Name: security-pen-testing
Rating: 65.60000000000001 (1 reviews)
Author: alirezarezvani

security-pen-testing

Use when the user asks to perform security audits, penetration testing, vulnerability scanning, OWASP Top 10 checks, or offensive security assessments. Covers static analysis, dependency scanning, secret detection, API security testing, and pen test report generation.

Quality

80%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.gemini/skills/security-pen-testing/SKILL.md

The canonical home for this skill is security-pen-testing in alirezarezvani/claude-skills

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well-organized, actionable, and clearly sequenced with useful validation gates, but it is materially undermined by referencing three reference files and three scripts that are not bundled, breaking progressive disclosure navigation.

Suggestions

Bundle the referenced files (references/owasp_top_10_checklist.md, references/attack_patterns.md, references/responsible_disclosure.md) or remove the links and inline the essential content, since none of these paths currently exist.

Bundle or remove the invocations of scripts/vulnerability_scanner.py, scripts/dependency_auditor.py, and scripts/pentest_report_generator.py so the documented commands are actually executable.

Add an explicit validation checkpoint to Workflow 2 (e.g. 'verify each finding reproduces and is evidence-backed before compiling the report') to close the feedback-loop gap for a batch/destructive-adjacent operation.

Dimension	Reasoning	Score
Conciseness	The body is mostly efficient — tables, code blocks, and checklists carry the load with little explanatory padding of concepts Claude already knows — but a Table of Contents for a single file and some duplication between the OWASP quick-reference table and the referenced checklist could be trimmed, keeping it just below the lean anchor.	4 / 5
Actionability	Provides concrete, copy-paste-ready commands for real tools (trufflehog, nmap, npm audit, curl, govulncheck) plus a complete findings JSON schema and report structure, but the three custom scripts invoked (vulnerability_scanner.py, dependency_auditor.py, pentest_report_generator.py) are not bundled, a minor executability gap.	4 / 5
Workflow Clarity	Three workflows are clearly sequenced with decision gates ('If any critical or high findings, block the merge') and the CVE triage workflow includes an explicit verify-and-rerun feedback loop, though the main multi-day pen test workflow lacks an explicit validate-findings-before-reporting checkpoint.	4 / 5
Progressive Disclosure	Structure and signaling are good — one-level-deep markdown links to references/owasp_top_10_checklist.md, references/attack_patterns.md, and references/responsible_disclosure.md with descriptions of their contents — but no references/ or scripts/ directories exist, so every referenced path is a dangling link and navigation is broken, which the rubric explicitly scores against actual bundle structure.	3 / 5
	Total	15 / 20 Passed

Description

88%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-constructed description that explicitly covers both capabilities and triggers using concrete, natural language. It is comprehensive and clearly distinct from adjacent security skills, with only minor gaps in synonym coverage.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions across two clauses — 'security audits, penetration testing, vulnerability scanning, OWASP Top 10 checks' and 'static analysis, dependency scanning, secret detection, API security testing, and pen test report generation' — giving comprehensive coverage rather than vague language.	5 / 5
Completeness	Explicitly answers both what ('Covers static analysis, dependency scanning, secret detection, API security testing, and pen test report generation') and when ('Use when the user asks to perform security audits, penetration testing...'), with concrete trigger phrases matching the top anchor.	5 / 5
Trigger Term Quality	Strong natural terms users would actually say ('penetration testing', 'vulnerability scanning', 'security audits', 'OWASP Top 10', 'offensive security assessments'), but a few common variations (e.g. 'pentest', 'vuln scan', 'red team') are absent, so it sits just below the comprehensive anchor.	4 / 5
Distinctiveness Conflict Risk	The 'offensive security assessments' / 'penetration testing' framing carves a clear niche distinct from defensive or policy work, but 'security audits' and 'vulnerability scanning' are broad enough to risk minor overlap with related security skills, keeping it just below the minimal-conflict anchor.	4 / 5
	Total	18 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
relative_links	Relative link issues: 6 missing, 1 deeper-than-1-level, 3 suspicious	Warning
referenced_paths_exist	Referenced path issues: 15 missing	Warning

	Total	14 / 16 Passed

Repository: alirezarezvani/claude-skills
Path: .gemini/skills/security-pen-testing/SKILL.md
Commit: 19392f7

Reviewed: ~14 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.