Menu
Run an automated security assessment — find internet-exposed resources, attack paths, and network vulnerabilities.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Basé sur la classification professionnelle SOC
| name | pentest |
| description | Run an automated security assessment — find internet-exposed resources, attack paths, and network vulnerabilities. |
| user-invocable | true |
Run an automated security assessment to find internet-exposed resources and attack paths.
Read shasta.config.json for python_cmd. Use that for all commands (shown as <PYTHON_CMD>).
Run the assessment:
<PYTHON_CMD> -c "
import json
from shasta.config import get_aws_client
from shasta.aws.pentest import run_security_assessment, save_pentest_report
client = get_aws_client()
client.validate_credentials()
print('Running automated security assessment...')
report = run_security_assessment(client)
path = save_pentest_report(report)
print(json.dumps({
'report_path': str(path),
'exposed_resources': len(report.exposed_resources),
'attack_paths': len(report.attack_paths),
'network_findings': len(report.network_findings),
'resources': [{
'id': r.resource_id, 'type': r.resource_type,
'exposure': r.exposure_type, 'ports': r.ports[:10],
} for r in report.exposed_resources],
'paths': report.attack_paths,
}, indent=2))
"
Present like a pen test debrief: exposed resources, attack paths with risk ratings, remediation. Recommend running quarterly for audit evidence.
Deep code scan for AI security issues — prompt injection, PII in prompts, hardcoded keys, unguarded agents.
Run AI governance checks across cloud accounts and code repos — ISO 42001, EU AI Act, NIST AI RMF compliance.
Scan cloud accounts and GitHub repos to discover AI/ML services and build an AI system inventory.
Walk staged changes against the engineering principles checklist and report pass/fail per principle. Run before any non-trivial commit. Catches doc drift, stub functions, single-region defaults, missing framework mappings, and other regressions before they ship.
Generate a public-facing security trust page from scan data. Produces a single deployable index.html that shows compliance framework scores, security policies, infrastructure overview, and data protection posture. Deployable to S3, Vercel, Netlify, or GitHub Pages.
Paste a vendor's domain. Get a security risk assessment in 60 seconds.