performing-penetration-testing

This skill enables automated penetration testing of web applications. It uses the penetration-tester plugin to identify vulnerabilities, including OWASP Top 10 threats, and suggests exploitation techniques. Use this skill when the user requests a "penetration test", "pentest", "vulnerability assessment", or asks to "exploit" a web application. It provides comprehensive reporting on identified security flaws.

Install with Tessl CLI

npx tessl i github:jeremylongshore/claude-code-plugins-plus-skills --skill performing-penetration-testing

What are skills?

1.00x

Quality

48%

Does it follow best practices?

Impact

90%

1.00x

Average score across 12 eval scenarios

Optimize this skill with Tessl

npx tessl skill review --optimize ./backups/skills-migration-20251108-070147/plugins/security/penetration-tester/skills/penetration-tester/SKILL.md

SKILL.md

Review

Evals

Evaluation results

100%

Penetration Test Report: RetailFlow E-Commerce Platform

Pentest report structure and content

Criteria

Without context

With context

Risk ratings present

100%

Remediation recommendations

100%

SQL injection coverage

100%

XSS coverage

100%

CSRF coverage

100%

OWASP framework reference

100%

Scope documentation

100%

Authorization statement

100%

Executive summary

100%

Structured sections

100%

Without context: $0.2790 · 1m 57s · 10 turns · 14 in / 6,295 out tokens

With context: $0.4825 · 2m 26s · 21 turns · 29 in / 7,654 out tokens

91%

-2%

Security Assessment Planning: MediTrack Patient Portal

Engagement planning and authorization

Criteria

Without context

With context

Authorization requirement

100%

Scope boundaries defined

100%

Safe exploitation approach

100%

Target identification step

100%

OWASP Top 10 methodology

100%

Vulnerability tracking integration

30%

10%

Authentication and authorization testing

100%

Reporting deliverable

100%

Without context: $0.3106 · 2m 19s · 11 turns · 18 in / 6,728 out tokens

With context: $0.5024 · 2m 53s · 22 turns · 174 in / 8,224 out tokens

88%

API Security Assessment: LogiTrack Shipment Management API

API security assessment reporting

Criteria

Without context

With context

Authentication bypass coverage

58%

100%

Authorization issues coverage

100%

Remediation per finding

100%

OWASP framework used

100%

Risk ratings assigned

100%

Injection attack coverage

100%

Authorization confirmation

100%

Vulnerability tracking mention

Scope definition

100%

Without context: $0.2737 · 1m 34s · 12 turns · 19 in / 4,711 out tokens

With context: $0.4885 · 2m 29s · 22 turns · 28 in / 7,595 out tokens

100%

23%

Vulnerability Findings Export for Engineering Backlog

Vulnerability tracking integration

Criteria

Without context

With context

Machine-readable export

100%

Risk rating per finding

100%

OWASP category per finding

100%

Remediation per finding

25%

100%

All input findings included

100%

Scope field present

100%

Authorization statement

100%

Tracking-system fields

80%

100%

Summary document

100%

No single-paragraph blob

100%

Without context: $0.2153 · 1m 1s · 13 turns · 20 in / 3,013 out tokens

With context: $0.5258 · 2m 9s · 27 turns · 31 in / 7,260 out tokens

100%

18%

Security Compliance Assessment for FinTech Web Portal

Comprehensive OWASP Top 10 assessment

Criteria

Without context

With context

OWASP Top 10 organizing structure

40%

100%

Minimum 8 OWASP categories covered

41%

100%

Injection addressed

100%

Broken access control addressed

100%

Risk rating per finding

80%

100%

Remediation per finding

100%

Target identification

100%

Scope definition

100%

Authorization confirmation

100%

Executive summary

100%

Negative findings included

100%

Without context: $0.4258 · 2m 48s · 16 turns · 23 in / 8,726 out tokens

With context: $0.6568 · 3m 56s · 22 turns · 27 in / 12,794 out tokens

70%

-3%

Developer Vulnerability Education Document

Safe exploitation demonstration documentation

Criteria

Without context

With context

No working exploit code

80%

60%

Conceptual PoC included

100%

SQL injection demonstrated safely

80%

70%

XSS demonstrated safely

70%

80%

Risk rating per vulnerability

Remediation per vulnerability

100%

Developer-oriented framing

100%

Authorization statement

100%

OWASP category mapping

Impact description

100%

Without context: $0.2367 · 1m 35s · 9 turns · 11 in / 4,536 out tokens

With context: $0.3932 · 2m 17s · 18 turns · 20 in / 6,579 out tokens

88%

-6%

Targeted Web Banking Security Assessment

CSRF and session security assessment

Criteria

Without context

With context

CSRF addressed

100%

Session/cookie security addressed

100%

Risk rating per finding

100%

Remediation per finding

100%

OWASP category mapping

90%

80%

Authorization statement

50%

20%

Scope defined

100%

No live attack payloads

100%

Conceptual PoC present

100%

75%

Executive summary

100%

Without context: $0.3381 · 2m 35s · 12 turns · 19 in / 7,927 out tokens

With context: $0.4981 · 2m 52s · 21 turns · 367 in / 8,697 out tokens

100%

Penetration Testing Engagement Template

Penetration testing methodology workflow

Criteria

Without context

With context

Target identification phase

100%

Vulnerability scanning phase

100%

Reporting phase

100%

Authorization requirement

100%

Scope definition requirement

100%

OWASP Top 10 in scanning

83%

100%

Safe exploitation guidance

100%

Report contents specified

100%

Sequential phase ordering

100%

Without context: $0.3262 · 2m 30s · 13 turns · 20 in / 7,132 out tokens

With context: $0.3910 · 2m 23s · 18 turns · 53 in / 6,559 out tokens

79%

-4%

Series A Due Diligence Security Review

Full-stack web app security review report

Criteria

Without context

With context

SQL injection addressed

100%

XSS addressed

100%

CSRF addressed

25%

Authentication/authorization addressed

100%

OWASP used as framework

100%

Risk rating per category

100%

Remediation per finding

100%

Authorization confirmed

12%

Scope documented

100%

Executive summary present

100%

Negative findings documented

50%

25%

Target identified

100%

Without context: $0.5815 · 4m 3s · 16 turns · 22 in / 12,689 out tokens

With context: $0.6552 · 3m 45s · 26 turns · 400 in / 11,922 out tokens

Evaluated: 2 days ago
Agent: Claude Code
Model: Claude Sonnet 4.6

Table of Contents

Penetration Test Report: RetailFlow E-Commerce Platform Security Assessment Planning: MediTrack Patient Portal API Security Assessment: LogiTrack Shipment Management API Vulnerability Findings Export for Engineering Backlog Security Compliance Assessment for FinTech Web Portal Developer Vulnerability Education Document Targeted Web Banking Security Assessment Penetration Testing Engagement Template Series A Due Diligence Security Review

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.