# pentest-toolkit-pro-html

A skill that tells the agent how to drive an offline pentest toolkit: OWASP WSTG checklists, finding tracking, CVSS scoring and a printable report. Handy when results must live in one file.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 340 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/pentest-toolkit-pro-html/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/pentest-toolkit-pro-html

## What it does

The toolkit itself is a single HTML file you open in a browser. No build step, no dependencies. Its tabs cover rules of engagement, contract templates, mission timeline, the OWASP WSTG checklist, a findings database, a CVSS calculator, a remediation plan, report output, plus web and infrastructure cheat sheets. The skill gives the agent the map of those tabs.

Records live in browser `localStorage` under keys such as `pentestToolkit_owaspChecklist` and `pentestToolkit_vulnerabilities`. That keeps everything local and works without a network. It also means the data belongs to one browser profile — move it by moving the profile, and an agent in another window won't see your entries.

From the skill the agent learns how to wire a new panel through `data-tab`, how to extend the WSTG list with your own tests, and how to push a finding template with severity, cvss, impact and remediation fields. No API key, no server: open the file and start.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill pentest-toolkit-pro-html -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/pentest-toolkit-pro-html/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/pentest-toolkit-pro-html/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill pentest-toolkit-pro-html -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/pentest-toolkit-pro-html/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill pentest-toolkit-pro-html -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/pentest-toolkit-pro-html/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills pentest-toolkit-pro-html
```

2. **Manually: put the files in place**
- File: `.github/skills/pentest-toolkit-pro-html/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill pentest-toolkit-pro-html -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/pentest-toolkit-pro-html
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/pentest-toolkit-pro-html/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill pentest-toolkit-pro-html -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/pentest-toolkit-pro-html/SKILL.md

## When to use it
- run a web app through the OWASP WSTG checklist without losing track of progress
- score a finding with CVSS while the test is still running
- keep findings in a database with impact and fix notes
- produce a printable report at the end of an engagement
- extend the toolkit with a custom test or panel

## Example prompts
- Open the pentesting toolkit web interface and list the OWASP WSTG items I haven't checked yet
- Add this finding to the vulnerability tracker and work out its CVSS score
- Generate a pentest report from what's currently saved in the toolkit

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 69 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md