CD pentest-tools

Operate 20+ penetration-testing tools (Nmap, Nuclei, SQLMap, FFUF, Hashcat, and more) through structured workflows with consistent output handling.

sickn33/agentic-awesome-skills Agent Skills author: sickn33 MIT 21 files body ≈ 2 311 tokens Open the sourcegithub.com↗ analyzed 26 h ago

Operate 20+ penetration-testing tools (Nmap, Nuclei, SQLMap, FFUF, Hashcat, and more) through structured workflows with consistent output handling.

As a process D 46/100 · Unfinished process — weak spots: result and completion, when it triggers, inputs and preconditions

Procedure GitHub Docker AI and agents Securitytype and topics are labelled automatically from the skill text

Runs in: Claude / Claude Code ChatGPT / Codex Gemini CLI Cursor GitHub Copilot / VS Code Qwen Code Kimi Code CLI Z.ai (GLM) DeepSeek (Deep Code) Mistral Vibe LangChain (deepagents) OpenClaw Goose OpenCode

JSON

Technical rating

62/100

safety, quality, tests

Safety 60%: 47
Quality 40%: 84
Run on models: none yet

Process rating

46/100

Unfinished process

Result and completion w 14: 0
Inputs and preconditions w 11: 0
Failures and branches w 10: 0

the three weakest of ten parameters · all ten

The same skill appears in 2 more places: agentic-awesome-skills, agentic-awesome-skills

What is at stake

Medium-severity findings: the skill is probably honest, but read what alarmed the scanner.

Exfiltration medium severity

Below is the worst case for this category. The finding here is medium: the guard saw a sign, not a proof.

If you install

The instructions or scripts send data out: environment variables, keys, file contents, chat history. You may never notice, because the agent performs the upload as "part of the task".

For the author

If the upload is not needed for the task, remove it: catalogs flag such skills and delist them. If it is needed, name the destination explicitly, say what leaves the machine, and give the user a switch.

How to improve

For the model run — optional

Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.

Guard findings · 49

✓ No critical or high findings

Medium and low: 49

medium Exfiltration exfil-read-secret-files references/network-attack-defense.md:74

Reads credential / secret files (documentation of a security skill)
```
cat /etc/shadow
```
security skill
low Risky intent intent-offensive-security references/ai-pentest-agents.md:4

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
> 可作为本包 pentest-tools skill 的补充能力来源。
```
fixture
low Risky intent intent-offensive-security references/ai-pentest-agents.md:13

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
| **pentest-ai (0xSteph)** | MCP server + Python agents，197+ 安全工具，exploit 链接，PoC 验证 | https://github.com/0xSteph/pentest-ai |
```
fixture
low Risky intent intent-offensive-security references/ai-pentest-agents.md:18

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
| **Auto-Pentest-GPT** | LLM 驱动的软件渗透测试 | https://github.com/Armur-Ai/Auto-Pentest-GPT-AI |
```
fixture
low Risky intent intent-offensive-security references/ai-pentest-agents.md:23

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file; quoted — discussed, not commanded)
```
这些框架大多支持 MCP 或 HTTP API，可以作为本包 `pentest-tools` skill 的增强后端：
```
fixturequoted
low Risky intent intent-offensive-security references/ai-pentest-agents.md:28

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file; quoted — discussed, not commanded)
```
"pentest-ai": {
```
fixturequoted
low Risky intent intent-offensive-security references/ai-pentesting-landscape-2026.md:11

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
- 在 Bug Bounty 排行榜上已超越部分人类黑客
```
fixture
low Risky intent intent-offensive-security references/ai-pentesting-landscape-2026.md:19

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
| **Pentest Swarm AI** | Stigmergic blackboard | 执行 | pgvector + pheromones | 8 ProjectDiscovery + nmap | ✓ | ✓ 真 swarm |
```
fixture
low Risky intent intent-offensive-security references/ai-pentesting-landscape-2026.md:37

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
| XBOW | 自主 Bug Bounty | AI agent 自动挖洞提交 |
```
fixture
low Risky intent intent-offensive-security references/ai-pentesting-landscape-2026.md:52

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
上面列出的工具（特别是 Pentest Swarm AI、HexStrike AI、mcp-kali-server）都可以作为本包的**执行后端**，通过 MCP 接入。
```
fixture
low Risky intent intent-offensive-security references/ai-pentesting-landscape-2026.md:59

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
pentest-tools/SKILL.md
```
fixture
low Risky intent intent-offensive-security references/awesome-pentest-digest.md:3

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
> 精选自 [awesome-pentest](https://github.com/enaqx/awesome-pentest)（25k+ stars，CC-BY 4.0）
```
fixture
low Risky intent intent-offensive-security references/awesome-pentest-digest.md:173

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
| Pentest-Ground | https://pentest-ground.com/ |
```
fixture
low Risky intent intent-offensive-security references/burpsuite-mcp-guide.md:370

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)
```
- `pentest-tools` Nmap 发现 Web 服务 → Burp MCP 做深度测试
```
quoted
low Risky intent intent-offensive-security references/kali-mcp-ecosystem.md:45

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
- **特点**：多 agent 架构，自动化渗透测试、漏洞发现、Bug Bounty
```
low Risky intent intent-offensive-security references/kali-mcp-ecosystem.md:49

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
### 4. Pentest Swarm AI
```
low Risky intent intent-offensive-security references/kali-mcp-ecosystem.md:51

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)
```
- **安装**：`go install github.com/Armur-Ai/Pentest-Swarm-AI/cmd/pe…@….1.0`
```
quoted
low Risky intent intent-offensive-security references/kali-mcp-ecosystem.md:52

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
- **来源**：[Armur-Ai/Pentest-Swarm-AI](https://github.com/Armur-Ai/Pentest-Swarm-AI)
```
low Risky intent intent-offensive-security references/kali-mcp-ecosystem.md:64

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
### 6. Pentest-Agent
```
low Risky intent intent-offensive-security references/msf-protocol.md:32

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
- `sleep 20`：给 reverse shell 留连接时间
```
low Risky intent intent-offensive-security references/msf-protocol.md:103

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)
```
把这套规则补到 `pentest-tools/SKILL.md` 或单独的 `pentest-tools/references/msf-protocol.md`，确保 AI 在生成 MSF 命令前先读到。
```
quoted
low Dangerous commands cmd-persistence references/network-attack-defense.md:118

Persistence mechanism (cron / launchd / scheduled task / autorun registry) (documentation table row; documentation of a security skill)
```
| 自动运行 | `reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run` |
```
tablesecurity skill
low Dangerous commands cmd-persistence references/network-attack-defense.md:126

Persistence mechanism (cron / launchd / scheduled task / autorun registry) (documentation table row; documentation of a security skill)
```
| Cron 任务 | `cat /etc/crontab` + `ls -la /etc/cron.*` |
```
tablesecurity skill
low Dangerous commands cmd-persistence references/network-attack-defense.md:210

Persistence mechanism (cron / launchd / scheduled task / autorun registry) (documentation table row; documentation of a security skill)
```
| 计划任务 | `schtasks /create` |
```
tablesecurity skill
low Dangerous commands cmd-persistence references/network-attack-defense.md:222

Persistence mechanism (cron / launchd / scheduled task / autorun registry) (documentation table row; documentation of a security skill)
```
| Cron 任务 | `/etc/crontab`、`/var/spool/cron/` |
```
tablesecurity skill
low Risky intent intent-offensive-security references/network-attack-defense.md:324

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
| Privilege Escalation | SUID、Potato、内核漏洞、DLL 劫持 |
```
low Risky intent intent-offensive-security references/network-attack-defense.md:328

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
| Lateral Movement | PtH、WMI、SMB、RDP |
```
low Risky intent intent-offensive-security references/nuclei-guide-2026.md:4

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
> 适用场景：漏洞扫描、自定义检测模板编写、Bug Bounty 自动化
```
low Risky intent intent-offensive-security references/nuclei-guide-2026.md:116

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
### Pentest Swarm AI 集成
```
low Risky intent intent-offensive-security references/nuclei-guide-2026.md:118

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
Pentest Swarm AI 原生集成 Nuclei，在 swarm 模式下：
```
low Risky intent intent-offensive-security references/pentest-ai-agents-matrix.md:1

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
# pentest-ai-agents 覆盖矩阵
```
fixture
low Risky intent intent-offensive-security references/pentest-ai-agents-matrix.md:6

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
> 参考自 [0xSteph/pentest-ai-agents](https://github.com/0xSteph/pentest-ai-agents)（1.3k stars，MIT）
```
fixture
low Risky intent intent-offensive-security references/pentest-ai-agents-matrix.md:7

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
> 35 个 Claude Code 渗透子 agent 的能力映射。可作为我们 pentest-tools skill 的方法论参考。
```
fixture
low Risky intent intent-offensive-security references/pentest-ai-agents-matrix.md:30

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)
```
| engagement-planner | 渗透计划/ROE/ATT&CK 映射 | — | pentest-tools |
```
fixture
low Risky intent intent-offensive-security references/pentest-ai-agents-matrix.md:31

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition; test fixture / example file)
```
| recon-advisor | 信息收集/目标优先级 | nmap, masscan, subfinder, httpx | pentest-tools |
```
detectorfixture
low Risky intent intent-offensive-security references/recon-pipeline.md:1

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
# 授权侦察流水线（Bug Bounty / 渗透）
```
low Risky intent intent-offensive-security references/recon-pipeline.md:3

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
> 来源启发：社区 bug bounty recon 管线（subfinder→httpx→katana→nuclei→ffuf 等）、claude-bug-bounty 类 /recon 流程
```
low Dangerous commands cmd-execpolicy-bypass references/recon-pipeline.md:19

Runs PowerShell with execution policy bypassed (documentation of a security skill)
```
powershell -NoProfile -ExecutionPolicy Bypass -File skills\scripts\case…ps1 `
```
security skill
low Risky intent intent-offensive-security references/recon-pipeline.md:20

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)
```
-Hint "web pentest app.example" -CaseName "demo-case" `
```
quoted
low Dangerous commands cmd-execpolicy-bypass references/recon-pipeline.md:123

Runs PowerShell with execution policy bypassed (documentation of a security skill)
```
powershell -NoProfile -ExecutionPolicy Bypass -File skills\scripts\appe…ps1 `
```
security skill
low Risky intent intent-offensive-security references/recon-pipeline.md:143

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)
```
深度漏洞类型 playbook → `pentest-tools/src-hunter/`。
```
quoted
low Risky intent intent-offensive-security references/web-attack-cheatsheet.md:4

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
> 配合 pentest-tools 的 MCP 工具链使用。
```
low Risky intent intent-offensive-security references/web-attack-cheatsheet.md:95

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
// Keylogger
```
low Risky intent intent-offensive-security SKILL.md:2

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
name: pentest-tools
```
low Risky intent intent-offensive-security SKILL.md:131

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)
```
"pentest": {
```
quoted
low Dangerous commands cmd-execpolicy-bypass SKILL.md:160

Runs PowerShell with execution policy bypassed (documentation of a security skill)
```
powershell -NoProfile -ExecutionPolicy Bypass -File skills\scripts\boot…ps1 -Capability reqable-mcp -McpHostTarget Codex
```
security skill
low Risky intent intent-offensive-security SKILL.md:188

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (quoted — discussed, not commanded)
```
> **重要**：执行渗透测试时，必须按 `references/pentest-loop.md` 的自主循环框架运行。
```
quoted
low Risky intent intent-offensive-security SKILL.md:283

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
- [awesome-pentest](https://github.com/enaqx/awesome-pentest) — 25k+ stars 渗透工具大全
```
low Risky intent intent-offensive-security SKILL.md:287

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
- [pentest-ai-agents](https://github.com/0xSteph/pentest-ai-agents) — 35 个 Claude Code 渗透子 agent（参考其 prompt 模式）
```

Files scanned: 21. Evidence is masked. Grey chips explain why severity was lowered.

Against the Agent Skills spec

note frontmatter-key unknown frontmatter key "risk"
note frontmatter-key unknown frontmatter key "source"
note frontmatter-key unknown frontmatter key "source_repo"
note frontmatter-key unknown frontmatter key "source_type"
note frontmatter-key unknown frontmatter key "date_added"
note frontmatter-key unknown frontmatter key "license_source"

Process rating: all ten parameters 46/100

0Result and completion. Does not say what the result is
0Inputs and preconditions. Does not say what the process needs to start
0Failures and branches. Linear process with no failure handling
0Progress reporting. Says nothing while it works
20When it triggers. No condition that starts the skill
60Tools and files. Uses tools (git, python) that frontmatter does not declare
100Steps. 63 steps
100Consistency. Name and required fields are in place
100Execution cost. Instruction body is 2311 tokens
100Running it twice. No mutating operations

low 11 top-level sections: this looks like several domains in one skill

Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.

Quality signals

+5Description has no quoted example phrases that should trigger the skill
+4Description does not say when NOT to use the skill (false activations)
+3Output format is not stated: the model decides each time
-2localhost URLs: will not work for another user
+2Single-language instructions
+3Description length 147: enough signal without eating the budget
+4Structure: 28 headings
+3Step-by-step instructions: 63 items
+4Has examples (7 code blocks)
+4Reference files are cited in the instructions (7 of 15)
+1License stated

Quality base 70; lint remarks subtract, signals add up to 100. Result: 84.

Tests

— no evals.json

— no spec.yaml

— not run on models

Files · 21

SKILL.md 13K
references/ai-pentest-agents.md 6K
references/ai-pentesting-landscape-2026.md 3K
references/automation-loop-pattern.md 5K
references/awesome-pentest-digest.md 6K
references/burpsuite-mcp-guide.md 23K
references/client-side-lab-playbook.md 5K
references/kali-mcp-ecosystem.md 4K
references/msf-protocol.md 6K
references/network-attack-defense.md 10K
references/nuclei-guide-2026.md 4K
references/payloads.md 1K
references/pentest-ai-agents-matrix.md 6K
references/pentest-loop.md 7K
references/recon-pipeline.md 6K
references/templates/findings.md 0K
references/templates/progress.md 0K
references/templates/rules.md 1K
references/templates/scope.md 0K
references/templates/task_plan.md 1K
references/web-attack-cheatsheet.md 8K

When to use

- An authorized assessment needs standard tooling orchestrated coherently. - Choosing and sequencing the right tool per recon/exploitation phase.

Frontmatter

risk: offensive

source: https://github.com/zhaoxuya520/reverse-skill

source_repo: zhaoxuya520/reverse-skill

source_type: community

date_added: 2026-08-25

license: MIT

license_source: https://github.com/zhaoxuya520/reverse-skill/blob/main/LICENSE

Dates

In catalog since —

Updated in catalog 12 Sept 2026

First seen here 7 Sept 2026

Last analysis 12 Sept 2026, 16:23 UTC

Last seen in crawl 25 h ago

Score history

Date		Score	Safety	Qual.
11 Sept 2026	C	62	47	84
10 Sept 2026	C	63	49	84
7 Sept 2026	C	62	49	81
7 Sept 2026	D	59	49	75
7 Sept 2026	C	63	47	88

Similar skills

C pentest-tools sickn33/agentic-awesome-skills
C pentest-tools sickn33/agentic-awesome-skills