A comprehensive cybersecurity and CTF assistant providing direct CLI access to over 150 security tools for reconnaissance, exploitation, and forensics.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install hexstrike
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install hexstrike using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is HexStrike?
HexStrike is a high-performance security research and penetration testing module designed for Openclaw Skills. It bypasses restrictive middleware by providing direct execution access to a massive library of industry-standard security tools. Whether you are tackling a complex Capture The Flag (CTF) competition or performing a professional network audit, HexStrike streamlines the transition from reconnaissance to exploitation.
The skill is built on a methodology-first approach, ensuring that security professionals and researchers can follow structured workflows for web application testing, binary analysis, and cloud security assessments. By leveraging Openclaw Skills, HexStrike transforms your AI agent into a sophisticated red-team collaborator capable of handling everything from passive DNS enumeration to complex buffer overflow analysis.
HexStrike Use Cases
- Solving diverse CTF challenges including web, crypto, pwn, forensics, and reverse engineering.
- Executing comprehensive network reconnaissance and port scanning using industry-standard tools.
- Performing web application security audits, including SQL injection and XSS vulnerability assessments.
- Conducting digital forensics on memory dumps, disk images, and network traffic captures.
- Automating OSINT gathering and credential security testing within authorized environments.
- Assessing cloud infrastructure security across AWS, GCP, and Kubernetes environments.
How HexStrike Works
- Environment Triage: The workflow begins by running the tool-check script to verify the availability of installed security packages across specific categories like network or web.
- Category Identification: The agent analyzes target indicators (URLs, binary headers, or ciphertexts) to classify the engagement type and select the appropriate playbook.
- Methodology Reference: HexStrike consults internal reference docs such as the recon-methodology or ctf-playbook to ensure a structured, phased approach.
- Execution and Monitoring: Commands are executed directly via the CLI, utilizing background processes for long-running scans to maintain agent responsiveness.
- Data Management: Results are piped to structured files and filtered using stream editors to ensure large scan outputs remain digestible and actionable.
- Documentation: Findings are iteratively recorded to build a comprehensive map of the attack surface or challenge solution.
HexStrike Setup
To get started with HexStrike in your Openclaw Skills environment, ensure your host system (ideally Kali Linux or a Debian-based distro) has the necessary tools installed. Verify your setup with the following commands:
# Check the availability of all security tools
bash scripts/tool-check.sh
# Check for specific tool categories (e.g., network)
bash scripts/tool-check.sh network
# Install missing dependencies on Debian/Ubuntu systems
sudo apt install <package-name>
HexStrike Data Schema & Taxonomy
HexStrike organizes its security intelligence and tool outputs using a structured file-based taxonomy for maximum portability.
| Directory / File | Purpose |
|---|---|
references/ctf-playbook.md |
Methodology and hints for various CTF categories. |
references/recon-methodology.md |
Step-by-step phases for network and web penetration testing. |
references/tool-reference.md |
Syntax and flag documentation for 80+ core security tools. |
/tmp/ |
Default location for redirected tool outputs and scan logs. |
scripts/tool-check.sh |
Utility to audit the local environment for tool availability. |
HexStrike Advanced Features
- Background Process Handling: Execute long-running scans like full-port Nmap discovery as background tasks with polling intervals.
- Methodology-Driven Automation: Integrated playbooks that guide the agent through sophisticated multi-step exploitation chains.
- Direct Tool Access: Zero-middleware execution allows for full-featured use of complex CLI tools like sqlmap, nuclei, and gdb.
- Rate-Limited Scanning: Support for batch flags and timeout settings to ensure non-disruptive testing on sensitive targets.
- Scalable Tooling: Easily extendable to include custom Go, Python, or Ruby-based security tools via standard package managers.
SKILL.md
Loading
Related Openclaw Skills
Professional Image Editor Skill
A high-fidelity image post-processing engine for AI agents that uses ImageMagick to deliver lossless, iterative photo editing.
Orbit
A comprehensive integration skill for the Orbit community growth platform, enabling AI agents to manage organizations, track member engagement, and automate community workflows.
UniSkill V4
A high-performance, minimalist AI agent framework that uses Socratic questioning and multi-model debates to solve complex decision problems with 97% less code.
fox-veille: RSS Feed Aggregator & LLM Scorer
An intelligent RSS feed aggregator for Openclaw Skills featuring multi-layer deduplication and optional LLM-powered article scoring.
Side Hustle Analyst
A structured execution tracker that maintains state across a 28-day AI agent side hustle lifecycle to drive sequential business progress.
Hustle Scout
An AI-powered opportunity scanner designed to find and score monetizable gaps in the AI automation and digital product markets.
Featured*
