csautter

LLM Pentest Juice Shop — Security skill for Claude Code

Security community

Demonstration of LLM coding agents performing automated black-box pentesting and white-box code review against OWASP Juice Shop, with consolidated security reporting.

How to install LLM Pentest Juice Shop

This entry records only its repository, not the path inside it, so there is no exact command to give. Open csautter/llm-pentest-juice-shop and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What LLM Pentest Juice Shop does

Demonstration of LLM coding agents performing automated black-box pentesting and white-box code review against OWASP Juice Shop, with consolidated security reporting.

Alternatives in Security

Skills Audit Report — Date: 2026-02-15 Auditor: Automated Skill Quality Audit Scope: Recently added skills in business-growth/, fina 5.3k ★
Promptmap — Security scanner for custom LLM apps 1.2k ★
Clawsec — Security skill suite with drift detection, automated audits, and skill integrity verification 798 ★

README

OWASP Juice Shop — LLM Security Demo Environment

A reproducible dev-container environment that demonstrates how an LLM coding agent can systematically find, exploit, and remediate web application vulnerabilities using [OWASP Juice Shop](https://github.com/juice-shop/juice-shop) as the intentionally-vulnerable target.

What this repo contains

Path	Purpose
`.devcontainer/`	Dev-container definition (Dockerfile + post-create hook). Installs the full security toolkit and clones Juice Shop.
`.agents/skills/blackbox-pentest/`	Black-box / DAST skill: recon → spidering → automated scanning → manual OWASP Top 10 tests.
`.agents/skills/whitebox-code-review/`	White-box / SAST skill: SAST (semgrep, njsscan) + SCA + secret scanning + manual class-by-class review.
`.agents/skills/security-assessment-orchestrator/`	Orchestrator: runs both skills, correlates/de-dupes findings, writes a consolidated report.
`PLAN_build-demo-environment.md`	Architecture/design decisions and implementation phases.
`SECURITY_CHECK_*.md`	Generated assessment reports (example outputs).

`juice-shop/`, `assess-out/`, and `bak/` are **git-ignored** — they live only in the local working tree and are never committed.

⚖️ Authorized-use notice

**All offensive-security tooling in this project is for authorized testing only.**

Only run these skills and tools against:

The local Juice Shop instance started by post-create.sh (default and intended target).
Systems you own or are explicitly authorized in writing (signed contract, scope agreement, or applicable law) to test.

You are solely responsible for ensuring your use is legal. Unauthorized scanning or exploitation is illegal in most jurisdictions and can cause real damage.