a playbook that gives an AI agent detailed knowledge of deauthentication and disassociation attacks against 802.11 (Wi-Fi) networks. This guide explains what an agent skill is, how to install this one, how to ask for help in a way that triggers it, and the safety limits you must respect. It is written for authorized testers, security students working in a lab, and red teams writing reports on wireless detection.

Wi-Fi Deauth Attack PlaybookSnailSploit/Claude-Red · MIT

Quick start

  1. 1Confirm your setup. Check that you have Linux, the aircrack-ng suite, mdk4, a monitor-mode and injection-capable adapter, and root or sudo access. Confirm you have written authorization for the network you will test.
  2. 2Download the ZIP. Download the offensive-deauth-disassoc ZIP from the directory page. Keep the file somewhere you can find it.
  3. 3Install the skill. Unzip it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder, or upload the ZIP in the Claude apps under Settings → Capabilities → Skills.
  4. 4Start a new session. Open a fresh agent session so the skill is available to load.
  5. 5Describe your authorized goal. Explain the target, your authorization and the goal, such as checking PMF status or capturing a handshake from your own client in a lab.
  6. 6Review every command. Read each command the agent writes before running it, and confirm the BSSID, channel and interface are the ones you are authorized to test.
  7. 7Record the results. Write down the burst size, duration, observed effect and the detection signals a defender would have seen.

What an agent skill is and what this one makes the agent do

An agent skill is a folder containing a SKILL.md file. The file holds instructions the AI agent can load when a request matches the skill's description, so the agent has specialized guidance instead of only general knowledge.

This skill covers forged deauthentication and disassociation frames that knock clients off an access point. According to its description, it covers targeted single-client deauth to capture a WPA handshake, broadcast deauth for denial-of-service (with authorization), action-frame attacks against networks that use 802.11w (PMF), beacon flooding, and mdk4 and aireplay-ng tooling. It also explains how these bursts look to wireless intrusion detection systems (WIPS), and how to check whether an access point enforces PMF.

  • Checks PMF status of a target so you know whether classic deauth can work
  • Explains single-client versus broadcast scope and the trade-off in noise and impact
  • Describes action-frame, beacon-flood and mdk4 approaches for PMF-protected targets
  • Suggests what to record in a test report

What you need before you install

The skill's requirements are listed as Linux with the aircrack-ng suite (aireplay-ng and airodump-ng), mdk4 installed, a wireless adapter that supports monitor mode and packet injection, and root or sudo privileges. The skill itself does not run scripts and does not use the network, but the tools it tells the agent to use do need the hardware and privileges above.

Check your adapter's support for monitor mode and injection before you start. Without those capabilities, the commands the agent writes will not work on your machine.

  • Linux system with aircrack-ng suite installed
  • mdk4 installed
  • Wireless adapter capable of monitor mode and packet injection
  • Root or sudo privileges

How to install the skill step by step

You can install the skill in one of two ways. The first is to download the ZIP file from the directory page and unzip it into your personal skills folder, ~/.claude/skills/, or into a project's .claude/skills/ folder if you want it available only for that project. The second is to upload the ZIP in the Claude apps under Settings → Capabilities → Skills.

After installing, start a new session so the agent can see the skill. If you installed it in a project folder, open the agent from that project.

  • Option A: download the ZIP, unzip into ~/.claude/skills/ for personal use
  • Option B: unzip into a project's .claude/skills/ folder for project-only use
  • Option C: upload the ZIP in the Claude apps under Settings → Capabilities → Skills

How to trigger the skill with natural requests

You do not need special syntax. The agent decides whether to load a skill by matching your request against the skill's description, which mentions handshake capture, evil-twin roaming, targeted DoS, and testing PMF posture. State your goal, the context and the authorization in plain language so the agent has what it needs.

Good requests name the goal and the scope. For example, you might describe a lab with your own access point and ask how to test whether its clients fall back when PMF is enabled. Requests that only ask how to knock a neighbor's network offline will not be helped by this skill, and you should not make them.

  • Name the goal: handshake capture, PMF status check, or detection coverage report
  • State the authorization: written permission or your own lab equipment
  • Give the scope: single client or whole network, and the environment
  • Ask for a report structure if you need documentation for a client

Safety notes on scripts and network use

This skill runs no scripts and makes no network calls. Its risk comes from what the commands do on the air. Deauth and beacon-flood bursts can disconnect real users and overload wireless monitoring systems, so the skill's own guidance is to use broadcast deauth only with explicit authorization.

Do not test networks you do not own or lack written authorization to test, since this is illegal in most jurisdictions. Avoid production or public networks, where outages can reach emergency or business services. If your only goal is to secure your own Wi-Fi, this skill is the wrong tool because it provides no hardening steps.

  • Test only networks you own or have written authorization to test
  • Avoid production, public and emergency-service networks
  • Prefer single-client scope over broadcast when you can
  • Keep a record of every burst, its size and its duration

Tips for getting useful results

Run recon first. The skill's workflow starts by identifying the target client and access point (BSSID and channel) and checking PMF status, since that status determines which attack family can work at all. Tell the agent what you already observed so it does not repeat steps.

Use the report template the skill provides. Recording the target BSSID, ESSID, PMF status, burst size, observed effect and the detection signals a defender would have seen makes the results useful to the people who fix the network.

  • Give the agent the PMF status you already observed
  • Ask for the detection signals a defender would see, to improve reporting
  • Keep sessions focused on one target at a time

What people use it for

  • Testing whether a lab access point enforces PMF and how its clients respond
  • Capturing a WPA handshake from your own client device in a controlled lab
  • Writing a red team report on wireless detection and response coverage
  • Teaching 802.11 management-frame weaknesses in a university security course

Frequently asked questions

How do I install the offensive-deauth-disassoc skill?

Download the ZIP from the directory page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. You can also upload the ZIP in the Claude apps under Settings → Capabilities → Skills.

What do I need to run this skill?

You need Linux with the aircrack-ng suite, mdk4 installed, a wireless adapter that supports monitor mode and packet injection, and root or sudo privileges. The skill itself runs no scripts and uses no network.

Is the offensive-deauth-disassoc skill free?

The skill is published under the MIT licence, as stated on the source page. Check that licence text for the terms that apply to your use.

Can I use this skill on my neighbour's Wi-Fi?

No. Testing a network you do not own or lack written authorization for is illegal in most jurisdictions and can disrupt other people's connectivity. Use it only on networks you are authorized to test.

Why does the deauth attack fail on some networks?

If the access point requires PMF (802.11w), classic deauth frames are ignored, so the skill points to action-frame techniques instead. Checking PMF status with airodump-ng is the first step.

Does this skill help me secure my own Wi-Fi?

No. The skill is oriented toward offensive use and provides no hardening steps. For securing your own network, look for a defensive resource that covers access point configuration, including enabling PMF where your equipment supports it.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits authorized penetration testers, security students working in a lab, and red teams that need to document wireless detection coverage. It is a poor choice if you only want to secure your own Wi-Fi, or if you cannot test on equipment you are authorized to use, and it should never be pointed at networks you do not control.

Download the skill