skill CX Codex

zen-ai-pentest-framework — Claude Code skill: autonomous pentest

Q: How do I install zen-ai-pentest-framework in Claude Code?

Run `npx skills add reason-machines/security-skills --skill zen-ai-pentest-framework -a claude-code`. The skill lands in `~/.claude/skills/zen-ai-pentest-framework/SKILL.md`.

A skill that sets up an autonomous pentest framework for AI agents, running real security tools and producing compliance-mapped reports.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓

npx skills add reason-machines/security-skills --skill zen-ai-pentest-framework -a claude-code

Open on GitHub

What zen-ai-pentest-framework does

This skill covers deploying Zen-AI-Pentest, a framework where AI agents drive actual security tooling — Nmap, Nuclei, SQLMap, FFuF and more — inside a Docker sandbox instead of faking results. Agents follow the ReAct loop: reason, act, observe, reflect. Four safety levels decide what is allowed, from passive information gathering up to exploit validation.

The stack includes a FastAPI backend pushing live updates over WebSocket, PostgreSQL for persistence, Redis for caching, JWT auth with RBAC, and report output in PDF, HTML or JSON mapped to OWASP, PCI-DSS and GDPR. A Python SDK lets you create a scan with ZenClient, wait for it to finish and save the report. Custom tools plug in through the BaseTool class.

You need Python 3.10+, Docker and Docker Compose, PostgreSQL 13+, plus OPENAI_API_KEY and ANTHROPIC_API_KEY in .env. Level 3 requires a VPN — without one it will not run. Installing manually also means pulling nmap, sqlmap and the rest yourself.

What it helps with

stand up an autonomous pentest framework that runs real tools
scan a target with AI agents under a chosen safety level
produce a vulnerability report with CVSS and EPSS scoring
wire a custom security tool into the agent
run pentests from a CI/CD pipeline

Example prompts for the agent

Deploy Zen-AI-Pentest with Docker Compose and run a quick scan on example.com
Create a scan at safety level 1 using nmap, nuclei and whatweb
Configure an agent with memory at level 2 to probe web vulnerabilities

How to install zen-ai-pentest-framework

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill zen-ai-pentest-framework -a claude-code

2Manually: put the files in place

~/.claude/skills/zen-ai-pentest-framework/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/zen-ai-pentest-framework/

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill zen-ai-pentest-framework -a codex

2Manually: put the files in place

.agents/skills/zen-ai-pentest-framework/SKILL.md

For all projects use ~/.agents/skills/

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill zen-ai-pentest-framework -a cursor

2Manually: put the files in place

.cursor/skills/zen-ai-pentest-framework/SKILL.md

Cursor also reads .agents/skills/ and .claude/skills/

1GitHub CLI

gh skill install reason-machines/security-skills zen-ai-pentest-framework

2Manually: put the files in place

.github/skills/zen-ai-pentest-framework/SKILL.md

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill zen-ai-pentest-framework -a gemini-cli

2Platform CLI

gemini skills install https://github.com/reason-machines/security-skills --path skills/zen-ai-pentest-framework

Manually: put the files in place

.devin/skills/zen-ai-pentest-framework/SKILL.md

The legacy .windsurf/skills/ path still works

Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill zen-ai-pentest-framework -a opencode

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about zen-ai-pentest-framework

How do I install zen-ai-pentest-framework in Claude Code?

Run npx skills add reason-machines/security-skills --skill zen-ai-pentest-framework -a claude-code. The skill lands in ~/.claude/skills/zen-ai-pentest-framework/SKILL.md.

What does zen-ai-pentest-framework do?

It deploys an autonomous pentest framework: AI agents execute real security tools in a Docker sandbox, collect findings and generate reports mapped to compliance frameworks.

What do I need to run the framework?

Python 3.10+, Docker and Docker Compose, PostgreSQL 13+, and OPENAI_API_KEY and ANTHROPIC_API_KEY in .env. Redis is only for caching.

Similar skills

All skills for Security →

git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs

From the same set42

malware-repository-warning The skill triggers when someone asks for help with a crack, keygen or pre-activated antivirus, and answers with a warning instead of setup steps. CX Codex +1 851installs kali-pentest-ai-agent This skill plans and runs phased penetration tests with Kali Linux tools. It fits authorized assessments where high-risk actions need human approval. CX Codex +1 837installs malware-analysis-warning This skill flags repositories that may distribute malware while posing as antivirus or other security software. CX Codex +1 833installs edgesecurityaccess-wireguard-vpn This skill walks the agent through standing up a WireGuard VPN: build the Go server, add users, and hand out configs over an HTTP API. CX Codex +1 788installs sparkfinderoven-security-compliance-skills A suite of commands and workflows for security and compliance work: OWASP scanning, CVE detection, GDPR audits, SOC 2 readiness, threat modeling. CX Codex +1 759installs security-compliance-skills-suite-claude This skill scans code and dependencies for security issues, supports GDPR, SOC 2 and ISO 27001 checks, and guides incident response. CX Codex +1 754installs pentestify-security-report-generator A skill that turns pentest findings into a structured report: vulnerability tracking, live risk stats and PDF export. CX Codex +1 747installs awesome-claude-code-security-compliance-suite This skill checks code and dependencies for security issues, supports GDPR audits, and builds threat models. Use it for security work inside coding agents. CX Codex +1 730installs