Agent skill · security · aradotso
claude-pentest-framework
AI-driven penetration testing framework for Claude Code with 15 agents, 6 skill coordinators, and 63 attack categories coordinated through structured engagement workflows
Why this skill is useful
Adds a comprehensive framework with executable commands for orchestrating penetration tests, including specialized agents and structured workflows.
What it needs
Requires claude installed locally. About 7k tokens when loaded. Last updated 2026-08-04. 11 stars on the source repository.
What this skill does
claude-pentest Framework Skill by ara.so — Security Skills collection. claude-pentest is a comprehensive penetration testing framework for Claude Code that coordinates 15 specialized agents across 6 skill domains and 63 attack categories. It provides structured, human-in-the-loop, evidence-driven security assessments with automatic PoC generation, HTTP evidence capture, and Playwright screenshots. Core Concepts Agent Coordination Framework: Unlike traditional scanners, claude-pentest orchestrates specialized executor agents following a strict 4-phase workflow (reconnaissance → planning → approval → execution → escalation). Human-in-the-Loop: Every exploitation attempt requires explicit operator approval. Claude cannot proceed to active exploitation without confirmation. Evidence-First: All findings include working PoCs (poc.py), captured output (pocoutput.txt), HTTP evidence, and screenshots. No theoretical findings. Structured Outputs: Machine-readable JSON + markdown analysis written to outputs/{engagement}/. Installation Add Marketplace Repository Install Plugin The plugin installs to .claude/ in your project directory. All agents, skills, and slash commands become available immediately. Optional: Kali Server (MKS) For server-side testing (nmap, sqlmap, gobuster, Metasploit), deploy MCP-Kali-Server on a Kali Linux host: Key Commands Launch Full Engagement Flow: 1. Isolate session to pentest plugin (recommended) 2. Configure scope (target, engagement name, out-of-scope, time budget, auth, thoroughness) 3. Select attack profile (Full / Web app / API & cloud / Custom) 4. Configure Kali server integration (optional) 5. Review engagement summary 6. Execute: pre-flight → recon → planning → approval → executor deployment → time-budget loop → report Session Isolation: When enabled, Claude constrains itself to pentest plugin agents only, preventing interference from other plugins. Define Scope Configure or update engagement scope without launching. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/claude-pentest-framework