How to use the Wireless Network Penetration Test agent skill

What this skill makes the agent do

An agent skill is a folder of instructions and optional scripts that an AI agent loads when a task matches its description. This skill gives the agent a structured playbook for testing the security of WiFi networks that you are authorized to assess.

The playbook covers wireless reconnaissance, capturing WPA2 handshakes or PMKIDs for offline cracking, testing enterprise (802.1X) and WPA3 transition configurations, evil twin access point scenarios with a captive portal, and checking whether a compromised wireless segment can reach internal systems. It also tests for rogue access points, captive portal bypasses, and the effectiveness of wireless intrusion detection systems.

• Scans for access points and records SSID, BSSID, channel and crypto type
• Flags rogue APs and evil twins by comparing results against known networks
• Checks whether wireless-to-wired segmentation is enforced
• Documents findings for a written report

Install the skill in Claude

You can install the skill in two ways. Download the ZIP file from this page and unzip it into one of these locations:

For a personal setup, unzip it into ~/.claude/skills/. For a single project, unzip it into the .claude/skills/ folder inside that project.

In the Claude apps, you can instead upload the ZIP under Settings, then Capabilities, then Skills.

• Personal: ~/.claude/skills/
• Project: .claude/skills/ inside your project folder
• Claude apps: Settings → Capabilities → Skills (upload the ZIP)

Set up the test environment

Before you ask for any wireless work, check that you have everything the skill lists as required. The skill is built for a Linux penetration testing environment and needs an external WiFi adapter that supports monitor mode and packet injection. The skill names the Alfa AWUS036ACH and TP-Link TL-WN722N v1 as examples.

The helper script in scripts/agent.py uses Scapy to sniff beacon frames, and it calls the aircrack-ng tools as subprocesses. The skill's API notes show the script being run after monitor mode is enabled on the adapter. Written authorization from the network owner must exist before testing starts.

• Kali Linux or an equivalent with aircrack-ng, hostapd, bettercap, hashcat, hcxdumptool and nmap
• External WiFi adapter supporting monitor mode and packet injection
• Python with Scapy for the helper script
• Written authorization that names target SSIDs, BSSIDs and test locations

How to trigger the skill with natural requests

You do not need a special command. Describe the job in plain language that includes the authorization and scope. The skill activates for requests about wireless pentesting, WiFi security assessment, WPA2 or WPA3 testing, and rogue access point detection.

Vague requests are less useful than specific ones. Name the networks in scope, the security type you expect, and what you want back, such as a report of findings.

• 'I have written authorization to test the CorpWiFi network at our Building 2 office. Assess its WPA2 configuration and report weaknesses.'
• 'Check our guest and IoT SSIDs for rogue access points against our AP inventory.'
• 'Review our WPA3 transition mode setup and tell me whether WPA2 clients could be downgraded.'
• 'Test whether our wireless segment can reach the internal database servers, within the authorized scope.'

Safety and scope notes

The skill itself says not to use it against wireless networks without written authorization from the network owner. It also says not to run jamming or denial-of-service attacks against wireless infrastructure unless explicitly authorized, and not to test anywhere wireless disruption could affect life-safety systems.

The steps describe real attacks on credentials and clients. Treat the scripts directory as tooling for authorized work only, and keep your authorization document with the test records. The skill's metadata says it runs scripts but does not use the network on its own.

• Get written authorization that names SSIDs, BSSIDs and locations
• Avoid jamming and deauthentication against production networks
• Skip sites where a wireless outage could affect life-safety systems
• Keep all captured data and reports under your engagement's rules

Tips for better results

Give the agent your scope and architecture up front. The skill expects you to know the target's SSIDs, authentication types and RADIUS infrastructure, so supplying those details lets the agent choose the right branch of the playbook.

Ask for the output in a form you can use. The helper script can write a JSON report when you pass an output file name, and the agent can summarize findings for a client.

• Name the authentication type (WPA2-Personal, WPA2-Enterprise, WPA3-SAE or transition) if you know it
• Provide a list of known SSIDs and BSSIDs so rogue detection has a baseline
• Ask the agent to document the attack path from wireless access to internal systems