Skip to main content
affpapa.org
RU EN
skill CX Codex

pentest-toolkit-pro-html — Claude Code skill

A skill that tells the agent how to drive an offline pentest toolkit: OWASP WSTG checklists, finding tracking, CVSS scoring and a printable report. Handy when results must live in one file.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add reason-machines/security-skills --skill pentest-toolkit-pro-html -a claude-code
Open on GitHub

What pentest-toolkit-pro-html does

The toolkit itself is a single HTML file you open in a browser. No build step, no dependencies. Its tabs cover rules of engagement, contract templates, mission timeline, the OWASP WSTG checklist, a findings database, a CVSS calculator, a remediation plan, report output, plus web and infrastructure cheat sheets. The skill gives the agent the map of those tabs.

Records live in browser localStorage under keys such as pentestToolkit_owaspChecklist and pentestToolkit_vulnerabilities. That keeps everything local and works without a network. It also means the data belongs to one browser profile — move it by moving the profile, and an agent in another window won't see your entries.

From the skill the agent learns how to wire a new panel through data-tab, how to extend the WSTG list with your own tests, and how to push a finding template with severity, cvss, impact and remediation fields. No API key, no server: open the file and start.

What it helps with

  • run a web app through the OWASP WSTG checklist without losing track of progress
  • score a finding with CVSS while the test is still running
  • keep findings in a database with impact and fix notes
  • produce a printable report at the end of an engagement
  • extend the toolkit with a custom test or panel

Example prompts for the agent

  • Open the pentesting toolkit web interface and list the OWASP WSTG items I haven't checked yet
  • Add this finding to the vulnerability tracker and work out its CVSS score
  • Generate a pentest report from what's currently saved in the toolkit

How to install pentest-toolkit-pro-html

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill pentest-toolkit-pro-html -a claude-code

2Manually: put the files in place

~/.claude/skills/pentest-toolkit-pro-html/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/pentest-toolkit-pro-html/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about pentest-toolkit-pro-html

How do I install pentest-toolkit-pro-html in Claude Code?

Run npx skills add reason-machines/security-skills --skill pentest-toolkit-pro-html -a claude-code. The skill lands at ~/.claude/skills/pentest-toolkit-pro-html/SKILL.md.

What does pentest-toolkit-pro-html do?

It briefs the agent on a single-file offensive testing toolkit: WSTG checklists, finding tracking, CVSS scoring, remediation and report generation. The agent then helps you use and customise it.

Where does the toolkit keep its data?

In browser localStorage, split by key for engagement rules, contracts, timeline, the checklist, findings and the action plan. Nothing is sent to a server.

Similar skills

All skills for Security →
git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs

From the same set69

pentestcompanion-workspace This skill wires your agent into a self-hosted Pentest Companion workspace for running engagements, tools and reports. CX Codex +1 534installs email-security-auditor-cpp Validates email credentials and audits inbox authentication via SMTP and IMAP using C++. Built for authorized security testing and credential stuffing assessments. CX Codex +1 479installs agentic-security-scanner A skill that scans your code for vulnerabilities, explains findings in plain English and fixes them. Useful when AI writes code faster than you can review it. CX Codex +1 462installs vibe-pentest-ai-security-testing Coordinates multi-agent security testing across web apps and APIs. Identifies injection flaws, authentication issues, and outputs DOCX or HTML reports. CX Codex +1 446installs dfyx-code-security-review This skill performs white-box static analysis of code, tracing data flows and checking security controls, configuration, and business logic. Use it for a deep project audit. CX Codex +1 338installs pentestops-dashboard This skill guides an agent through setting up a dashboard for penetration testing projects, tasks, findings, clients, and assets. Use it to organize an assessment workflow. CX Codex +1 336installs dfyx-code-security-auditor A white-box code audit skill that traces data flows and checks security weaknesses. Use it for release reviews, OWASP checks, or a deeper project assessment. CX Codex +1 334installs dfyx-code-security-audit This skill audits source code for vulnerabilities through data-flow analysis and business-logic review. Use it for a project security check or pentest preparation. CX Codex +1 328installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor