pentest-skills-framework — Claude Code skill: pentesting
A modular skill for reconnaissance, vulnerability checks, and result analysis through natural-language requests. It fits AI CLI penetration-testing workflows.
npx skills add reason-machines/security-skills --skill pentest-skills-framework -a claude-codeWhat pentest-skills-framework does
pentest-skills-framework turns penetration testing into separate skills for port discovery, subdomain collection, directory enumeration, and web technology identification. It also covers checks for SQL injection, XSS, and LFI. The agent maps a plain-language request to the relevant tools and reviews the returned data.
A skill can include SKILL.md, Python or Bash automation, reference notes, and resource files such as wordlists. The documented toolset includes nmap, subfinder, dnsx, httpx, nuclei, ffuf, sqlmap, xsstrike, and dalfox; the required set depends on the task. Subdomain and directory work requires the Go-based utilities, while the base setup targets Ubuntu/Debian or macOS.
The skill supports Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, and OpenCode. A selected check will fail to run when its required command-line tools are missing, so install the tools for that skill before starting.
What it helps with
- scan ports and identify service versions
- enumerate live subdomains for a domain
- search a web app for hidden directories
- test a URL for SQL injection
- fingerprint web application technologies
Example prompts for the agent
- Scan
192.168.1.100, find open ports, and identify the service versions. - Enumerate subdomains for
example.com, verify which ones respond, and save the results to a file. - Check
http://target.com/page.php?id=1for SQL injection and interpret the responses.
How to install pentest-skills-framework
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill pentest-skills-framework -a claude-code2Manually: put the files in place
~/.claude/skills/pentest-skills-framework/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/pentest-skills-framework/
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill pentest-skills-framework -a codex2Manually: put the files in place
.agents/skills/pentest-skills-framework/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill pentest-skills-framework -a cursor2Manually: put the files in place
.cursor/skills/pentest-skills-framework/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install reason-machines/security-skills pentest-skills-framework2Manually: put the files in place
.github/skills/pentest-skills-framework/SKILL.md1Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill pentest-skills-framework -a gemini-cli2Platform CLI
gemini skills install https://github.com/reason-machines/security-skills --path skills/pentest-skills-frameworkManually: put the files in place
.devin/skills/pentest-skills-framework/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add reason-machines/security-skills --skill pentest-skills-framework -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about pentest-skills-framework
How do I install pentest-skills-framework in Claude Code?
Run npx skills add reason-machines/security-skills --skill pentest-skills-framework -a claude-code, then open ~/.claude/skills/pentest-skills-framework/SKILL.md.
What does pentest-skills-framework do?
It provides modular penetration-testing tasks for reconnaissance, subdomain and directory discovery, technology checks, and testing for SQL injection, XSS, and LFI.
Which tools does the skill use?
Its documented toolkit includes nmap, subfinder, dnsx, httpx, nuclei, ffuf, sqlmap, xsstrike, and dalfox. The subdomain and directory skills use Go-based tools.
