essential-tools
Core pentesting tools and methodology - Burp Suite usage, Playwright automation, binary analysis, testing methodology, and professional reporting standards.
- Installs
- 188
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/transilienceai/communitytools --skill essential-tools- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads essential-tools automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Essential Tools
Core tools, methodology, and reporting standards for penetration testing.
Components
| Component | Purpose |
|---|---|
| Burp Suite | Proxy, scanner, intruder, repeater, sequencer |
| Playwright | Browser automation, evidence capture, SPA testing |
| Binary Analysis | Static analysis, reverse engineering, string extraction |
| Nuclei | Templated exposure & misconfiguration scanning |
| sslscan | TLS posture (protocols, ciphers, cert) |
| Methodology | PTES, OWASP WSTG, attack prioritization |
| Reporting | Professional report templates, PDF generation |
Reference
reference/essential-skills*.md- Burp Suite techniques and web security testing methodologyreference/playwright-automation.md- Playwright MCP usage for pentestingreference/binary-analysis-quickstart.md- Static analysis for executable files and reverse engineeringreference/web-application-attacks.md- Web application attack methodologyformats/transilience-report-style/pentest-report.md- Finding quality standards, compliance mapping, and pre-delivery checklist
Required-at-start tooling (web/API engagements)
Run an availability check before declaring recon complete:
command -v subfinder nuclei sslscan httpx; curl -s "https://crt.sh/?q=%25.${DOMAIN}&output=json" | head -c1
- Subdomain/CT enum: subfinder, certspotter, crt.sh
- TLS posture: sslscan
- Templated exposure: nuclei
If a tool-class is unavailable, record it as an explicit limitation — NEVER declare recon COMPLETE having skipped a whole class. Hand-rolled urllib is not a substitute (see skills/coordination/reference/principles.md 'Real tools before hand-rolled HTTP').
FAQ
What does the essential-tools skill do?
Core pentesting tools and methodology - Burp Suite usage, Playwright automation, binary analysis, testing methodology, and professional reporting standards.
How do I install essential-tools?
Run npx skills add https://github.com/transilienceai/communitytools --skill essential-tools in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/essential-tools/ (personal) or .claude/skills/essential-tools/ (project).
Which AI agents can use essential-tools?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is essential-tools safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains essential-tools?
It is published by transilienceai in transilienceai/communitytools. It has 188 recorded installs.
More from transilienceai/communitytools
attack-path-stitcher
transilienceai/communitytools
Stitches confirmed single-asset findings into multi-hop attack paths across the organization. Builds a graph where nodes are assets and edges are confirmed exploit hops citing the findings that enable them.
blockchain-security
transilienceai/communitytools
Smart contract security testing and blockchain CTF exploitation. Covers Solidity vulnerability analysis, EVM storage manipulation, delegatecall attacks, CREATE/CREATE2 address prediction, and common DeFi exploit patterns. Use when analyzing Solidity contracts, solving blockchain challenges, or testing smart contract security.
hackerone
transilienceai/communitytools
HackerOne bug bounty automation - parses scope CSVs, deploys parallel pentesting agents per asset, validates PoCs, and generates platform-ready submission reports.
reconnaissance
transilienceai/communitytools
Open the skill to read its SKILL.md instructions.
cve-poc-generator
transilienceai/communitytools
Open the skill to read its SKILL.md instructions.
Popular testing & qa skills
tdd
mattpocock/skills
Test-driven development. Use when the user wants to build features or fix bugs test-first, mentions "red-green-refactor", or wants integration tests.
grilling
mattpocock/skills
Grill the user relentlessly about a plan, decision, or idea. Use when the user wants to stress-test their thinking, or uses any 'grill' trigger phrases.
migrate-to-shoehorn
mattpocock/skills
Migrate test files from as type assertions to @total-typescript/shoehorn. Use when user mentions shoehorn, wants to replace as in tests, or needs partial test data.
run-train
lllllllama/rigorpilot-skills
Rigor Train skill for deep learning research repositories. Use when a documented or selected training command should be run conservatively for startup verification, short-run verification, full kickoff, or resume, with command, config, seed, log, checkpoint, status, and metric evidence written to standardized trainoutputs/. Do not use for environment setup, exploratory sweeps, speculative idea implementation, or end-to-end orchestration.
test-driven-development
obra/superpowers
Use when implementing any feature or bugfix, before writing implementation code
finishing-a-development-branch
obra/superpowers
Use when implementation is complete, all tests pass, and you need to decide how to integrate the work