Pentest

This is a structured penetration testing workflow that follows the PTES methodology across seven phases, from scoping to exploitation to reporting. It enforces a strict "no exploit, no report" policy, meaning every finding needs a working proof of concept or it gets dropped. The output is a scored report (0-100 scale) with CVSS ratings and specific remediation steps. Honestly, the real value here is the forcing function: it delegates to specialist skills for SAST, mobile reversing, and logic flaws, then consolidates everything into audit-grade documentation. You'd use this when you need to produce evidence-backed security findings rather than just scanner output, though you'll need explicit authorization before running it against any target.

GitHub stars: 504
last updated: Jun 11, 2026

View on GitHub

Install

$ npx -y skills add hoangnguyen0403/agent-skills-standard --skill pentest --agent claude-code

Installs into .claude/skills of the current project.

Files

Pentest Skill

[!IMPORTANT] PTES-aligned adversarial security audit for backend, frontend, and mobile applications. Produces a CVSS-scored Hacker Report with verified PoCs and phased remediation.

Instructions

When the user asks to perform this workflow, execute the following steps:

🕵️‍♂️ Penetration Test (PTES-Aligned)

Goal: Execute a red-team assessment across backend, frontend, and mobile targets with verified PoCs and audit-grade evidence.

Steps

Scope and authorization:
- Determine mode (whitebox, greybox, blackbox) and targets.
- Verify explicit, current authorization, target exclusions, permitted techniques, time window and stop contact. Require demonstrated runtime controls for live actions; unsupported controls block execution, not offline planning.

SKILL.md on GitHub