pentest-checklist — Claude Code skill: plan a pentest step by step
A skill that walks you through pentest planning: objectives, scope, environment prep, tester selection and monitoring. Useful before a security assessment.
npx claude-code-templates@latest --skill security/pentest-checklistWhat pentest-checklist does
The skill lays out a penetration test in four phases. Scope definition comes first: why you are testing, which type fits (external, internal, web application, social engineering, red team), where the risk sits and what falls inside the boundaries. Then environment preparation — production or staging, preliminary scans, compliance checks, notifying the hosting provider, freezing deployments for the testing window.
Next comes picking testers and a methodology. The skill asks about experience, certifications, report format and risk rating scale, and helps you choose between black box, gray box and white box. The final phase covers monitoring: IDS/IPS, logging, SIEM, alerting. Everything ships as checklists and comparison tables.
Without written authorization and agreed boundaries the skill has nothing to work with, because the whole flow is built around what may and may not be touched. Testing in the cloud means sorting out the provider's policy in advance — that is a separate prep item.
What it helps with
- draw pentest boundaries and keep third-party systems out of scope
- choose between black box, gray box and white box testing
- prepare a staging environment and freeze deploys during the test
- get cloud provider approval before scanning their infrastructure
- define report sections and a risk rating scale
Example prompts for the agent
- help me plan a penetration test for our web app
- build a security assessment checklist for next month
- which logs and alerts should we watch during the pentest
How to install pentest-checklist
1claude-code-templates
npx claude-code-templates@latest --skill security/pentest-checklist2Skills CLI (Vercel)
npx skills add davila7/claude-code-templates --skill pentest-checklist -a claude-code3Manually: put the files in place
~/.claude/skills/pentest-checklist/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/pentest-checklist/
Manually: put the files in place
.agents/skills/pentest-checklist/SKILL.mdFor all projects use ~/.agents/skills/
Manually: put the files in place
.cursor/skills/pentest-checklist/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install davila7/claude-code-templates pentest-checklist2Manually: put the files in place
.github/skills/pentest-checklist/SKILL.mdPlatform CLI
gemini skills install https://github.com/davila7/claude-code-templates --path cli-tool/components/skills/security/pentest-checklistManually: put the files in place
.devin/skills/pentest-checklist/SKILL.mdThe legacy .windsurf/skills/ path still works
Claude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about pentest-checklist
How do I install pentest-checklist in Claude?
Use the templates CLI: npx claude-code-templates@latest --skill security/pentest-checklist. Or run npx skills add davila7/claude-code-templates --skill pentest-checklist -a claude-code. The skill lands at ~/.claude/skills/pentest-checklist/SKILL.md.
What does pentest-checklist do?
It guides you through four pentest phases: scope and objectives, environment preparation, tester and methodology selection, and monitoring during the engagement. You end up with defined boundaries, a prep plan and report requirements.
What do I need before using the skill?
Business objectives for the test, target environment details, budget and timeline limits, stakeholder contacts and written authorization. Agreed boundaries and permission are what the whole plan is built on.
