penetration-testing

Q: How do I install penetration-testing?

Run npx skills add https://github.com/bagelhole/devops-security-agent-skills --skill penetration-testing in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/penetration-testing/ (personal) or .claude/skills/penetration-testing/ (project).

by bagelholeSecurity

Perform basic penetration testing and security assessments. Use reconnaissance, vulnerability discovery, and exploitation techniques. Use when validating security controls or assessing system security.

Installs: 374
Last 24h: —
Trending rank: —
Security: Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/bagelhole/devops-security-agent-skills --skill penetration-testing

01
Install
Run the command in your project. The CLI asks which agents to install for.
02
Describe the task
Ask your agent for something this skill covers. It loads penetration-testing automatically when relevant.
03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

Penetration Testing

Validate security controls through authorized testing.

Phases

pentest_phases:
  1_reconnaissance:
    - Passive information gathering
    - DNS enumeration
    - Network mapping
    
  2_scanning:
    - Port scanning
    - Service identification
    - Vulnerability scanning
    
  3_exploitation:
    - Attempt exploitation
    - Verify vulnerabilities
    - Document findings
    
  4_post_exploitation:
    - Privilege escalation
    - Lateral movement
    - Data access
    
  5_reporting:
    - Document findings
    - Risk assessment
    - Remediation recommendations

Reconnaissance

# DNS enumeration
dig example.com ANY
host -l example.com

# Subdomain discovery
subfinder -d example.com

# WHOIS
whois example.com

Scanning

# Port scan
nmap -sV -sC -p- target.com

# Web scanning
nikto -h https://target.com
dirb https://target.com

# Vulnerability scan
nmap --script vuln target.com

Web Testing

# SQL injection test
sqlmap -u "http://target.com/page?id=1"

# XSS testing
# Use Burp Suite or manual testing

# Directory traversal
curl "http://target.com/file?path=../../../etc/passwd"

Rules of Engagement

scope:
  in_scope:
    - target.com
    - api.target.com
  out_of_scope:
    - production-db.target.com
    - third-party services
  
  testing_window: "Weekdays 2-6 AM UTC"
  emergency_contact: "security@target.com"

Best Practices

Always get written authorization
Define clear scope
Document everything
Report critical findings immediately
Safe exploitation techniques only

Related Skills

dast-scanning - Automated testing
vulnerability-scanning - Vulnerability discovery

FAQ

What does the penetration-testing skill do?

How do I install penetration-testing?

Run npx skills add https://github.com/bagelhole/devops-security-agent-skills --skill penetration-testing in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/penetration-testing/ (personal) or .claude/skills/penetration-testing/ (project).

Which AI agents can use penetration-testing?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is penetration-testing safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains penetration-testing?

It is published by bagelhole in bagelhole/devops-security-agent-skills. It has 374 recorded installs.