Penthera

Offline cyber security agent for the user's own apps and AI coding tools, run locally with the Penthera CLI; open R&D, measured in public. Sets it up in one command ("set up penthera in this repo"). Scans the user's own live URL and repo (TLS, headers, auth, OpenAPI, secrets incl. AI keys, opt-in injection); checks npm and Python dependencies offline ("is this dependency safe?", "what changed in my deps?", "install X safely", "any AGPL in our deps?"); blocks secrets and risky agent config before commit ("add a pre-commit hook"); audits AI tooling ("audit my MCP servers / skills / hooks", "chec

78 stars 13 forksAI, LLMs & Agents

Install

skills CLI (Claude Code, Cursor, Codex and more)

npx skills add danoszz/penthera --skill penthera

Manual install

git clone --depth 1 https://github.com/danoszz/penthera.git /tmp/penthera
mkdir -p ~/.claude/skills
cp -r /tmp/penthera/skills/penthera ~/.claude/skills/penthera

Personal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.

From the SKILL.md

# Penthera Security Scanner

Lightweight security scanner for URLs, local repos, and (macOS) machine audits. Always run the authorization gate before any scan.

## Critical: Authorization gate

**Do not run Penthera until authorization is confirmed.**

Before the first scan in a session, ask the user to confirm ONE of:

1. They **own** the target (app, server, project).
2. They have **written authorization** from the system owner.
3. The target is **localhost** or a private lab they control.

If the user requests scanning a third-party domain (e.g. `google.com`, `example.com`) without claiming ownership or authorization, **stop and refuse**. When in doubt, do not scan.

For full policy, see [references/authorization.md](references/authorization.md).

## Preflight

Run before the first scan:

```bash
bash <this skill's folder>/scripts/preflight.sh [URL]
```

Run it from the user's project folder: it creates `reports/` there. The skill's folder is where this SKILL.md is (in a Penthera checkout, `skills/penthera`). Pass the target URL to warn on non-localhost targets. Fix any errors before proceeding.

## Resolve CLI command

Use whichever is available:

```bash
penthera --version          # installed (npm install -g penthera@2.1.2, or npm link)
npx -y penthera@2.1.2 --version   # nothing installed: npx fetches it
node bin/penthera.js --version   # from a Penthera checkout
```

Read the full skill on GitHub

Details

Skill name: penthera
Repository: danoszz/penthera
Path: skills/penthera/SKILL.md
License: MIT
Repo updated: 31 October 2026
Listed in: VoltAgent/awesome-agent-skills

FAQ

What does the Penthera skill do?

How do I install the Penthera skill?

skills CLI (Claude Code, Cursor, Codex and more): npx skills add danoszz/penthera --skill penthera. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.

Is Penthera popular?

It lives in danoszz/penthera, which has 78 GitHub stars and 13 forks, and is included in 1 curated skill list.

Related skills

Cida

108

mizzlelover/cida

辞达 · 现代中文高质量对话型表达与平台内容设计引擎。用于中文写作、重写、润色、诊断、口述/访谈成文、书面自然化、公众号/小红书/知乎/微博/视频口播/播客/社群等场景适配，以及按用户真实文本校准个人风格。先确定事实与立场边界，再建立平台任务契约、比较表达策略、设计读者价值兑现，最后完成文本质量与平台适配双自检。不做去AI味检测对抗、虚假钩子、平台流量承诺或任何在世作者的个人风格模仿。

AI, LLMs & Agents

Claude for Safari

100

SDLLL/claude-for-safari

Control the user's real Safari browser on macOS through AppleScript, page JavaScript, screenshots, and carefully verified System Events input. Use when an agent needs to inspect or operate the user's existing Safari tabs and login sessions, including reading pages, navigating, clicking, filling non-sensitive forms, taking screenshots, observing page-level fetch/XHR metadata, or troubleshooting Safari-specific UI behavior.

AI, LLMs & Agents16

Fable Mode

106

cozytab/fable5-mode

A work-discipline protocol that makes Opus 4.8 (or any non-frontier model) operate at Fable-5-grade quality. Core idea — output quality = model capability x work discipline: spend extra orchestration to buy single-pass quality via six levers (plan gate, small-card execution, adversarial self-check, real-product verification, context hygiene, checkpoint autonomy). Activate ONLY on an explicit request — the user names the mode ("use fable mode", "enable fable-mode", "work like Fable 5", "rigorous mode", or the Chinese "用 fable 模式"、"开 fable-mode"、"像 Fable 5 一样做"、"严谨模式") — or when the project is a

AI, LLMs & Agents

Prompt Sensei

109

chengzhongwei/Prompt-sensei

Stage-aware prompt coaching, prompt improvement, lookback analysis, prompting habit feedback, and local reports about prompt quality for AI coding agents such as Claude Code or Codex.

AI, LLMs & Agents10

Reap

thousandflowers/skillreaper

Report how much of the context this agent loads is never used - unused skills, MCP servers, subagents, hooks and always-loaded prose - measured from real session transcripts. Use when asked why the context window is full, what is wasting tokens, or what is safe to remove.

AI, LLMs & AgentsIn 2 lists

Okf Generator

110

UmairBaig8/okf-generator

Generate OKF (Open Knowledge Format) v0.2 knowledge bundles from codebases, and look up exact concepts for AI agent context injection. Use this skill whenever the user wants to: index a codebase, generate OKF bundles, extract code knowledge into structured markdown, convert codebases into training data, look up functions/classes/modules by name, prime an AI agent with codebase context, or integrate codebase knowledge with OpenCode or other AI coding agents. Also trigger for phrases like "index my code", "generate knowledge bundle", "extract codebase concepts", "what does X class do", or "look

AI, LLMs & Agents10

Browse the most popular Claude skills, all ai, llms & agents skills, or write your own with the skills generator.