transilienceai/communitytools

What it solves

This project provides a comprehensive suite of AI-powered security testing tools designed to automate the penetration testing lifecycle. It addresses the difficulty of scaling professional security assessments by providing structured skills and agent roles that cover the full spectrum of vulnerabilities, from reconnaissance and attack surface mapping to final reporting.

How it works

Built as a set of extensions for Claude Code, the system uses a "skills-only" architecture. It defines 26 specific security skills (e.g., injection, API security, AI threat testing) and three specialized agent roles: a coordinator, an executor, and a validator.

When a user triggers a pentest, the coordinator agent manages the workflow, spawning executor agents to perform specific attacks and validator agents to conduct blind reviews of the evidence. The system integrates with Playwright for browser automation and Kali Linux tools for network testing, utilizing a large library of reference files and payloads to identify vulnerabilities.

Who it’s for

• Penetration Testers: Professionals looking to automate repetitive parts of the security lifecycle.
• Bug Bounty Hunters: Researchers using platforms like HackerOne or HackTheBox.
• Security Researchers: Individuals testing AI-specific threats (OWASP LLM Top 10) or smart contract security.
• Ethical Hackers: Students and practitioners in CTF competitions.

Highlights

• Broad Coverage: 100% coverage of OWASP Top 10 and OWASP LLM Top 10.
• Multi-Agent Workflow: Uses a coordinator-executor-validator loop to ensure findings are validated independently.
• Professional Reporting: Generates branded PDF reports including CVSS 4.0 scores, CWE, and MITRE ATT&CK mapping.
• Extensive Knowledge Base: Includes over 160 reference files with integrated payloads from PayloadsAllTheThings.
• Platform Integrations: Dedicated workflows for HackerOne and HackTheBox automation.