Guide · Agent skill
How to use the Offensive WPS Attack Methodology agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The offensive-wps skill is a playbook that gives an AI agent a structured methodology for assessing the WPS (Wi-Fi Protected Setup) feature on wireless routers. It is written for penetration testers, security students and red teams who have written authorization to test a network. After this guide you will know what the skill covers, how to install it, how to ask for it in plain language, and what you need in place before using it.
Offensive WPS Attack MethodologySnailSploit/Claude-Red · MIT Download the skill Quick start
- 1Download the ZIP. Get the offensive-wps skill as a ZIP file from our page.
- 2Unzip into a skills folder. Place the folder in ~/.claude/skills/ for personal use, or in a project's .claude/skills/ folder for one project.
- 3Or upload in the Claude apps. Open Settings, go to Capabilities, then Skills, and upload the skill.
- 4Confirm your authorization. Make sure you have written permission to test the target network before you begin.
- 5Prepare your Linux test environment. Set up a Linux machine with a monitor-mode and packet-injection capable adapter and the listed tools.
- 6Ask a specific question. Describe your authorized scope and what you need, such as assessing WPS on in-scope access points.
- 7Document results. Record scope, findings and evidence for your report, and verify tool flags against each tool's documentation.
What the skill makes the agent do
WPS is a convenience feature that lets a device join a Wi-Fi network with a short PIN or a button press. The skill explains how the PIN mechanism works, how WPS-enabled access points are detected, and how the methodology is ordered: check for the easiest-to-test conditions first, then move to slower options.
The skill covers several topics: detecting WPS-enabled access points, an offline attack against vulnerable chipsets, online PIN guessing with reaver and bully, lockout handling, push-button (PBC) exposure, and deriving the Wi-Fi password from a recovered PIN. Because it is written as an offensive methodology, the agent's guidance will be oriented toward testing the network, not hardening it. The skill says it does not cover mitigation such as disabling WPS in depth.
- Detection of WPS-enabled access points and their WPS status
- Chipset-based assessment of the offline method
- Online PIN testing with reaver and bully, including lockout considerations
- Push-button exposure and PIN-to-password derivation
Install the offensive-wps skill
Download the skill as a ZIP file from our page. Unzip it so the skill folder sits in your skills directory. For a personal setup, use ~/.claude/skills/. For a single project, put it in that project's .claude/skills/ folder instead, so it only loads when you work in that project.
If you use the Claude apps rather than a local setup, open Settings, go to Capabilities, and upload the skill under Skills. The skill's main instructions are in a file called SKILL.md, which is the only file in this package.
- Personal use: unzip into ~/.claude/skills/
- Single project: unzip into the project's .claude/skills/ folder
- Claude apps: Settings → Capabilities → Skills, then upload
Trigger the skill with natural requests
You do not need a special command. An agent loads a skill when your request matches its description. This skill's description mentions WPS, Wi-Fi Protected Setup, Pixie Dust, reaver, bully and SOHO routers that expose WPS, so questions that involve those topics are the ones that will engage it.
State your context in the request. Mentioning that you have written authorization and that the target is in a lab you own helps the agent frame its answer around an approved engagement. Vague requests are less useful than specific ones about the device, the scope and the question you need answered.
- Examples: "I'm on an authorized engagement. Walk me through assessing WPS on the access points in scope."
- Examples: "Which WPS-enabled APs in my lab are worth checking first, and why?"
- Examples: "Explain how lockout policies affect online WPS testing so I can write it into my report."
What you need before you start
The skill assumes a Linux environment with a wireless adapter that supports monitor mode and packet injection. It refers to the aircrack-ng suite (airmon-ng and airodump-ng), and to the reaver, bully, wash and pixiewps tools. The optional wpspin tool is used for PIN candidate calculation. The skill does not run scripts and does not use the network itself; the tools you install do the work.
Authorization is not optional. The skill is for networks you own or have explicit written permission to test. Testing a Wi-Fi network you do not control is illegal in most jurisdictions.
- Linux with a monitor-mode and packet-injection capable wireless adapter
- aircrack-ng suite, reaver, bully, wash, pixiewps
- Optional: wpspin for PIN candidates
- Written authorization for the target network
Safety notes and when to choose another option
The skill is an attack methodology. It is not the right tool for everyday problems. If you are a home user who forgot your own Wi-Fi password, the router's admin page is simpler and safer. If you are a defender looking for hardening steps, this skill does not cover mitigation in depth, so use guidance aimed at defenders instead.
Be deliberate about disruption. The skill itself notes that rebooting an access point is only appropriate when you are authorized for that disruption, and that testing can trigger administrator attention. Agree on timing and scope with the network owner before any testing begins.
- Do not test networks without explicit written permission
- Agree on disruption limits, such as resetting or rebooting access points, in advance
- Record your scope and results so the engagement is reproducible and reportable
Tips for getting useful results
Ask the agent to explain its reasoning, including why a step comes before another. The skill is organized around trying low-impact conditions first, so questions about ordering and trade-offs tend to get the most useful answers.
Keep your own notes. Treat the agent's output as a starting point for your methodology and check it against the official documentation for each tool you use, since tool behaviour and flags can change.
- Name the device model and firmware if you have them, since chipset and vendor details affect the analysis
- Ask for report-ready summaries of findings and their evidence
- Verify tool flags against each tool's own documentation
What people use it for
- Structuring a written WPS section for a Wi-Fi penetration test report
- Planning an assessment of consumer routers in an approved red team engagement
- Teaching wireless assessment concepts to security students in a lab they own
- Reviewing how lockout policies on access points affect online testing scope
Frequently asked questions
How do I install the offensive-wps skill?
Download the ZIP from our page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. You can also upload it in the Claude apps under Settings, then Capabilities, then Skills.
What do I need to run the offensive-wps skill?
You need a Linux environment with a wireless adapter that supports monitor mode and packet injection, plus the aircrack-ng suite, reaver, bully, wash and pixiewps. wpspin is optional for PIN candidates. The skill itself runs no scripts and uses no network.
Is the offensive-wps skill free to use?
The skill is published under the MIT licence, which is stated on its source listing. Check the licence file in the source repository for the full terms before you reuse it.
Can I use this skill on my neighbour's Wi-Fi or a network I don't own?
No. The skill is for networks you own or have explicit written permission to test. Accessing a Wi-Fi network without permission is illegal in most jurisdictions.
What should I use if I just forgot my own Wi-Fi password?
Use your router's admin page, which is simpler and safer than an attack methodology. This skill is aimed at penetration testers and security students, not home password recovery.
How is this different from simply running reaver or bully?
Reaver and bully are tools. This skill is a methodology that tells the agent how to order the work, what conditions to check first, how lockouts affect the approach, and how to frame results. It does not replace knowing how those tools behave.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits penetration testers, security students and red teams who have written authorization to assess WPS on wireless routers and want a structured, offensive-focused methodology from an AI agent. It is the wrong choice for home users recovering their own password, for anyone without permission to test the network, and for defenders who need mitigation guidance such as disabling WPS.
Download the skill