# zen-ai-pentest-framework

A skill that sets up an autonomous pentest framework for AI agents, running real security tools and producing compliance-mapped reports.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 779 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/zen-ai-pentest-framework/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/zen-ai-pentest-framework

## What it does

This skill covers deploying Zen-AI-Pentest, a framework where AI agents drive actual security tooling — Nmap, Nuclei, SQLMap, FFuF and more — inside a Docker sandbox instead of faking results. Agents follow the ReAct loop: reason, act, observe, reflect. Four safety levels decide what is allowed, from passive information gathering up to exploit validation.

The stack includes a FastAPI backend pushing live updates over WebSocket, PostgreSQL for persistence, Redis for caching, JWT auth with RBAC, and report output in PDF, HTML or JSON mapped to OWASP, PCI-DSS and GDPR. A Python SDK lets you create a scan with `ZenClient`, wait for it to finish and save the report. Custom tools plug in through the `BaseTool` class.

You need Python 3.10+, Docker and Docker Compose, PostgreSQL 13+, plus `OPENAI_API_KEY` and `ANTHROPIC_API_KEY` in `.env`. Level 3 requires a VPN — without one it will not run. Installing manually also means pulling `nmap`, `sqlmap` and the rest yourself.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill zen-ai-pentest-framework -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/zen-ai-pentest-framework/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/zen-ai-pentest-framework/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill zen-ai-pentest-framework -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/zen-ai-pentest-framework/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill zen-ai-pentest-framework -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/zen-ai-pentest-framework/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills zen-ai-pentest-framework
```

2. **Manually: put the files in place**
- File: `.github/skills/zen-ai-pentest-framework/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill zen-ai-pentest-framework -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/zen-ai-pentest-framework
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/zen-ai-pentest-framework/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill zen-ai-pentest-framework -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/zen-ai-pentest-framework/SKILL.md

## When to use it
- stand up an autonomous pentest framework that runs real tools
- scan a target with AI agents under a chosen safety level
- produce a vulnerability report with CVSS and EPSS scoring
- wire a custom security tool into the agent
- run pentests from a CI/CD pipeline

## Example prompts
- Deploy Zen-AI-Pentest with Docker Compose and run a quick scan on example.com
- Create a scan at safety level 1 using nmap, nuclei and whatweb
- Configure an agent with memory at level 2 to probe web vulnerabilities

## Similar
- [penetration-testing](https://affpapa.org/en/nevibecode/skills/devops-skills-penetration-testing.md) — skill · 373 installs
- [supabase-pentest](https://affpapa.org/en/nevibecode/skills/supabase-pentest.md) — skill · 698 installs
- [recon](https://affpapa.org/en/nevibecode/skills/briiirussell-recon.md) — skill · 405 installs
- [web-pentest](https://affpapa.org/en/nevibecode/skills/web-pentest.md) — skill · 545 installs
- [pentest-checklist](https://affpapa.org/en/nevibecode/skills/pentest-checklist.md) — skill · 336 installs
- [container-escape-techniques](https://affpapa.org/en/nevibecode/skills/container-escape-techniques.md) — skill · 3600 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 42 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md