Agent skill · security · aradotso
pentest-skills-framework
Natural language-driven penetration testing framework with modular skills for recon, exploitation, and security testing using AI agents
Why this skill is useful
Adds multiple automation scripts for penetration testing workflows that significantly enhance the AI's capabilities in security testing.
What it needs
Requires dalfox, ffuf, git, go, nmap, python3, sqlmap, xsstrike installed locally. About 7k tokens when loaded. Last updated 2026-08-04. 11 stars on the source repository.
What this skill does
Pentest-Skills Framework Skill by ara.so — Security Skills collection. A modular penetration testing framework designed for AI CLI tools (Claude Code, Gemini CLI, Cursor) that enables professional security testing through natural language commands. Each skill contains knowledge documents, automation scripts, reference documentation, and resource files. What It Does Pentest-Skills provides atomic-level capabilities for penetration testing workflows: Information Gathering: Port scanning, subdomain enumeration, directory scanning, fingerprinting Vulnerability Exploitation: SQL injection, XSS, LFI, file download vulnerabilities Natural Language Interface: Describe testing goals in plain language; AI selects tools and executes Automated Analysis: AI interprets results and generates actionable reports Installation Prerequisites Install required tools based on skills you'll use: Install Skills Restart your AI coding agent to load the skills. Skill Structure Each skill follows this pattern: Usage Patterns Port Scanning (recon-port-scan) Natural language: Direct tool usage: Python script automation: Run: Subdomain Enumeration (recon-subdomain) Natural language: Direct tool usage: Automation script: SQL Injection Testing (exploit-sqli) Natural language: Direct tool usage: Testing script: XSS Testing (exploit-xss) Natural language: Direct tool usage: Testing script: Directory Enumeration (recon-dir-scan) Natural language: Direct tool usage: Configuration Environment Variables Store sensitive data in environment variables: Skill Configuration Each skill can have a config.yaml: Common Patterns Chaining Multiple Skills Report Generation Troubleshooting Permission Issues Tool Not Found Rate Limiting Proxy Configuration Timeout Issues Legal Warning ⚠️ IMPORTANT: Only use these skills on systems you have explicit written permission to test. Unauthorized testing is illegal and punishable under cybercrime laws (e.g., CFAA in the US, Computer Misuse Act in the UK). …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/pentest-skills-framework