Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
O comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.
Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.
Explorador de arquivos
22 arquivos
Exibindo SKILL.md
SKILL.md
Instruções da origem · Visualização somente leitura
name
pentest-toolkit
description
AI-Powered Security Testing Toolkit - Professional penetration testing scripts for discovering vulnerabilities, analyzing application structure, and generating context-aware security tests. All scripts return structured JSON for agent consumption.
allowed-tools
["Read","Grep","Glob","Bash(uv:*)"]
AI-Powered Security Testing Toolkit
A comprehensive penetration testing skill designed specifically for AI agents. This toolkit provides specialized scripts that perform intelligent security assessments and return structured JSON output for agent consumption. All scripts are designed for automated execution without human interaction.
🚀 AI Agent Scripts
All scripts are located in the scripts/ directory and return structured JSON output.
Discovery Scripts
discover_structure.py
Purpose: Blindly discovers API structure, data models, and business logic without source code access.
Usage:
uv run python ${CLAUDE_PLUGIN_ROOT}/skills/pentest-toolkit/scripts/discover_structure.py <TARGET_URL>
Purpose: Generates security reports from test results.
Usage:
uv run python ${CLAUDE_PLUGIN_ROOT}/skills/pentest-toolkit/scripts/generate_report.py <RESULTS_FILE>
Outputs:
security_report.md - Human-readable report
security_report.json - Machine-readable findings
🎯 AI Agent Workflows
Standard Security Assessment
# Step 1: Discover application structure
uv run python ${CLAUDE_PLUGIN_ROOT}/skills/pentest-toolkit/scripts/discover_structure.py https://target.com > structure.json
# Step 2: Analyze responses for patterns
uv run python ${CLAUDE_PLUGIN_ROOT}/skills/pentest-toolkit/scripts/analyze_responses.py structure.json > patterns.json
# Step 3: Generate targeted tests
uv run python ${CLAUDE_PLUGIN_ROOT}/skills/pentest-toolkit/scripts/generate_context_tests.py structure.json patterns.json > tests.json
# Step 4: Execute vulnerability tests
uv run python ${CLAUDE_PLUGIN_ROOT}/skills/pentest-toolkit/scripts/comprehensive_test.py https://target.com > vuln_results.json
# Step 5: Generate final report
uv run python ${CLAUDE_PLUGIN_ROOT}/skills/pentest-toolkit/scripts/generate_report.py vuln_results.json
API Security Testing
# Focus on API endpoints
uv run python ${CLAUDE_PLUGIN_ROOT}/skills/pentest-toolkit/scripts/discover_structure.py https://api.target.com > api_structure.json
# Test for API-specific vulnerabilities
uv run python ${CLAUDE_PLUGIN_ROOT}/skills/pentest-toolkit/scripts/test_sql_injection.py https://api.target.com/users
uv run python ${CLAUDE_PLUGIN_ROOT}/skills/pentest-toolkit/scripts/test_xss.py https://api.target.com/search
# Analyze API responses
uv run python ${CLAUDE_PLUGIN_ROOT}/skills/pentest-toolkit/scripts/analyze_responses.py api_responses.json
Business Logic Testing
# Discover business entities and relationships
uv run python ${CLAUDE_PLUGIN_ROOT}/skills/pentest-toolkit/scripts/discover_structure.py https://app.target.com > app_structure.json
# Generate business logic tests
uv run python ${CLAUDE_PLUGIN_ROOT}/skills/pentest-toolkit/scripts/generate_context_tests.py app_structure.json patterns.json > business_tests.json
# Execute with focus on authorization and workflow abuse
📚 Knowledge Base
Pattern Libraries
Located in patterns/ directory:
business_logic.json
Contains vulnerability patterns for:
Authorization bypasses
State manipulation
Workflow circumvention
Race conditions
Resource abuse
data_relationships.json
Contains patterns for:
Insecure direct object references
Foreign key manipulation
Junction table abuse
Hierarchical relationship attacks
Using Patterns with Agents
# Load business logic patternswithopen('patterns/business_logic.json', 'r') as f:
business_patterns = json.load(f)
# Generate tests based on discovered structure + patterns# This creates context-aware tests for the specific application
🔧 Script Execution Requirements
Critical: UV Usage
All scripts MUST use uv run python for proper dependency management:
# Correct
uv run python ${CLAUDE_PLUGIN_ROOT}/skills/pentest-toolkit/scripts/discover_structure.py https://target.com
# Incorrect - will fail
python ${CLAUDE_PLUGIN_ROOT}/skills/pentest-toolkit/scripts/discover_structure.py https://target.com
# Claude will automatically discover and use these scripts
skill: "pentest-toolkit"# Claude can execute:
uv run python ${CLAUDE_PLUGIN_ROOT}/skills/pentest-toolkit/scripts/discover_structure.py {{TARGET_URL}}
defbatch_assessment(targets):
results = {}
for target in targets:
# Run full assessment
assessment = security_assessment(target)
results[target] = assessment
# Learn from patterns for faster testing
update_knowledge_base(assessment)
return results
⚡ Performance Considerations
Caching
Structure discovery results can be cached
Pattern analysis is reusable across similar applications
Test generation is fast once patterns are understood
Parallel Execution
Multiple endpoints can be tested in parallel
Different vulnerability types can be tested simultaneously
Batch processing supported for multiple targets
Rate Limiting
Use conservative request rates when testing targets
Respect published rate limit headers and robots.txt as appropriate
Avoid denial-of-service conditions
🛡️ Security & Compliance
Authorization Testing Only
Only test systems you own or have explicit authorization to assess
Focus on discovery and validation, avoiding destructive payloads
Output Handling
Results may contain response data; handle and store securely
Avoid logging credentials or secrets; redact where necessary
Legal Compliance
Designed for authorized security testing only
Includes responsible usage validation
Supports compliance reporting
📊 Success Metrics
When scripts run successfully, agents should expect:
Structured JSON output with consistent schemas
Actionable findings with risk levels and remediation
Performance metrics for optimization
Error details for troubleshooting
🔗 Related Files
reference.md - Detailed API documentation
examples.md - Practical usage examples
templates/ - Reusable test templates and workflows
