skills-ws/skills/security-pentester/SKILL.md

87 agent skills for AI coding assistants — marketing, growth, web3, dev, design & operations. Built for OpenClaw, Claude Code, Cursor, and Codex.

---
name: security-pentester
description: "Active offensive testing — OWASP Top 10 exploitation, white-box source-aware scans, CI/CD security gates, vuln report interpretation, remediation. Use when running pentests or attacking your own app. Paired with security-hardening (defensive code) and security-sentinel (runtime threat intel)."
---
# Security Pentester

> Disambiguation: this skill = active offensive testing. For defensive code patterns see `security-hardening`. For runtime threat intel / URL+wallet scam scanning see `security-sentinel`.

Autonomous web application penetration testing driven by an LLM-agent pipeline (Shannon), backed by manual validation. Source-aware analysis combines code reading with live exploitation attempts and prioritizes findings that come with a reproducible proof-of-concept.

This skill is tool-agnostic in principle: Shannon is the reference automated driver, but the workflow (recon → analyze → exploit → triage → remediate → regression-test) and every remediation playbook below apply to any pentest engagement (manual, Burp/ZAP-driven, or other agents).

> **Scope first.** Only run against applications you own or have explicit written authorization to test, and never against production. See §8 for the full rules of engagement.

## Safety gate

Before executing commands or changing external systems, confirm scope, credentials, target environment, rollback, and required approval. Pin and verify third-party artifacts; never expose secrets to client code or logs.

## Reference guide

Read only the references needed for the current request:

- **Core Principle**: [references/core-principle.md](references/core-principle.md)
- **1. Vulnerability Coverage**: [references/1-vulnerability-coverage.md](references/1-vulnerability-coverage.md)
- **2. Running a Pentest**: [references/2-running-a-pentest.md](references/2-running-a-pentest.md)
- **3. Understanding the Pipeline**: [references/3-understanding-the-pipeline.md](references/3-understanding-the-pipeline.md)
- **4. Interpreting Reports**: [references/4-interpreting-reports.md](references/4-interpreting-reports.md)
- **[CRITICAL] SQL Injection in /api/users/search**: [references/critical-sql-injection-in-api-users-search.md](references/critical-sql-injection-in-api-users-search.md)
- **4a. Remediation Playbooks**: [references/4a-remediation-playbooks.md](references/4a-remediation-playbooks.md)
- **5. CI/CD Integration**: [references/5-ci-cd-integration.md](references/5-ci-cd-integration.md)
- **6. Post-Pentest Workflow**: [references/6-post-pentest-workflow.md](references/6-post-pentest-workflow.md)
- **7. What Shannon Doesn't Cover**: [references/7-what-shannon-doesn-t-cover.md](references/7-what-shannon-doesn-t-cover.md)
- **8. Safe Testing Practices**: [references/8-safe-testing-practices.md](references/8-safe-testing-practices.md)