Agent skill · security · aradotso
pentest-lyan-web-security-testing
Autonomous web penetration testing skill with threat modeling, JavaScript analysis, and multi-role verification
Why this skill is useful
Adds executable scripts for autonomous web penetration testing that validate business impact and perform complex threat modeling not covered by standard tools.
What it needs
Requires npm, python installed locally. About 9k tokens when loaded. Last updated 2026-08-04. 11 stars on the source repository.
What this skill does
Pentest-Lyan Web Security Testing Skill by ara.so — Security Skills collection. Pentest-Lyan is an autonomous web penetration testing framework that performs self-directed threat modeling across 12 dimensions, complete JavaScript analysis, and cross-role verification. It validates business impact (not just HTTP 200 responses), maintains state across sessions, and generates both technical Markdown and delivery-ready Word reports. What It Does Autonomous Threat Modeling: Identifies threats based on 12 thinking dimensions rather than fixed vulnerability checklists Deep JavaScript Analysis: Reads and understands business logic, signing mechanisms, and frontend parameters before testing APIs Business Impact Validation: Verifies database-layer changes, data access, and state transitions actually occur Multi-Role Testing: Builds permission matrices and performs cross-role privilege escalation checks Stateful Testing: Supports resume (--resume), multi-project isolation, and session pooling Dual Report Formats: Markdown for technical details, Word for delivery; separates critical findings from configuration issues Installation Prerequisites 1. Python 3.8+ with the project dependencies 2. Playwright MCP Server (recommended for browser automation and session pooling) Setup Steps Playwright MCP Setup (Optional but Recommended) Project Structure Basic Usage Starting a New Security Test Important: No need to declare authorization scope/timeframe — issuing the command implies authorization. Multi-Project Management Default project-id is extracted from the hostname's first segment. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/pentest-lyan-web-security-testing