Agent skill

Infrastructure

by transilienceai in transilienceai/communitytools

Network infrastructure testing - port scanning, DNS attacks, MITM, VLAN hopping, IPv6, SMB/NetBIOS, sniffing, and DoS assessment.

MITAuto-check passedSecurity

Install Infrastructure

skills CLI
$ npx skills add transilienceai/communitytools --skill infrastructure -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install transilienceai/communitytools infrastructure --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/transilienceai/communitytools.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/infrastructure .claude/skills/infrastructure && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
infrastructure
GitHub stars
562
Token cost
~768 tokens
SKILL.md length
265 words
Files
59
Skills in repo
35
Repo updated
First seen
Licence
MIT

At a glance

Network infrastructure testing - port scanning, DNS attacks, MITM, VLAN hopping, IPv6, SMB/NetBIOS, sniffing, and DoS assessment.

  • Works in 5 steps: Network discovery and topology mapping → Port scanning and service enumeration → Protocol-specific vulnerability testing → …
  • Security work in your project
  • SKILL.md covers Techniques, Workflow and Reference
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Infrastructure is an agent skill from transilienceai/communitytools. Network infrastructure testing - port scanning, DNS attacks, MITM, VLAN hopping, IPv6, SMB/NetBIOS, sniffing, and DoS assessment.

Its SKILL.md is about 770 tokens, which your agent loads only when the skill is triggered. The skill folder holds 61 other files (for example `reference/ccsds-space-telecommand-quickstart.md`, `reference/dns-quickstart.md` and `reference/dos-quickstart.md`).

It sits in Security. The repository describes itself as: Open-source Claude Code skills, agents, and slash commands for AI-powered penetration testing, bug bounty hunting, and security research. The licence is MIT.

When your agent uses it

  • Security work in your project

Example prompts

  • “/infrastructure”

Requirements

  • Docker

Workflow steps

5 steps, taken from the first numbered list in SKILL.md.

  1. Network discovery and topology mapping
  2. Port scanning and service enumeration
  3. Protocol-specific vulnerability testing
  4. Network attack execution (authorized scope only)
  5. Evidence capture with packet captures and logs

What it can do on your machine

Read from SKILL.md and the folder at commit 95fdc12. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Infrastructure loads about 768 tokens when it runs. Until then it costs about 36 tokens; SKILL.md has 265 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~36
When it runs · the whole SKILL.md, loaded when a task matches
~768

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from transilienceai/communitytools at commit 95fdc12, republished under its MIT licence (© transilienceai). 265 words, ~768 tokens.

Download SKILL.mdSave it as .claude/skills/infrastructure/SKILL.md (or your agent's skills folder). This skill also uses 58 other files; get the full folder from GitHub.
name
infrastructure
description
Network infrastructure testing - port scanning, DNS attacks, MITM, VLAN hopping, IPv6, SMB/NetBIOS, sniffing, and DoS assessment.

Infrastructure

Test network infrastructure for vulnerabilities including network services, protocols, and perimeter security.

Techniques

TypeKey Vectors
Port ScanningSYN scan, UDP scan, service detection, OS fingerprinting
DNSZone transfers, cache poisoning, subdomain takeover, DNS rebinding
MITMARP spoofing, DNS spoofing, SSL stripping, LLMNR/NBT-NS poisoning
VLAN HoppingSwitch spoofing, double tagging
IPv6RA flooding, neighbor spoofing, tunneling attacks
SMB/NetBIOSNull sessions, relay attacks, enumeration
SniffingPacket capture, credential harvesting, protocol analysis
DoSResource exhaustion, amplification, application-layer
ICS/SCADAModbus TCP, PLC exploitation, coil/register manipulation, session hijacking
Space / CCSDSSatellite telecommand framing (Space Packet + TC Transfer Frame), APID/SCID/VCID routing, VCFC sequencing, CRC-16/CCITT, ASCII 0x%02x: command counters
UPnP / IoT / CPErootDesc/SCPD enumeration, vendor SOAP info disclosure (GetPassword), command injection via vendor actions, cross-action auth-key reuse
Hardware / EmbeddedLogic captures (Saleae .sal), CAN/UART decoding, side-channel password recovery, legacy CPU errata, i386 tools via docker

Workflow

  1. Network discovery and topology mapping
  2. Port scanning and service enumeration
  3. Protocol-specific vulnerability testing
  4. Network attack execution (authorized scope only)
  5. Evidence capture with packet captures and logs

Reference

Quickstart guides (per attack type):

  • reference/port-scanning-quickstart.md - Port scanning and service discovery
  • reference/dns-quickstart.md - DNS attacks and enumeration
  • reference/mitm-quickstart.md - Man-in-the-middle attacks
  • reference/vlan-hopping-quickstart.md - VLAN hopping techniques
  • reference/ipv6-quickstart.md - IPv6 attack vectors
  • reference/smb-netbios-quickstart.md - SMB/NetBIOS exploitation
  • reference/sniffing-quickstart.md - Network sniffing and capture
  • reference/dos-quickstart.md - DoS assessment
  • reference/ics-modbus-quickstart.md - ICS/SCADA Modbus PLC exploitation
  • reference/ccsds-space-telecommand-quickstart.md - Satellite CCSDS telecommand frame crafting (Space Packet + TC Transfer Frame)
  • reference/upnp-iot-quickstart.md - UPnP / IoT / CPE firmware web UI enumeration and exploitation
  • reference/hardware-embedded-quickstart.md - Logic captures, CAN/UART decoding, side-channel char-by-char recovery, legacy CPU bugs (6502), i386 tooling on ARM macOS

Scan techniques: reference/syn-scan.md, reference/udp-scan.md, reference/icmp-scan.md, reference/os-fingerprint.md Other: reference/firewall-detection.md, reference/service-enum.md, reference/ip-reputation.md, reference/overview.md

© transilienceai, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 58 other files in skills/infrastructure of transilienceai/communitytools.

  • SKILL.md
  • reference/ccsds-space-telecommand-quickstart.md
  • reference/dns-quickstart.md
  • reference/dos-quickstart.md
  • reference/firewall-detection.md
  • reference/hardware-embedded-quickstart.md
  • reference/icmp-scan.md
  • reference/ics-modbus-quickstart.md
  • reference/ics-protocols.md
  • reference/ip-reputation.md
  • reference/ipv6-quickstart.md
  • reference/mitm-quickstart.md
  • reference/os-fingerprint.md
  • reference/overview.md
  • reference/port-scanning-quickstart.md
  • reference/scenarios/dns/bind-tsig-key-hijack.md
  • reference/scenarios/dns/dns-cache-poisoning.md
  • reference/scenarios/dns/dns-rebinding.md
  • … and 41 more

Open the folder on GitHubat commit 95fdc12

Compare with similar skills

Infrastructure next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Infrastructure compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Infrastructure this skilltransilienceai/communitytools562—~768Automated safety check: PassMIT
Fla Ascend Performancefla-org/flash-linear-attention5.8k—~6.3kAutomated safety check: PassMIT
Deepsec Documentation Guidevercel-labs/deepsec8.1k—~956Automated safety check: PassApache-2.0
Skill Scannergetsentry/skills1k4 repos~2.5kAutomated safety check: WarnApache-2.0
Serenity Aleabitoreddityan-labs/serenity-aleabitoreddit4811 repos~3.3kAutomated safety check: PassNone
Security Alert Triageelastic/agent-skills5921 repos~3.5kAutomated safety check: NotesApache-2.0

Similar skills

  • Fla Ascend Performance

    fla-org/flash-linear-attention

    Guidelines for Ascend NPU kernel / Triton-Ascend backend performance work in the FLA repo.

    5.8k GitHub stars~6.3k tokensUpdated today
    SecurityAuto-check passed
  • Deepsec Documentation Guide

    vercel-labs/deepsec

    Official

    Points the agent at deepsec's own docs to answer questions about initializing, configuring, resuming, scanning with and extending the vulnerability scanner.

    8.1k GitHub stars~956 tokensUpdated 9 days ago
    SecurityAuto-check passed
  • Skill Scanner

    getsentry/skills

    Official

    Scan agent skills for security issues. An agent skill from getsentry/skills.

    1k GitHub starsUsed in 4 repos~2.5k tokens
    SecurityAuto-check: warnings
  • Serenity Aleabitoreddit

    yan-labs/serenity-aleabitoreddit

    Apply trader Serenity's (@aleabitoreddit) AI/semiconductor supply-chain analytical lens to US-stock ideas and market judgment.

    481 GitHub starsUsed in 1 repo~3.3k tokens
    SecurityAuto-check passed
  • Security Alert Triage

    elastic/agent-skills

    Official

    Triage Elastic Security alerts — gather context, classify threats, create cases, and acknowledge.

    592 GitHub starsUsed in 1 repo~3.5k tokens
    SecurityAuto-check: notes
  • Shiro Attack CLI

    SummerSec/ShiroAttack2

    当用户要求利用、检测或测试 Apache Shiro rememberMe 反序列化漏洞 (Shiro-550, CVE-2016-4437) 时使用。触发词包括 "Shiro"、"rememberMe"、"shiro attack"、"CVE-2016-4437"、"Shiro-550"、"爆破 Shiro key"、"利用 Shiro"、"Shiro…

    2.6k GitHub stars~945 tokensUpdated 4 mo ago
    SecurityAuto-check passed

More from transilienceai/communitytools

All 35 skills in this repo
  • Dfir

    transilienceai/communitytools

    Digital forensics and incident response - Windows event log analysis, PCAP forensics, filesystem artifact analysis, AD attack detection, and timeline correlation.

    562 GitHub stars~1.5k tokensUpdated 2 mo ago
    Auto-check passed
  • GitHub Workflow

    transilienceai/communitytools

    GitHub workflow automation — branching, committing, pushing, pull requests, issues, and code review.

    562 GitHub stars~812 tokensUpdated 2 mo ago
    Auto-check: notes
  • Pci Secure Software

    transilienceai/communitytools

    Automated PCI Secure Software Standard (SSS) v2.0 readiness gap-assessment of an application from its source code and documentation.

    562 GitHub stars~1.8k tokensUpdated 2 mo ago
    Auto-check passed
  • Protect With Password

    transilienceai/communitytools

    Generate ONE strong password and apply it to each referenced file (PDF, Word, Excel, PowerPoint, or any type).

    562 GitHub stars~583 tokensUpdated 2 mo ago
    Auto-check passed
  • Skill Update

    transilienceai/communitytools

    Skill creation, update and management — generates skill directory structure, validates against best practices, enforces line count limits.

    562 GitHub stars~1.2k tokensUpdated 2 mo ago
    Auto-check passed
  • Source Code Scanning

    transilienceai/communitytools

    Security-focused source code review and SAST. An agent skill from transilienceai/communitytools.

    562 GitHub stars~1.2k tokensUpdated 2 mo ago
    Auto-check: notes

Categories

Questions about Infrastructure

What does Infrastructure do?

Network infrastructure testing - port scanning, DNS attacks, MITM, VLAN hopping, IPv6, SMB/NetBIOS, sniffing, and DoS assessment. Infrastructure is an agent skill from transilienceai/communitytools. Network infrastructure testing - port scanning, DNS attacks, MITM, VLAN hopping, IPv6, SMB/NetBIOS, sniffing, and DoS assessment.

When should I use Infrastructure?

Infrastructure fits situations like: security work in your project.

How do I install Infrastructure in Claude Code?

Run `npx skills add transilienceai/communitytools --skill infrastructure -a claude-code`. Or copy the skill folder (skills/infrastructure in transilienceai/communitytools) into .claude/skills/infrastructure in your project. Claude Code loads it when a task matches its description.

How do I install Infrastructure in Codex?

Run `npx skills add transilienceai/communitytools --skill infrastructure -a codex`. Or copy the skill folder (skills/infrastructure in transilienceai/communitytools) into .agents/skills/infrastructure in your project. Codex loads it when a task matches its description.

Can I use Infrastructure in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add transilienceai/communitytools --skill infrastructure -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/infrastructure, .gemini/skills/infrastructure, .github/skills/infrastructure and .opencode/skills/infrastructure in your project.

What does Infrastructure need to run?

SKILL.md names no scripts, command-line tools or credentials: Infrastructure is instructions for the agent only. Our summary lists: Docker.

Does Infrastructure access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Infrastructure safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Infrastructure use?

Infrastructure is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Infrastructure use?

About 768 tokens (SKILL.md is roughly 3.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Infrastructure?

Skills that share tags, products or a category with Infrastructure: Fla Ascend Performance (fla-org/flash-linear-attention, 5.8k stars), Deepsec Documentation Guide (vercel-labs/deepsec, 8.1k stars), Skill Scanner (getsentry/skills, 1k stars) and Serenity Aleabitoreddit (yan-labs/serenity-aleabitoreddit, 481 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Infrastructure?

transilienceai (a GitHub organization) maintains it in transilienceai/communitytools, which has 562 GitHub stars. The repository holds 35 skills in this directory. The repository was last updated on July 29, 2026.

Source: transilienceai/communitytools on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.