Laazrk/shannon ? reverse-engineered prompt

Build me a local command line tool that can pentest my web app and API by reading the source code, finding likely attack paths, then actually trying the exploits against a running staging app so it only reports issues it can prove.

I want it to feel like a guided agent I can launch with one command, then point at a repo or workspace and let it run through setup, scan the code, test the live app, and generate a clean report of real findings, ideally with exportable results like a report file and something CI can use. It should be able to run in Docker, work with common AI providers, and fit into a developer workflow where I can test every build before it goes to production.

If there are safety limits or required credentials, make the setup clear and straightforward. Also include support for checking a specific PHP exploit chain mentioned in the docs if that’s part of the project.