skill CX Codex

pentestcompanion-workspace — Claude Code skill: pentest workspace

Q: How do I install pentestcompanion-workspace in Claude Code?

Run `npx skills add reason-machines/security-skills --skill pentestcompanion-workspace -a claude-code`. The skill lands in `~/.claude/skills/pentestcompanion-workspace/SKILL.md`.

Q: What has to be configured before Pentest Companion runs?

Set `SECRET_KEY` and `ADMIN_PASSWORD` in `.env`. Add SMTP or `RESEND_API_KEY` if you want email. Storage defaults to SQLite, and `DATABASE_URL` switches it to PostgreSQL.

This skill wires your agent into a self-hosted Pentest Companion workspace for running engagements, tools and reports.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓

npx skills add reason-machines/security-skills --skill pentestcompanion-workspace -a claude-code

Open on GitHub

What pentestcompanion-workspace does

Pentest Companion is a self-hosted workspace for penetration testing work, and this skill teaches the agent how to drive it. One interface covers targets and open ports, credentials, PTES phases, time tracking, findings with CVSS v3.1 scoring and CVE lookup, evidence uploads, finding templates, client portals, and DOCX or PDF reports with branded covers and executive summaries. Nothing leaves your own infrastructure.

The Tools Hub bundles dozens of utilities — nmap, gobuster, nikto, sqlmap, netexec, impacket — with live output and automatic finding import. There is also a passive web scanner for TLS, headers, cookies, CORS, exposed files and tech fingerprinting, playbooks that chain scans in sequence, terminal logging with ANSI replay, scheduled recurring scans, Slack, Discord and Teams webhooks, and a read-only REST API for engagements and findings.

You can deploy with Docker or run it from Python. The .env file needs SECRET_KEY and ADMIN_PASSWORD; email invites and password resets need SMTP or RESEND_API_KEY. Skip that file and the app will not start, so edit the config before you run docker compose up -d. The UI listens on http://localhost:5000, and admin credentials print on first run.

What it helps with

keep targets, ports and credentials for one engagement together
run nmap or gobuster and land the findings in the database
pull Nessus or Burp results in without retyping them
score a vulnerability with CVSS and pick a matching template
produce a DOCX or PDF report with the client's cover page

Example prompts for the agent

Create a new engagement in Pentest Companion and add target 10.0.0.50
Run nmap against that target through the Tools Hub and show me what it found
Import the findings from my .nessus file into the current engagement

How to install pentestcompanion-workspace

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill pentestcompanion-workspace -a claude-code

2Manually: put the files in place

~/.claude/skills/pentestcompanion-workspace/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/pentestcompanion-workspace/

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill pentestcompanion-workspace -a codex

2Manually: put the files in place

.agents/skills/pentestcompanion-workspace/SKILL.md

For all projects use ~/.agents/skills/

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill pentestcompanion-workspace -a cursor

2Manually: put the files in place

.cursor/skills/pentestcompanion-workspace/SKILL.md

Cursor also reads .agents/skills/ and .claude/skills/

1GitHub CLI

gh skill install reason-machines/security-skills pentestcompanion-workspace

2Manually: put the files in place

.github/skills/pentestcompanion-workspace/SKILL.md

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill pentestcompanion-workspace -a gemini-cli

2Platform CLI

gemini skills install https://github.com/reason-machines/security-skills --path skills/pentestcompanion-workspace

Manually: put the files in place

.devin/skills/pentestcompanion-workspace/SKILL.md

The legacy .windsurf/skills/ path still works

Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill pentestcompanion-workspace -a opencode

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about pentestcompanion-workspace

How do I install pentestcompanion-workspace in Claude Code?

Run npx skills add reason-machines/security-skills --skill pentestcompanion-workspace -a claude-code. The skill lands in ~/.claude/skills/pentestcompanion-workspace/SKILL.md.

What does pentestcompanion-workspace do?

It lets the agent operate a self-hosted Pentest Companion instance: manage engagements and targets, run tools, import findings, and generate reports.

What has to be configured before Pentest Companion runs?

Set SECRET_KEY and ADMIN_PASSWORD in .env. Add SMTP or RESEND_API_KEY if you want email. Storage defaults to SQLite, and DATABASE_URL switches it to PostgreSQL.

Similar skills

All skills for Security →

git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs

From the same set42

s800-vehicle-network-security-testing A skill for automotive network security work: CAN traffic analysis, fuzzing, ECU scanning and replay. Useful when you have authorization to test a vehicle. CX Codex +1 723installs esaa-security-audit This skill runs 95 checks across 16 security domains and records every finding as an immutable event, so the same repo state yields the same report. CX Codex +1 717installs foundry-security-spec A skill that walks your agent through implementing Cisco's Foundry spec: a multi-role system for finding and validating vulnerabilities. Useful when you're building your own evaluation pipeline. CX Codex +1 683installs web-security-scanner-pro A skill that teaches your agent to drive Web Security Scanner Pro: 49 modules, WAF evasion, CMS checks and HTML or PDF reports. CX Codex +1 607installs agentic-security-scanner A skill that scans your code for vulnerabilities, explains findings in plain English and fixes them. Useful when AI writes code faster than you can review it. CX Codex +1 462installs dfyx-code-security-auditor A white-box code audit skill that traces data flows and checks security weaknesses. Use it for release reviews, OWASP checks, or a deeper project assessment. CX Codex +1 334installs security-investigator-automation A skill that runs security investigations across Microsoft Sentinel, Defender XDR and Graph API from a plain-language request. CX Codex +1 322installs linux-pentester-commands A Linux command reference for reconnaissance, enumeration, exploitation, and privilege escalation during authorized penetration testing. CX Codex +1 319installs