Prohao42/aimy-skill

What it solves

aimy-skill is an AI-native penetration testing toolkit designed to automate the process of finding vulnerabilities (bug hunting) and executing attack chains. It bridges the gap between AI agents and security tools by providing a standardized interface that allows AI to perform complex security tasks—from reconnaissance to weaponization—without requiring custom development for each tool.

How it works

The toolkit operates as a set of "skills" (103 in total) and CLI commands (87) that can be called by AI agents (like Claude Code, AutoGPT, or Cursor) or manually by a user. It uses a unified check() interface that returns structured JSON, making it easy for AI to parse and act upon.

Its architecture consists of several layers:

• Discovery & Recon: Port scanning, directory fuzzing, and crawling.
• Injection Detection: Specialized modules for SQLi, XSS, SSRF, Command Injection, and more.
• Authentication & Logic: Tools for JWT analysis, auth bypass, and business logic flaw detection (e.g., race conditions).
• Weaponization: Modules to extract data from SQLi or move laterally via SSRF.
• WAF Bypass: A fingerprinting system and 16 encoders to evade security filters.
• Orchestration: An engine that can chain these stages into a fully automated "hunt" or "deep scan" process.

Who it’s for

• Penetration Testers: To automate the full attack chain and generate reports.
• AI Agent Developers: Who need a plug-and-play security toolkit with structured outputs.
• Security Researchers: For deep weaponization and WAF bypass testing.
• CTF Players: For rapid vulnerability verification.
• Enterprise Security Teams: To integrate automated security pipelines into CI/CD.

Highlights

• AI-Agent Native: Designed specifically for AI agents with structured JSON outputs and a unified API.
• Comprehensive Attack Chain: Covers everything from reconnaissance and injection to weaponization and WAF bypass.
• Advanced SQLi Engine: Supports blind SQLi with binary search, OOB channels, and DBMS-specific payload libraries.
• WAF Evasion: Includes 14 WAF fingerprints and multiple encoding strategies.
• Automated Workflows: Features deepscan and autohunt commands for end-to-end automated penetration testing.