Pentest Tool

Autonomous penetration testing framework. Claude acts as offensive security expert with independent decision-making. Provides methodology and principles, not command scripts. ALL commands must execute in kali-pentest container via 'docker exec kali-pentest <tool>'.

27 stars 4 forksSecurity

Install

skills CLI (Claude Code, Cursor, Codex and more)

npx skills add Jumbo-WJB/pentest-skills --skill pentest-tool

Manual install

git clone --depth 1 https://github.com/Jumbo-WJB/pentest-skills.git /tmp/pentest-skills
mkdir -p ~/.claude/skills
cp -r /tmp/pentest-skills/. ~/.claude/skills/pentest-tool

Personal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.

From the SKILL.md

# pentest-tool - Autonomous Security Assessment Framework

## ⚠️ ABSOLUTE RULE
**Every security tool MUST run in container**: `docker exec kali-pentest <command>`

## Core Philosophy: Think Like a Penetration Tester

### Claude's Role
You are an **autonomous penetration tester**, not a script executor. For each task:

1. **Analyze the objective** - What am I trying to achieve?
2. **Assess the situation** - What do I know about the target?
3. **Choose appropriate tools** - Which tools fit this scenario?
4. **Execute and observe** - What did the results tell me?
5. **Adapt strategy** - Did it work? If not, why? What should I try next?

**Never blindly follow fixed procedures** - each target is unique.

## Decision-Making Principles

### Principle 1: Adaptive Tool Selection
**Don't prescribe tools - reason about them:**

**Example Scenario**: User says "scan this web app for vulnerabilities"

**Wrong Approach** ❌:
```
Run: nikto -h <url>
Then: sqlmap -u <url>
Then: gobuster dir -u <url>
```

**Correct Approach** ✅:

Read the full skill on GitHub

Details

Skill name: pentest-tool
Repository: Jumbo-WJB/pentest-skills
Repo updated: 25 December 2025

FAQ

What does the Pentest Tool skill do?

How do I install the Pentest Tool skill?

skills CLI (Claude Code, Cursor, Codex and more): npx skills add Jumbo-WJB/pentest-skills --skill pentest-tool. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.

Is Pentest Tool popular?

It lives in Jumbo-WJB/pentest-skills, which has 27 GitHub stars and 4 forks.

Related skills

Slopsec

lachydotmcg/slopsec

Security audit and hardening for vibe-coded SaaS apps. Use when reviewing, securing, hardening, or pen-testing an app — especially AI-generated / vibe-coded / "shipped fast" projects (Next.js, Supabase, Firebase, Express, serverless). Triggers: "is my app secure", "security review", "harden this", "check for vulnerabilities", "I'm about to launch", "audit before deploy", "exposed secrets", "leaked API keys", "before I ship". Walks the 50 most common ways vibe-coded apps get owned and produces a prioritized fix list.

Security

Prism Scanner

aidongise-cell/prism-scanner

Security scanner for AI Agent skills, plugins, and MCP servers. Use when: user asks to scan a skill, check if a plugin is safe, vet an MCP server, review skill security, detect malicious code, supply chain safety, or says 'is this safe to install', 'scan this skill', 'check this MCP server', 'security scan', 'vetting', 'skill safety', 'prism scan', '安全扫描', '这个插件安全吗', '扫描一下', '检查安全性', '安装前检查', '技能审查'.

Security

Move Auditor

pantheraudits/move-auditor

Audits Move contracts (Sui & Aptos) for security bugs.

Security

R00 BehiSecc Awesome Claude Skills Security

freewaychameleonnode/r17-behisecc-awesome-claude-skills-security

🔒 Security & Compliance skill suite derived from BehiSecc/awesome-claude-skills. Security audits, vulnerability management, GDPR/SOC2/ISO27001 compliance and incident response. Provides 10 specialised commands for security, compliance, gdpr workflows.

Security

Security Research

rhysha/claude-security-research-skill

Full-spectrum security research skill for web servers, REST APIs, web applications, and network/port enumeration. Triggers whenever the user wants to: find vulnerabilities, run a security assessment, scan a target, test an API for security issues, enumerate ports or services, check for OWASP Top 10 vulnerabilities, audit auth/secrets, fuzz endpoints, run recon on a domain or IP, or use tools like nmap, nikto, nuclei, ZAP, sqlmap, ffuf, dalfox, subfinder, hydra, or trufflehog. Use this skill even if the user says "just a quick scan" or phrases it casually. Covers full engagement workflow: recon

Security

R00 Glebis Claude Skills Security

lavendertalesun/r20-glebis-claude-skills-security

🔒 Security & Compliance skill suite derived from glebis/claude-skills. Security audits, vulnerability management, GDPR/SOC2/ISO27001 compliance and incident response. Provides 10 specialised commands for security, compliance, gdpr workflows.

Security

Browse the most popular Claude skills, all security skills, or write your own with the skills generator.