Menu
Security scanning via clearwing — source code vulnerability hunting and network pentesting.
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/ariadoss/superskills --skill pentestThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes
Use when you have a written implementation plan to execute in a separate session with review checkpoints
Use when executing implementation plans with independent tasks in the current session
Based on SOC occupation classification
Showing SKILL.md
| name | pentest |
| description | Security scanning via clearwing — source code vulnerability hunting and network pentesting. |
| allowed-tools | ["Bash","Read","Write","Grep","Glob"] |
Authorized security testing using clearwing.
Before any scanning, confirm authorization with the user. Ask:
If authorization is unclear, STOP and do not proceed.
Check if clearwing is installed:
command -v clearwing && clearwing --version
If not installed:
uv tool install clearwing
clearwing setup # Interactive LLM provider configuration
Requires: Python 3.10+, uv, Rust toolchain (for native bridge).
Hunt vulnerabilities in source code using the 11-stage pipeline:
# Standard depth — recommended starting point
clearwing sourcehunt <path-to-repo> --depth standard
# Quick scan — faster, less thorough
clearwing sourcehunt <path-to-repo> --depth quick
# Deep scan — comprehensive, takes longer
clearwing sourcehunt <path-to-repo> --depth deep
The pipeline: preprocess → rank files → generate fuzzing harnesses → tiered hunt (6 specialists) → adversarial verification → patch oracle → variant loop → exploit triage → auto-patch → report.
Evidence levels (ascending confidence):
suspicion — pattern match, needs investigationstatic_corroboration — confirmed by static analysiscrash_reproduced — fuzzer triggered a crashroot_cause_explained — mechanism understoodexploit_demonstrated — exploitability confirmedpatch_validated — fix verifiedScan a live target for service vulnerabilities:
# Single host
clearwing scan <target-ip-or-hostname>
# CIDR block (concurrent)
clearwing parallel <CIDR> --max-concurrent 5
Results are stored in SQLite and exported as:
For guided exploration:
clearwing interactive
clearwing interactive --resume <session_id>
clearwing ci --sarif-output results.sarif