Security Penetration Testing
This skill provides a hands-on methodology for offensive security testing, including OWASP Top 10 audits, static analysis, dependency scanning, secret detection, API and web vulnerability testing, and infrastructure checks. It produces structured findings and professional penetration test reports.
✨ What it does
- Generates OWASP Top 10 checklists and scans for vulnerabilities.
- Provides static analysis guidance with recommended tools and patterns.
- Scans dependencies for known CVEs and prioritizes remediation.
- Detects secrets in code and git history using TruffleHog and Gitleaks.
- Tests API security including JWT manipulation, IDOR, and rate limiting.
- Generates structured pen test reports with CVSS scoring and remediation steps.
🎯 When to use it
- When asked to perform a security audit, penetration test, or vulnerability scan on a web application, API, or infrastructure.
- When needing to check for OWASP Top 10 vulnerabilities or specific attack patterns like SQL injection, XSS, or SSRF.
- When a security review is required before a release or as part of a CI/CD pipeline.
- When generating a professional penetration test report from structured findings.
🚀 How to use
Trigger by asking for a security audit, penetration test, or vulnerability scan. Provide the target (URL, repository, or file) and scope. The skill uses scripts like vulnerability_scanner.py and dependency_auditor.py, and guides manual testing. Example prompts:
Run a quick security check on our staging web app.
Perform a full penetration test on the API and generate a report.
📄 Output: A penetration test report (markdown or JSON) with findings, severity, evidence, and remediation, or a checklist of vulnerabilities.
📦 Add this skill to Claude Code
# 1. Get the skills repo
git clone --depth 1 https://github.com/alirezarezvani/claude-skills /tmp/claude-skills
# 2. Copy this skill into your project (or ~/.claude/skills for all projects)
mkdir -p .claude/skills
cp -r /tmp/claude-skills/engineering-team/skills/security-pen-testing .claude/skills/security-pen-testingSkill source: engineering-team/skills/security-pen-testing/SKILL.md
⚠️ Good to know
Requires written authorization from the system owner before testing; unauthorized testing is illegal.
❓ FAQ
What is the difference between this skill and senior-secops?
This skill is offensive security testing to find vulnerabilities, while senior-secops is defensive security operations like monitoring and incident response.
What tools are recommended for secret scanning?
TruffleHog and Gitleaks are recommended for scanning git history and filesystems for secrets.
What is the mandatory workflow for vulnerabilities found?
Responsible disclosure is mandatory, with a standard timeline of reporting on day 1, follow-up at day 7, status update at day 30, and public disclosure at day 90.
🤖 Overview, features, install steps and FAQ were generated from the project's SKILL.md on Sep 4, 2026. Always check the original source before running commands.