performing-penetration-testing
について
このスキルは、ペネトレーションテスター・プラグインを使用してOWASP Top 10の脆弱性を特定し、エクスプロイトを提案することで、Webアプリケーションペネトレーションテストを自動化します。ユーザーがペンテスト、脆弱性評価を要求するとき、またはWebアプリケーションのエクスプロイトを依頼したときに起動し、包括的なセキュリティレポートを提供します。開発者は、自動化された脆弱性スキャンとセキュリティ上の欠陥の特定のためにこれを使用すべきです。
クイックインストール
Claude Code
推奨/plugin add https://github.com/jeremylongshore/claude-code-plugins-plusgit clone https://github.com/jeremylongshore/claude-code-plugins-plus.git ~/.claude/skills/performing-penetration-testingこのコマンドをClaude Codeにコピー＆ペーストしてスキルをインストールします
ドキュメント
Overview
This skill automates the process of penetration testing for web applications, identifying vulnerabilities and suggesting exploitation techniques. It leverages the penetration-tester plugin to assess web application security posture.
How It Works
- Target Identification: Analyzes the user's request to identify the target web application or API endpoint.
- Vulnerability Scanning: Executes automated scans to discover potential vulnerabilities, covering OWASP Top 10 risks.
- Reporting: Generates a detailed penetration test report, including identified vulnerabilities, risk ratings, and remediation recommendations.
When to Use This Skill
This skill activates when you need to:
- Perform a penetration test on a web application.
- Identify vulnerabilities in a web application or API.
- Assess the security posture of a web application.
- Generate a report detailing security flaws and remediation steps.
Examples
Example 1: Performing a Full Penetration Test
User request: "Run a penetration test on example.com"
The skill will:
- Initiate a comprehensive penetration test on the specified domain.
- Generate a detailed report outlining identified vulnerabilities, including SQL injection, XSS, and CSRF.
Example 2: Assessing API Security
User request: "Perform vulnerability assessment on the /api/users endpoint"
The skill will:
- Target the specified API endpoint for vulnerability scanning.
- Identify potential security flaws in the API, such as authentication bypass or authorization issues, and provide remediation advice.
Best Practices
- Authorization: Always ensure you have explicit authorization before performing penetration testing on any system.
- Scope Definition: Clearly define the scope of the penetration test to avoid unintended consequences.
- Safe Exploitation: Use exploitation techniques carefully to demonstrate vulnerabilities without causing damage.
Integration
This skill can be integrated with other security tools and plugins to enhance vulnerability management and remediation efforts. For example, findings can be exported to vulnerability tracking systems.
GitHub リポジトリ
関連スキル
content-collections
メタThis skill provides a production-tested setup for Content Collections, a TypeScript-first tool that transforms Markdown/MDX files into type-safe data collections with Zod validation. Use it when building blogs, documentation sites, or content-heavy Vite + React applications to ensure type safety and automatic content validation. It covers everything from Vite plugin configuration and MDX compilation to deployment optimization and schema validation.
evaluating-llms-harness
テストThis Claude Skill runs the lm-evaluation-harness to benchmark LLMs across 60+ standardized academic tasks like MMLU and GSM8K. It's designed for developers to compare model quality, track training progress, or report academic results. The tool supports various backends including HuggingFace and vLLM models.
sglang
メタSGLang is a high-performance LLM serving framework that specializes in fast, structured generation for JSON, regex, and agentic workflows using its RadixAttention prefix caching. It delivers significantly faster inference, especially for tasks with repeated prefixes, making it ideal for complex, structured outputs and multi-turn conversations. Choose SGLang over alternatives like vLLM when you need constrained decoding or are building applications with extensive prefix sharing.
cloudflare-turnstile
メタThis skill provides comprehensive guidance for implementing Cloudflare Turnstile as a CAPTCHA-alternative bot protection system. It covers integration for forms, login pages, API endpoints, and frameworks like React/Next.js/Hono, while handling invisible challenges that maintain user experience. Use it when migrating from reCAPTCHA, debugging error codes, or implementing token validation and E2E tests.