The preview above is a clip. Click it for the full video.

A Claude Code plugin that runs a full pentest engagement from inside your coding agent. Point it at a target and it works through recon, deep testing, exploit verification, chain-building, judging, and writes a consolidated audit report to ./results/<target>/audit-report.md.

Every tool runs inside a per-engagement Kali Docker container. Each host working directory gets its own isolated sandbox, so two engagements never share state and nothing pentest-related touches your host.

• Docker, running. Docker Desktop on macOS/Windows, Docker Engine on Linux.
• A Claude Code (or other Agent Skills compatible) client.
• About 3 GB of disk for the Kali image, and roughly 200 MB of idle RAM per container.

You do not need to install nmap, nuclei, subfinder, or any other tool on the host. They all live in the container, which builds itself on first run.

Pick the method that fits how you want to use it. The skill resolves its own files across all of them, so any of these work.

/plugin marketplace add skshadan/kage
/plugin install kage@kage

Then invoke it with /kage:kage (plugin skills are namespaced as plugin:skill).

Point Claude Code at the plugin directory for the current session:

claude --plugin-dir /path/to/kage

Use /reload-plugins after edits. Invoked as /kage:kage.

If you prefer to type /kage without the namespace, copy just the skill folder into your skills directory:

cp -r /path/to/kage/skills/kage ~/.claude/skills/kage

It then loads as /kage in every session.

The first engagement builds the Kali image automatically (a one-time pull and build of a few minutes). To warm it ahead of time:

cd /path/to/skill/assets/docker && docker build -t kage:latest .

Optionally put the container shim on your PATH for the management commands below:

sudo ln -sf /path/to/skill/scripts/k /usr/local/bin/k

Run the agent from a clean engagement directory and call the skill:

cd ~/engagements/acme-audit
claude
> /kage:kage acme.com                 # full pipeline
> /kage:kage recon-only acme.com       # stop after recon
> /kage:kage greybox acme.com ./src    # black-box plus source context
> /kage:kage audit ./src               # white-box source audit only

The target can be a domain, URL, wildcard (*.example.com), or a local source path. Output lands at ./results/<target>/audit-report.md, with raw artifacts (nmap, nuclei, PoCs, verified exploits) under ./results/<target>/.

Drop a ./creds.md in the engagement directory before running and the skill reads it for target credentials, multi-account IDOR testing, and rules of engagement. A template lives at skills/kage/assets/creds.sample.md.

k ls       # list all kage containers
k reset    # remove this folder's container
k prune    # remove containers whose workspace directory no longer exists
k nuke     # remove every kage container

Full methodology is in skills/kage/references/methodology.md, judging rules in skills/kage/references/judging.md, and escalation patterns in skills/kage/references/chains.md.

kage/
├── .claude-plugin/        # plugin.json manifest and marketplace.json
└── skills/kage/
    ├── SKILL.md           # agent instructions
    ├── scripts/           # k shim, probe scripts, shared tls/browser client
    ├── agents/            # sub-agents: testers, verifier, chain-builder, judge, report-writer
    ├── references/        # methodology, judging, chains, report formatting, tools
    └── assets/            # Dockerfile, compose.yml, creds template, dorks, wordlists

Only test systems you own or have explicit permission to test. All output stays on your local filesystem. creds.md is bind-mounted into the container but never transmitted.

MIT