Pentest-Skills
Ten pentest skills for Claude Code and Gemini CLI: recon, SQL injection, XSS, LFI and a report, driven by plain-language requests
- 357 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- The skills run scanners and injections against the named target, and without the owner's permission that is a crime in many countries
- LFI and SQL injection scenarios read server files and can change or corrupt data in a database
- Target addresses and found vulnerabilities are written to disk in the results database
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/pentest-skillsDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The skills run scanners and injections against the named target, and without the owner's permission that is a crime in many countries
- LFI and SQL injection scenarios read server files and can change or corrupt data in a database
- Target addresses and found vulnerabilities are written to disk in the results database
This is third-party code. Review the repository files before installing.
What it does
Pentest-Skills bundles ten skills that turn a plain-language request into calls to familiar pentest tools. Recon is handled by recon-port-scan (nmap, masscan, rustscan), recon-subdomain (subfinder, amass, dnsx), recon-dir-scan (ffuf, gobuster, feroxbuster) and recon-fingerprint (wafw00f, whatweb, nuclei, httpx). Vulnerabilities are checked by exploit-sqli built on sqlmap, exploit-xss (XSStrike, Dalfox, XSpear), exploit-lfi and exploit-file-download. Each skill consists of a SKILL.md with command templates, helper scripts in Python and Bash, reference documents and resources such as wordlists and payloads. The scanners themselves are not included and are installed separately. The results-storage skill keeps results in SQLite so they can be queried across sessions, and pentest-report builds a report from a template: a project table, a list of findings, and details with reproduction steps and fix recommendations.
Who it is for. Security testers and students running an authorized web application test or a CTF who want to give tasks to an agent without recalling scanner flags.
Good fit when
- An authorized web application test is under way and recon has to be quick: ports, subdomains, directories, fingerprints
- A training lab on localhost is checked for SQL injection and XSS while the agent picks working payloads
- Findings pile up in a SQLite database during testing and turn into a report at the end
- A command for nmap or ffuf is easier to describe in words than to remember
Not a fit when
- There is no written permission from the system owner: the authors state outright that unauthorized scanning is illegal
- The target is a live database or a production service: the exploit-sqli skill itself warns the test can damage or destroy data
- The report is needed in another language: the pentest-report template is written in Chinese and would have to be rewritten
- A test without a human in the loop is required: in the demo the agent finds the injection point and asks permission before running sqlmap
Example request
Scan localhost for open ports and identify the service versionsLimitations
The scanners are not included: nmap, subfinder, dnsx, ffuf, sqlmap and the rest are installed separately through apt, brew, go install or pip. Skills are connected by copying folders into ~/.claude/skills/; there is no plugin and no install command. The README and the pentest-report skill are written in Chinese, the other descriptions are in English. The project does not check that the target is yours: the person sets the scope of a test. Some scenarios, including log poisoning in exploit-lfi, lead to code execution on the target. The last commit in the repository is dated June 2026.
How to disable. The skills sit as ordinary folders in ~/.claude/skills/ or the project's .claude/skills/. Delete the skill folders and restart Claude Code. The SQLite database with results, if you created one, is deleted separately.
FAQ
How do I install Pentest-Skills in Claude Code?
Clone the repository with git clone, copy the skill folders into ~/.claude/skills/ and restart the IDE. After that a plain-language request, such as one about localhost ports, triggers the right skill.
Which tools are needed in addition?
nmap is required for port scans, subdomains need subfinder and dnsx, directories need ffuf, exploit-sqli needs sqlmap. Optional ones are masscan, amass, rustscan, dirsearch and gobuster. The README gives apt, brew and go install commands.
Does the agent attack the target on its own?
No, a person names the target. In the README demo the agent finds the injection point and asks permission to run sqlmap. A person confirms that the test is authorized.
Where are scan results stored?
The results-storage skill keeps a SQLite database with scan results and found vulnerabilities, and queries against it work across sessions. pentest-report builds the report from a template.
Which agents does the set work with?
Claude Code and Gemini CLI are stated. The repository topics add Codex CLI and OpenCode, but the README has no separate install steps for them.
Discussion
No questions or reviews yet.
Related
SkillsA Claude Code plugin with 15 agents and 63 attack categories for authorized penetration testing with sign-off.
Claude Code CyberSecurity Skills
Claude Code CyberSecurity Skill Collection
A set of 22 cybersecurity skills for Claude Code: recon, vulnerability assessment, incident response, red and blue team, malware analysis
Cybersecurity Skills
Cybersecurity Skills for AI Agents
42 security skills for Claude Code, Cursor and Codex: code and cloud audits, authorization-gated pentesting and incident response
A practical security skills base for agents: web, API, privilege escalation, Active Directory, mobile, binaries and crypto
CTF Skills
ctf-skills
Skills for solving CTF challenges: web, pwn, crypto, reverse engineering, forensics, OSINT, malware and ML attacks
A pack of about fifty Claude Code subagents for authorized pentesting: planning, recon, exploit research and chaining, post-exploitation, detection and reportin
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| Pentest-Skills (this card) | no | 357 | |
| Anthropic Cybersecurity Skills | no | 35,708 | a broad library covering forensics, response, cloud and malware, while this set covers only web recon and testing |
| claude-pentest | no | 133 | a plugin with agents and attack categories, while this is skill folders with scanner command templates |
README in short
The page is in Chinese with an English version alongside. It covers the idea of driving a pentest in words, a three-step install, tables of skills by stage, sample reports for port, subdomain and directory scans, tool requirements and a legal notice about the right to test.
README badge
Original SKILL.md
--- name: recon-port-scan description: Port scanning and service identification using nmap, masscan, and rustscan. Use this skill when user needs to discover open ports, identify running services, detect service versions, or fingerprint operating systems on target hosts. --- # Port Scanning / Reconnaissance ## Authorization Warning **IMPORTANT:** Port scanning without proper authorization is illegal. Always ensure you have: - Written permission from the target system owner - Defined scope of authorized testing - Legal compliance with local regulations ## Prerequisites Required tools that must be installed on your system: - **nmap** - `sudo apt install nmap` (Debian/Ubuntu) or `brew install nmap` (macOS) Optional tools: - **masscan** - High-speed port scanner - **rustscan** - Modern fast scanner with nmap integration ## Quick Start Most commonly used commands for port scanning: ### Fast Common Port Scan ```bash nmap -T4 -F <target> ``` Quick scan of top 100 common ports. ### Full Port Scan with Service Detection ```bash nmap -sV -sC -p- <target> ``` Scan all 65535 ports with version detection and default scripts. ### Stealth SYN Scan ```bash sudo nmap -sS -T2 -p- <target> ``` Stealthy scan (requires root). ### High-Speed Large Range Scan ```bash masscan -p1-65535 <target/CIDR> --rate=10000