Claude Pentest Skills

Structured web application penetration testing with OWASP methodology, curated payload references, 6-gate validation, and professional report generation

66 stars 12 forksSecurity

Install

skills CLI (Claude Code, Cursor, Codex and more)

npx skills add frendysanusi/claude-pentest-skills --skill claude-pentest-skills

Manual install

git clone --depth 1 https://github.com/frendysanusi/claude-pentest-skills.git /tmp/claude-pentest-skills
mkdir -p ~/.claude/skills
cp -r /tmp/claude-pentest-skills/. ~/.claude/skills/claude-pentest-skills

Personal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.

From the SKILL.md

# Claude Pentest Skills

Structured methodology, curated payload references, and strict validation processes for **authorized** web application penetration testing.

## When to use

Use this skill when performing authorized web application penetration testing. It provides:
- A structured engagement workflow: scope definition, reconnaissance, vulnerability hunting, finding validation, and report generation
- OWASP Web Security Testing Guide (WSTG) methodology with coverage tracking
- 18 vulnerability class references with PayloadAllTheThings links
- A 6-gate validation process that eliminates false positives
- Professional pentest report generation (markdown + PDF)

**Only use against systems you own or have explicit written authorization to test.**

## Instructions

### Standard Workflow

```
/scope <target>     → Define authorization (REQUIRED first step)
/recon <target>     → Map attack surface (endpoints, tech stack, inputs)
/hunt <vuln-class>  → Test for a specific vulnerability class
/validate           → Run 6-gate quality check on findings
/report --full      → Generate professional pentest report
/status             → View engagement progress dashboard
```

### Safety Rules (Non-Negotiable)

1. **Never** test without running `/scope` first
2. **Never** send requests to out-of-scope domains or paths
3. **Always** log every payload attempt before analyzing the response
4. **Stop and ask** the user if uncertain whether an action is in scope

Read the full skill on GitHub

Details

Skill name: claude-pentest-skills
Repository: frendysanusi/claude-pentest-skills
Repo updated: 12 September 2026

FAQ

What does the Claude Pentest Skills skill do?

Structured web application penetration testing with OWASP methodology, curated payload references, 6-gate validation, and professional report generation

How do I install the Claude Pentest Skills skill?

skills CLI (Claude Code, Cursor, Codex and more): npx skills add frendysanusi/claude-pentest-skills --skill claude-pentest-skills. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.

Is Claude Pentest Skills popular?

It lives in frendysanusi/claude-pentest-skills, which has 66 GitHub stars and 12 forks.

Related skills

Auditor Skill

solanabr/auditor-skill

**AUDIT SKILL** — Comprehensive on-chain Solana program auditor and full-stack security review for ANY programming language. USE FOR: auditing Solana/Anchor programs, reviewing smart contract security, checking for vulnerabilities (missing signers, unchecked accounts, arithmetic overflow, CPI attacks, PDA confusion, type cosplay, reinitialization, flash loan exploits, MEV, governance backdoors, timelock bypass), auditing TypeScript/Python/Go/Java/Ruby/PHP/any language, backend/frontend code review, supply chain safety, CI/CD and GitHub Actions workflow security (comment-triggered commands, pul

Security13

Security Guide

139

jnMetaCode/shellward

OpenClaw 安全部署指南 / Security deployment guide — help users secure their OpenClaw installation

SecurityIn 1 list23

Malware Analysis

gl0bal01/malware-analysis-claude-skills

Orchestrate the complete malware analysis lifecycle across triage, dynamic analysis, detection engineering, and report writing. Use as the single entry point for any malware analysis task — routes to specialized sub-skills by file type and phase, carries findings between phases, and supports multi-sample batch workflows.

Security

Find Bugs

1.1k

getsentry/skills

Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.

SecurityIn 1 list62

Secscan

atgreen/secscan-skill

In-session, token-efficient LLM security scan of a repo (SAST triage). A lightweight, native Claude Code pipeline — survey → threat-model → deep-dive → adversarial-verify → report — using Read/Grep/Glob (and optional subagents), no external tooling. Use when asked to "security scan", "find vulnerabilities", "SAST", "audit this code for security", or "secscan".

Security

VibeSec Skill

1.4k

BehiSecc/VibeSec-Skill

This skill helps Claude write secure web applications. Use this when working on any web application or when a user requests a scan or audit to ensure security best practices are followed.

SecurityIn 2 lists122

Browse the most popular Claude skills, all security skills, or write your own with the skills generator.