# pentestcompanion-workspace

This skill wires your agent into a self-hosted Pentest Companion workspace for running engagements, tools and reports.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 534 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/pentestcompanion-workspace/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/pentestcompanion-workspace

## What it does

Pentest Companion is a self-hosted workspace for penetration testing work, and this skill teaches the agent how to drive it. One interface covers targets and open ports, credentials, PTES phases, time tracking, findings with CVSS v3.1 scoring and CVE lookup, evidence uploads, finding templates, client portals, and DOCX or PDF reports with branded covers and executive summaries. Nothing leaves your own infrastructure.

The Tools Hub bundles dozens of utilities — nmap, gobuster, nikto, sqlmap, netexec, impacket — with live output and automatic finding import. There is also a passive web scanner for TLS, headers, cookies, CORS, exposed files and tech fingerprinting, playbooks that chain scans in sequence, terminal logging with ANSI replay, scheduled recurring scans, Slack, Discord and Teams webhooks, and a read-only REST API for engagements and findings.

You can deploy with Docker or run it from Python. The `.env` file needs `SECRET_KEY` and `ADMIN_PASSWORD`; email invites and password resets need SMTP or `RESEND_API_KEY`. Skip that file and the app will not start, so edit the config before you run `docker compose up -d`. The UI listens on `http://localhost:5000`, and admin credentials print on first run.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill pentestcompanion-workspace -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/pentestcompanion-workspace/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/pentestcompanion-workspace/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill pentestcompanion-workspace -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/pentestcompanion-workspace/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill pentestcompanion-workspace -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/pentestcompanion-workspace/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills pentestcompanion-workspace
```

2. **Manually: put the files in place**
- File: `.github/skills/pentestcompanion-workspace/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill pentestcompanion-workspace -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/pentestcompanion-workspace
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/pentestcompanion-workspace/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill pentestcompanion-workspace -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/pentestcompanion-workspace/SKILL.md

## When to use it
- keep targets, ports and credentials for one engagement together
- run nmap or gobuster and land the findings in the database
- pull Nessus or Burp results in without retyping them
- score a vulnerability with CVSS and pick a matching template
- produce a DOCX or PDF report with the client's cover page

## Example prompts
- Create a new engagement in Pentest Companion and add target 10.0.0.50
- Run nmap against that target through the Tools Hub and show me what it found
- Import the findings from my `.nessus` file into the current engagement

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 42 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md