samklee1

Web Pentest — Security skill for Claude Code

Security community

An experimental Claude Code skill for orchestrating authorized web application penetration tests on Kali Linux.

How to install Web Pentest

This entry records only its repository, not the path inside it, so there is no exact command to give. Open samklee1/web-pentest and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Web Pentest does

An experimental Claude Code skill for orchestrating authorized web application penetration tests on Kali Linux.

Alternatives in Security

FastAPI Review — Review a FastAPI application for architecture, async correctness, dependency injection, Pydantic schemas, secu 243.5k ★
Free Code — The free build of Claude Code 8.1k ★
Anthropic Cybersecurity Skills — 734+ structured cybersecurity skills for AI agents · MITRE ATT&CK mapped · agentskills.io open standard · Work 3.8k ★

README

web-pentest

An experimental Claude Code Skill that orchestrates authorized web application penetration tests on Kali Linux. The lead agent plans, dispatches, and reviews; Opus sub-agents run every scan and exploit. The methodology follows PTES with difficulty-aware planning (TDA/EGATS), browser-first exploration, two-layer review (per-sub-agent + phase-level), a destructive-operations gate, an optional cross-model gap-audit layer (GPT/codex via `codex-plugin-cc`), mandatory KB updates with a reviewer-compliance transition gate, and hard-stop checkpoints at every phase transition.

⚠️ **Authorized testing only.** This skill is for engagements where you have written authorization — employee scope, SoW with a client, or a documented bug bounty program. Using it outside an authorized scope is illegal. Read the [Responsible Use](#responsible-use) section before you run anything.

Architecture at a glance

The skill is structured as a **router + enforced contract**. `SKILL.md` is the short orchestration file the lead agent reads at session start. The hard rules all live in `references/enforcement-contract.yml` — a machine-validated list where every rule either names the script that enforces it or is explicitly marked prose-only (so weak rules are visible). Sub-agent prompts are never hand-assembled: `scripts/build_prompt_pack.py` reads `references/registry.yml` and composes every bundle deterministically with a manifest recording source hashes and per-section token counts. A fixture-based regression harness under `tests/` locks in the behavior of every enforcement script.

SKILL.md                          the router (389 lines)
references/
  enforcement-contract.yml        the "law" — 20 rules, 15 blocking
  enforcement-contract.md         human index
  registry.yml                    single source of truth for agents, KB inputs,
                                  recipes, dependencies, canonical enums
  output-contract.yml             required outputs pe