Security Pen Testing
Use when the user asks to perform security audits, penetration testing, vulnerability scanning, OWASP Top 10 checks, or offensive security assessments.
Before & after
Same prompt, same agent — the only difference is the skill.
Security testing is definitely important before launch. You'd want to check for common issues, test your authentication, maybe scan dependencies. There are tools that can help, but it depends on your tech stack and how thorough you want to be. What type of application are you building?
SECURITY VULNERABILITY REPORT: EXECUTIVE SUMMARY: 3 High-risk, 7 Medium-risk, 4 Low-risk issues found. Recommend delaying launch 1 week for High fixes. OWASP TOP 10 MAPPING: CRITICAL (Fix before launch): 1. SQL Injection in search endpoint → Query: /api/search?q='; DROP TABLE users; -- → Impact: Full database compromise → Fix: Use parameterized queries → Time: 2 hours 2. Broken Authentication → JWT tokens never expire (default forever) → Session hijacking risk if token leaked → Fix: Add 7-day expiry + refresh token rotation → Time: 4 hours 3. Insecure Deserialization in upload handler → Uploaded pickle files auto-deserialize → Allows RCE (remote code execution) → Fix: Reject pickle, use JSON only → Time: 1 hour HIGH: • XSS in user profile (stored) → Sanitize all HTML input • Missing CSRF tokens on forms → Add token validation • Hardcoded API keys in code → Rotate, move to env vars • No rate limiting on login → Add 5-attempt cap + 15m lockout MEDIUM: • Weak password policy (6 chars min) → Enforce 12+ chars + complexity • Missing security headers (HSTS, CSP) → Add to all responses DEPENDENCY SCAN: • Django 3.1 (EOL, has 3 CVEs) → Update to 4.2 • lodash 4.17.15 → Update to 4.17.21+ SCHEDULE: High fixes (7h total) end of week → re-test Monday → green light launch Tuesday.
About this skill
name: security-pen-testing description: Use when Use when the user asks to perform security audits, penetration testing, vulnerability scanning, OWASP Top 10 checks, or offensive security assessments.
Security Pen Testing
Use when the user asks to perform security audits, penetration testing, vulnerability scanning, OWASP Top 10 checks, or offensive security assessments. Covers static analysis, dependency scanning, secret detection, API security testing, and pen test report generation.
What you get
- Public GitHub repo (alirezarezvani/claude-skills)
- the security-pen-testing skill folder with SKILL.md. Part of a 337-skill / 30-agent / 70-command install.
Customize your output
- Fork the repo and adapt the skill's instructions and references to your workflow.
Example output
Activates automatically when your request matches Security Pen Testing; chains with the other skills, agents, and commands in the collection.
Best for
Creators, builders, and teams using Claude Code.
SKILL.md preview
---
name: security-pen-testing
description: Use this skill when performing a security audit, penetration test, vulnerability scan, OWASP Top 10 check, or offensive security assessment.
version: 1.0.0
category: Development / Engineering
author: AgentVolt
license: proprietary
tags:
- development
- engineering
---
# Security Pen Testing
Runs an offensive security assessment covering static analysis, dependency scanning, secret detection, and API security testing, producing a pen-test report engineers can act on.
## When to use
… (sign up to view the full skill)More development skills
View all Development skills →Generate
Scaffold code, tests, and boilerplate from a short spec.
Performance Profiler
Systematic performance profiling for Node.js, Python, and Go applications.
Threat Detection
Use when hunting for threats in an environment, analyzing IOCs, or detecting behavioral anomalies in telemetry.
Agent Harness
Turns a domain folder of skills into a bounded agentic loop: compile a goal into a task plan, execute with the domain's tools, verify every task, retry within a budget.