security-pen-testing

name	security-pen-testing
description	Use when the user asks to perform security audits, penetration testing, vulnerability scanning, OWASP Top 10 checks, or offensive security assessments. Covers static analysis, dependency scanning, secret detection, API security testing, and pen test report generation.
zh_description	用于安全、pen、测试，支持安全扫描、审计、加固和风险治理。
version	1.0.1
author	alirezarezvani
source	github:alirezarezvani/claude-skills
source_url	https://github.com/alirezarezvani/claude-skills/blob/main/engineering-team/skills/security-pen-testing/SKILL.md
license	MIT
tags	["security", "penetration-testing", "owasp", "vulnerability-scanning", "offensive-security", "agent-skill"]
created_at	2026-06-01
updated_at	2026-06-16
quality	4
complexity	intermediate

Security Penetration Testing

Hands-on offensive security testing skill for finding vulnerabilities before attackers do. This is NOT compliance checking (see senior-secops) or security policy writing (see senior-security) — this is about systematic vulnerability discovery through authorized testing.

---

Table of Contents

• Overview
• OWASP Top 10 Systematic Audit
• Static Analysis
• Dependency Vulnerability Scanning
• Secret Scanning
• API Security Testing
• Web Vulnerability Testing
• Infrastructure Security
• Pen Test Report Generation
• Responsible Disclosure Workflow
• Workflows
• Anti-Patterns
• Cross-References

---

Overview

What This Skill Does

This skill provides the methodology, checklists, and automation for offensive security testing — actively probing systems to discover exploitable vulnerabilities. It covers web applications, APIs, infrastructure, and supply chain security.

Distinction from Other Security Skills

Skill	Focus	Approach
security-pen-testing (this)	Finding vulnerabilities	Offensive — simulate attacker techniques
senior-secops	Security operations	Defensive — monitoring, incident response, SIEM
senior-security	Security policy	Governance — policies, frameworks, risk registers
skill-security-auditor	CI/CD gates	Automated — pre-merge security checks

Prerequisites

All testing described here assumes written authorization from the system owner. Unauthorized testing is illegal under the CFAA and equivalent laws worldwide. Always obtain a signed scope-of-work or rules-of-engagement document before starting.

---

OWASP Top 10 Systematic Audit

Use the vulnerability scanner tool for automated checklist generation: