hackingtool plugin
hackingtool - Claude Code plugin
A Claude Code plugin wrapping 183 pentest and OSINT tools from Z4nzu/hackingtool, running them locally via Bash, WSL or Docker
- 1,165 ★ on the repository
- Last commit
Broad access
Why this level
- Runs pentest tools and network attacks on hosts, including scanners, exploits and secret handling
- Many commands need elevated privileges and act on real targets; use only with written authorization
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add plugins/hackingtool-claude-code-pluginDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Runs pentest tools and network attacks on hosts, including scanners, exploits and secret handling
- Many commands need elevated privileges and act on real targets; use only with written authorization
This is third-party code. Review the repository files before installing.
What it does
The plugin gives Claude Code a single skill backed by 183 pentest and OSINT tools drawn from the Z4nzu/hackingtool project: nmap, subfinder, httpx, nuclei, amass, holehe, maigret, trufflehog, sqlmap, impacket and more. Every call goes through the ht_run.py script, which picks a backend on its own, native Bash on Linux and macOS, WSL on Windows, or purpose-built Docker images, and returns output as structured JSON. Before work it runs ht_preflight.py to check what is available and recommend what to install. For a request such as domain recon or a username check, the agent picks a chain of tools and runs it. Tools are grouped by category: information gathering, port and vulnerability scanning, web attacks, SQL injection, secrets, Active Directory, forensics and others.
Who it is for. For security professionals and pentesters running authorized testing and OSINT from Claude Code.
Good fit when
- You need domain recon: subdomain enumeration, port scanning, web vulnerability checks
- You need OSINT on a username or email via holehe, maigret and similar
- You need to scan a repository or files for leaked secrets
Not a fit when
- You have no written authorization to test the target
- You cannot install Docker, WSL or security tools on the working machine
Example request
Run recon on example.com, which I am authorized to testLimitations
The plugin is intended only for authorized testing, bug bounty, CTF and research; responsibility for the legality of use rests with the user. It needs Python 3.10 or newer, and tools run natively, through WSL, or through Docker, with the Docker backend pulling kalilinux/kali-rolling on first use. Long-running tools block until they finish or time out. Tool readiness flags are heuristic, and some tools need sudo or manual environment setup.
How to disable. Remove the hackingtool plugin via /plugin, then optionally detach the hackingtool-marketplace. Pulled Docker images are removed with Docker's own tools.
FAQ
Is this legal?
The plugin targets authorized testing, bug bounty, CTF and research. Testing targets you do not own without written authorization is not allowed, and responsibility for use rests with the user.
Do I have to install all 183 tools?
No. Through ht_run.py the plugin picks and runs the specific tool for the task, pulling images and binaries as needed.
Discussion
No questions or reviews yet.
Related
PluginsA Claude Code plugin with 15 agents and 63 attack categories for authorized penetration testing with sign-off.
A Claude Code plugin with skills and tools for authorized IoT pentesting: network recon, firmware analysis, hardware access and mobile app analysis
A pack of about fifty Claude Code subagents for authorized pentesting: planning, recon, exploit research and chaining, post-exploitation, detection and reportin
A marketplace of 22 hook plugins for Claude Code: safety, cost control, observability and automation
An authorized bug-bounty suite: 50 subagents, 26 commands and 2 bug-bounty-platform MCP servers for Claude Code, Codex and five more agents
Ten pentest skills for Claude Code and Gemini CLI: recon, SQL injection, XSS, LFI and a report, driven by plain-language requests
README in short
The README describes a Claude Code plugin that wraps 183 pentest and OSINT tools from the Z4nzu/hackingtool project into a single skill. The ht_run.py script picks a backend, native Bash, WSL or Docker, maps known tools to purpose-built images and returns JSON output, while ht_preflight.py checks the environment. Tools are grouped into more than twenty categories, from information gathering and scanning to web attacks, forensics and Active Directory, with readiness flags. The plugin installs via the hackingtool-marketplace. MIT licensed, like the upstream Z4nzu/hackingtool.