diff --git a/capabilities/web-security/agents/web-security.md b/capabilities/web-security/agents/web-security.md
index 1ee185b..6fd1e3c 100644
--- a/capabilities/web-security/agents/web-security.md
+++ b/capabilities/web-security/agents/web-security.md
@@ -110,6 +110,7 @@ Any tool that scans, fuzzes, or floods runs on shared local hardware. Cap concur
 - Use the local `pacu` CLI when an authorized test yields AWS credentials, cloud metadata access, or another AWS-impact lead that needs validation. Load the `pacu-aws-exploitation` skill first, confirm AWS scope, and start with identity/read-only enumeration before any mutating module.
 - When the target accepts or extracts archive uploads (ZIP, TAR, etc.), use the local `archive-alchemist` CLI at `~/git/archivealchemist/archive-alchemist.py` to craft malicious archives. Load the `archive-path-traversal` skill for the full attack pattern catalog and iterative workflow.
 - Use `exif_read`, `exif_write`, `exif_strip`, and `exif_copy` for EXIF/XMP/IPTC metadata manipulation on image and document files. Primary use cases: injecting XSS payloads into metadata fields (Comment, Artist, Copyright, ImageDescription) that get rendered by the target, crafting images with SSRF-triggering metadata for server-side processing, testing whether upload handlers strip metadata, and transplanting payloads between file formats. Strip metadata first with `exif_strip` to create a clean baseline, then inject specific payloads with `exif_write`.
+- The `stegano` Python library is available for LSB steganography on PNG images. Use it via `python` to hide payloads inside image pixel data (`from stegano import lsb; lsb.hide("input.png", "payload").save("output.png")`) or reveal hidden data (`lsb.reveal("output.png")`). Useful for testing whether upload pipelines re-encode images (destroying LSB data), smuggling payloads past content inspection that only checks metadata/headers, and verifying image processing side-effects.
 - Use `log_image_output`, `log_audio_output`, and `log_video_output` when another tool has already written useful PoC media to disk and you need it attached to the current Dreadnode run as typed output. Use `log_file_artifact` when you want the raw file uploaded as an artifact instead of rendered media.
 - When a finding is browser-visible or a screenshot materially improves reproducibility, capture the screenshot and attach it to the run. Treat screenshot logging as standard evidence collection, not an optional flourish.
 - Use `bbscope_find` at the start of an engagement to check if a target is covered by any bug bounty program and retrieve scope boundaries. Use `bbscope_program` to get full in-scope/out-of-scope details for a specific program. Use `bbscope_targets` to enumerate targets by type (wildcards, domains, URLs, IPs, CIDRs) for reconnaissance. Use `bbscope_updates` to find freshly added targets that may be under-tested.
diff --git a/capabilities/web-security/capability.yaml b/capabilities/web-security/capability.yaml
index 2c81e30..8528ffb 100644
--- a/capabilities/web-security/capability.yaml
+++ b/capabilities/web-security/capability.yaml
@@ -25,7 +25,7 @@ description: >
   exploitation with Pacu, phone verification, vulnerability
   verification, IP rotation helpers (Flareprox, fireprox), archive
   extraction vulnerability crafting with archivealchemist, EXIF
-  metadata manipulation via exiftool, and AgentMail email inboxes for
+  metadata manipulation via exiftool, LSB steganography via stegano, and AgentMail email inboxes for
   agent-owned signup, recovery, and verification flows.
 
 produces:
@@ -143,6 +143,7 @@ dependencies:
     - "caido-sdk-client>=0.3.0"
     - "cryptography>=41.0"
     - "pydantic>=2.0"
+    - "stegano>=0.11"
   scripts:
     - scripts/install_tools.sh
 
@@ -253,3 +254,4 @@ keywords:
   - censys
   - distributed-routing
   - caido
+  - steganography