CD pentest-lyan

授权 Web 渗透测试 Skill。模型自主威胁建模，JSON Schema 校验状态文件结构，输出按功能列出测了哪些威胁。 Use when user asks to perform authorized web penetration testing, vulnerability assessment on a web application, security testing with an explicit target URL, or asks to evaluate web application security posture. Do NOT use for unauthorized penetration testing, mobile app security testing, infrastructure or network scanning, social engineering, or general security advice without a specific target.

ClawHub Agent Skills author: InkLin v1.0.0 MIT-0 30 files body ≈ 2 368 tokens Open the sourceclawhub.ai↗ analyzed 3 d ago

授权 Web 渗透测试 Skill。模型自主威胁建模，JSON Schema 校验状态文件结构，输出按功能列出测了哪些威胁。 Use when user asks to perform authorized web penetration testing, vulnerability assessment on a…

As a process D 47/100 · Unfinished process — weak spots: result and completion, inputs and preconditions, failures and branches

Analyzer Word Securitytype and topics are labelled automatically from the skill text

Runs in: OpenClaw Claude / Claude Code ChatGPT / Codex Gemini CLI Cursor GitHub Copilot / VS Code Qwen Code Kimi Code CLI Z.ai (GLM) DeepSeek (Deep Code) Mistral Vibe LangChain (deepagents) Goose OpenCode

JSON

Technical rating

73/100

safety, quality, tests

Safety 60%: 61
Quality 40%: 90
Run on models: none yet

Process rating

47/100

Unfinished process

Result and completion w 14: 0
Inputs and preconditions w 11: 0
Failures and branches w 10: 0

the three weakest of ten parameters · all ten

How to improve

For the model run — optional

Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.

Guard findings · 39

✓ No critical or high findings

Medium and low: 39

low Risky intent intent-offensive-security gates.md:9

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition)

本 Skill 仅用于已获授权的安全测试场景。用户调用 `/pentest-lyan <target>` 即视为已确认对该目标拥有合法授权(内部评估 / 授权渗透 / CTF / 靶场 / 安全研究)。模型据此直接执行, 不在每个操作前重复确认授权状态。

detector

low Risky intent intent-offensive-security README.md:1

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
# Pentest Lyan v2.3
```
low Risky intent intent-offensive-security README.md:44

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
/pentest-lyan https://target.example.com
```
low Risky intent intent-offensive-security README.md:55

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition)
```
- `/pentest-lyan <target>` — 新项目,project-id 默认从 hostname 第一段提取
```
detector
low Risky intent intent-offensive-security README.md:56

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition)
```
- `/pentest-lyan --resume <id>` — 断点续测
```
detector
low Risky intent intent-offensive-security README.md:57

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)
```
- `/pentest-lyan --list` — 列所有项目 + 阶段 / 状态 / 漏洞数
```
quoted
low Risky intent intent-offensive-security references/attack-guide.md:48

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
SESS=$(jq -r ".accounts[] | select(.role==\"$role\") | .cookie_value" pentest-data/{project-id}/sessions/pool.json)
```
low Risky intent intent-offensive-security references/discovery-guide.md:22

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)
```
2. **建项目目录**:`mkdir -p pentest-data/{project-id}/`
```
quoted
low Risky intent intent-offensive-security references/discovery-guide.md:24

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)
```
3. **登记项目清单** `pentest-data/index.json`(**根目录,不在子目录内**):
```
quoted
low Risky intent intent-offensive-security references/discovery-guide.md:27

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition)
```
- 有 + `target` 相同 → **续测**:Read `pentest-data/{id}/state.json` 断点恢复,跳到对应阶段
```
detector
low Risky intent intent-offensive-security references/discovery-guide.md:31

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)
```
4. 之后所有状态文件写到 `pentest-data/{project-id}/` 下。
```
quoted
low Risky intent intent-offensive-security references/discovery-guide.md:57

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)
```
把这些记录到 `pentest-data/{project-id}/js_analysis.json`：
```
quoted
low Risky intent intent-offensive-security references/docx-template.md:62

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)
```
1. 按上述结构写交付件内容,Write 成临时 `pentest-report/{project-id}-deliverable-tmp.md`(首部必须 `# 标题` + `>` 引用块 + `---`)
```
quoted
low Risky intent intent-offensive-security references/docx-template.md:63

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)
```
2. 执行 `python3 scripts/render_docx.py pentest-report/{project-id}-deliverable-tmp.md pentest-report/{project-id}-{系统名}-pentest-{YYYYMMDD}.docx`
```
quoted
low Risky intent intent-offensive-security references/docx-template.md:65

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)
```
4. 确认 `SAVED` 后删除临时 md:`rm pentest-report/{project-id}-deliverable-tmp.md`
```
quoted
low Risky intent intent-offensive-security references/docx-template.md:66

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
5. 最终 pentest-report/ 留:完整报告 `.md` + 交付件 `.docx`
```

low Risky intent intent-offensive-security references/post-delivery.md:9

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)

**更新项目清单**:Audit 完成 → 更新 `pentest-data/index.json` 中本项目的 `status=completed` + `vulns_confirmed`(= summary.json `confirmed_vulns.length`) + `system_name` + `last_active`(`date -Iseconds`)。

quoted

low Risky intent intent-offensive-security references/post-delivery.md:13

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)

- [警告] **凭据清理**:`pentest-data/{project-id}/sessions/account_*.json` 含明文 Token / Cookie,建议交付后清理或加密存储。确认 `pentest-data/` 在 `.gitignore` 内(见 `templates/.gitignore`)。

quoted

low Risky intent intent-offensive-security references/post-delivery.md:14

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)
```
- [警告] **报告含敏感信息**:`pentest-report/*.docx` 含完整请求响应(含 Authorization 头),交付时加密 / 内网传输。
```
quoted
low Risky intent intent-offensive-security references/post-delivery.md:29

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)
```
- [ ] 文件名规范 `{project-id}-{系统名}-pentest-{YYYYMMDD}.md`,保留不删
```
quoted

low Risky intent intent-offensive-security references/post-delivery.md:46

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

- [ ] 流程:写交付件 tmp.md → `python3 scripts/render_docx.py <tmp.md> <输出.docx>` → 确认 `SAVED` → `rm` tmp.md。pentest-report/ 最终留完整报告 `.md` + 交付件 `.docx`。失败先 `pip3 install python-docx`。

low Risky intent intent-offensive-security references/report-template.md:12

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
{工作目录}/pentest-report/{project-id}-{系统名}-pentest-{YYYYMMDD}.md     ← 完整技术报告(内部)
```
low Risky intent intent-offensive-security references/report-template.md:13

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
{工作目录}/pentest-report/{project-id}-{系统名}-pentest-{YYYYMMDD}.docx   ← 交付件(给客户)
```

low Risky intent intent-offensive-security references/schema-guide.md:9

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)

存储根目录:`{工作目录}/pentest-data/{project-id}/`。**多项目隔离**:每个项目一个子目录(project-id 命名),根目录 `pentest-data/index.json` 是项目清单。project-id 默认从 target hostname 第一段提取(`bi-fine-sit.agibot.com` → `bi-fine-sit`),可 `--pro

quoted

low Risky intent intent-offensive-security references/schema-guide.md:15

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)

多项目管理入口。位置:`pentest-data/index.json`(**根目录,不在项目子目录内**)。Discovery 建项目时初始化,每次进入项目更新, Audit 完成时回填状态。详见 [`schema/index.schema.json`](schema/index.schema.json)。

quoted

low Risky intent intent-offensive-security references/schema-guide.md:68

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (documentation table row)
```
| `project_id` | string | 本项目 project-id,对应 `pentest-data/{project-id}/`;默认 target hostname 第一段,`--project` 可覆盖 |
```
table

low Risky intent intent-offensive-security references/schema-guide.md:294

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)

**凭据安全**:`account_*.json` 含明文 Token / Cookie,`pentest-data/` 必须加入 `.gitignore`(见 [templates/.gitignore](templates/.gitignore));凭据位于 `pentest-data/{project-id}/sessions/`,per-project 隔离。测试结束清理流程见 `refe

quoted

low Risky intent intent-offensive-security skill-card.md:3

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

Pentest Lyan guides authorized web application penetration testing with threat modeling, JSON Schema-backed state tracking, cross-role validation, and Markdown or DOCX reporting.

low Risky intent intent-offensive-security skill-card.md:31

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

Mitigation: Keep pentest-data and pentest-report out of shared or synced folders, use test accounts where possible, and redact, encrypt, revoke, or delete artifacts after use.

low Risky intent intent-offensive-security skill-card.md:39

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
- [ClawHub skill page](https://clawhub.ai/ink5725/skills/pentest-lyan)
```

low Risky intent intent-offensive-security skill-card.md:60

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

**Other Properties Related to Output:** [Creates per-project pentest-data state and pentest-report artifacts; reports may contain credentials and full request/response evidence.]

low Risky intent intent-offensive-security SKILL.md:2

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
name: pentest-lyan
```
low Risky intent intent-offensive-security SKILL.md:5

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
Use when user asks to perform authorized web penetration testing, vulnerability assessment on a web application,
```
low Risky intent intent-offensive-security SKILL.md:7

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
Do NOT use for unauthorized penetration testing, mobile app security testing, infrastructure or network scanning,
```
low Risky intent intent-offensive-security SKILL.md:15

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)
```
tags: ["pentest", "web-security", "vulnerability-assessment", "authorized-testing"]
```
quoted
low Risky intent intent-offensive-security SKILL.md:18

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
# Pentest Skill v2
```
low Risky intent intent-offensive-security test-results.md:1

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
# Skill Test Report: pentest-lyan
```
fixture
low Risky intent intent-offensive-security test-results.md:25

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (documentation table row; test fixture / example file)
```
| 1 | 启动测试后要求生成状态文件 | `pentest-data/{project}/state.json` 等文件存在 | 待测 | ⏳ |
```
tablefixture
low Risky intent intent-offensive-security test-results.md:31

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file; quoted — discussed, not commanded)
```
- [x] 文件夹名 `pentest-lyan` 为 kebab-case
```
fixturequoted

Files scanned: 28. Evidence is masked. Grey chips explain why severity was lowered.

Against the Agent Skills spec

✓ No remarks against the Agent Skills spec

Process rating: all ten parameters 47/100

0Result and completion. Does not say what the result is
0Inputs and preconditions. Does not say what the process needs to start
0Failures and branches. Linear process with no failure handling
0Progress reporting. Says nothing while it works
30Running it twice. 2 mutating operations with no state check
50When it triggers. No condition that starts the skill
60Tools and files. Uses tools (bash, web, python) that frontmatter does not declare
100Steps. 50 steps
100Consistency. Name and required fields are in place
100Execution cost. Instruction body is 2368 tokens

low 12 top-level sections: this looks like several domains in one skill

Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.

Quality signals

+5Description has no quoted example phrases that should trigger the skill
+3Output format is not stated: the model decides each time
-31 of 1 scripts are never mentioned in SKILL.md
+2Single-language instructions
+4Description says when NOT to use the skill
+3Description length 463: enough signal without eating the budget
+4Structure: 15 headings
+3Step-by-step instructions: 50 items
+4Has examples (4 code blocks)
+4Reference files are cited in the instructions (11 of 11)
+1License stated

Quality base 70; lint remarks subtract, signals add up to 100. Result: 90.

External checks

ClawHub: suspicious

This is a disclosed web penetration-testing skill, but it weakens authorization checks and persistently stores live credentials and unredacted report evidence.

LLM: suspicious (high) · 8 Sept 2026

Tests

— no evals.json

— no spec.yaml

— not run on models

Files · 30

.gitignore 0K
LICENSE 1K
README.md 4K
SKILL.md 15K
gates.md 9K
references/attack-guide.md 3K
references/audit-guide.md 4K
references/cross-role-testing.md 2K
references/discovery-guide.md 9K
references/docx-template.md 2K
references/post-delivery.md 3K
references/report-template.md 7K
references/schema-data-flow.md 6K
references/schema-guide.md 12K
references/threat-modeling.md 5K
references/validation-guide.md 5K
schema/account.schema.json 1K
schema/coverage.schema.json 3K
schema/index.schema.json 2K
schema/module.schema.json 5K
schema/module_queue.schema.json 2K
schema/pages.schema.json 3K
schema/sessions_pool.schema.json 1K
schema/state.schema.json 1K
schema/summary.schema.json 2K
schema.md 0K
scripts/render_docx.py 22K
skill-card.md 3K
templates/.gitignore 0K
test-results.md 2K

Frontmatter

license: MIT

compatibility: Requires Claude Code or Kimi Code with browser automation or curl available.

metadata: {"author":"HeaSec","version":"2.3.0","category":"security-testing","tags":["pentest","web-security","vulnerability-asses

Dates

In catalog since 8 Sept 2026

Updated in catalog 8 Sept 2026

First seen here 10 Sept 2026

Last analysis 11 Sept 2026, 20:52 UTC

Last seen in crawl 8 h ago

Score history

Date		Score	Safety	Qual.
10 Sept 2026	C	73	61	90