penetration-testing
Perform basic penetration testing and security assessments. Use reconnaissance, vulnerability discovery, and exploitation techniques. Use when validating security controls or assessing system security.
How do I install this agent skill?
npx skills add https://github.com/bagelhole/devops-security-agent-skills --skill penetration-testingIs this agent skill safe to install?
- Gen Agent Trust Hubpass
The skill provides a educational framework and command examples for conducting authorized penetration testing and security assessments. It presents a low risk of indirect prompt injection as it processes user-provided targets through powerful network and system tools without explicit sanitization or boundary markers.
- Socketwarn
1 alert: gptSecurity
- Snykpass
Risk: LOW · No issues
- Runlayerwarn
1/1 file flagged
- ZeroLeakspass
Score: 93/100 · 2 sections analyzed
What does this agent skill do?
Penetration Testing
Validate security controls through authorized testing.
Phases
pentest_phases:
1_reconnaissance:
- Passive information gathering
- DNS enumeration
- Network mapping
2_scanning:
- Port scanning
- Service identification
- Vulnerability scanning
3_exploitation:
- Attempt exploitation
- Verify vulnerabilities
- Document findings
4_post_exploitation:
- Privilege escalation
- Lateral movement
- Data access
5_reporting:
- Document findings
- Risk assessment
- Remediation recommendations
Reconnaissance
# DNS enumeration
dig example.com ANY
host -l example.com
# Subdomain discovery
subfinder -d example.com
# WHOIS
whois example.com
Scanning
# Port scan
nmap -sV -sC -p- target.com
# Web scanning
nikto -h https://target.com
dirb https://target.com
# Vulnerability scan
nmap --script vuln target.com
Web Testing
# SQL injection test
sqlmap -u "http://target.com/page?id=1"
# XSS testing
# Use Burp Suite or manual testing
# Directory traversal
curl "http://target.com/file?path=../../../etc/passwd"
Rules of Engagement
scope:
in_scope:
- target.com
- api.target.com
out_of_scope:
- production-db.target.com
- third-party services
testing_window: "Weekdays 2-6 AM UTC"
emergency_contact: "security@target.com"
Best Practices
- Always get written authorization
- Define clear scope
- Document everything
- Report critical findings immediately
- Safe exploitation techniques only
Related Skills
- dast-scanning - Automated testing
- vulnerability-scanning - Vulnerability discovery
How can the creator link this skill?
Add the canonical catalog link to the repository README so users can inspect current installs and available audits. The publishing guide covers the complete discovery path.
<a href="https://skillzs.dev/skills/bagelhole/devops-security-agent-skills/penetration-testing">View penetration-testing on skillZs</a>