pentest-checklist

This skill should be used when the user asks to "plan a penetration test", "create a security assessment checklist", "prepare for penetration testing", "define pentest scope", "follow security testing best practices", or needs a structured methodology for penetration testing engagements.

Quality

61%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Medium

Suggest reviewing before use

Fix and improve this skill with Tessl

tessl review fix ./skills/pentest-checklist/SKILL.md

Quality

Content

50%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a thorough, well-organized pentest checklist, but it is verbose with conceptual padding Claude already knows, has mixed actionability, lacks explicit validation feedback loops, and is monolithic with no file splitting. It sits at a solid 2 across all dimensions.

Suggestions

Trim explanatory tables Claude already knows (test-type definitions, black/gray/white box semantics, budget factors) to lean checklists, keeping only the actionable items.

Add explicit validation feedback loops for risky steps, e.g. after pre-scans: 'Review scanner output -> fix obvious issues -> re-scan -> only then hand off to pentesters'.

Split the detailed reference material (cloud-provider policy links, monitoring command examples, troubleshooting table) into a references/ file and point to it from SKILL.md so the main file stays a lean overview.

Dimension	Reasoning	Score
Conciseness	The checklist is useful and well-sectioned, but it explains concepts Claude already knows (pentest type definitions, black/gray/white box access levels, budget factors, compliance acronyms), so it is mostly efficient but padded and could be tightened to a 3.	2 / 3
Actionability	It mixes genuinely concrete, executable commands (nmap --script vuln, nikto -h, tcpdump) with many vague checklist items ('Seek recommendations', 'Check references', 'Verify credentials'), so guidance is present but incomplete.	2 / 3
Workflow Clarity	The five phases provide a clear sequence with checklists, but validation checkpoints and feedback loops (validate -> fix -> retry) are largely implicit; given destructive/batch operations like production scanning, the rubric caps this at 2.	2 / 3
Progressive Disclosure	The content is well-organized with clear headings and sections, but it is a single ~327-line monolithic file with no bundle references; content that could be split (detailed tables, examples, troubleshooting) is all inline, so it is not a 3.	2 / 3
	Total	8 / 12 Passed

Description

72%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description excels at trigger-term coverage and distinctiveness, but it is trigger-heavy and never states the skill's concrete capabilities explicitly. Adding a clear 'what it does' clause would round it out.

Suggestions

Open with an explicit capability statement (e.g., 'Provides a structured checklist for planning, executing, and remediating penetration tests') before the trigger list so 'what this does' is stated, not implied.

Replace the abstract 'structured methodology for penetration testing engagements' with concrete actions the skill performs (e.g., 'define scope, prepare the test environment, set up monitoring, and track remediation').

Dimension	Reasoning	Score
Specificity	The description names the domain clearly (penetration testing) and implies one concrete capability ('structured methodology for penetration testing engagements'), but it frames actions as user requests rather than listing the specific actions the skill itself performs, so it is not comprehensive enough for a 3.	2 / 3
Completeness	The 'when' is explicitly and strongly answered ('should be used when the user asks to...'), but the 'what does this do' is only implied through the trigger clauses rather than stated as an explicit capability, so it falls short of a 3.	2 / 3
Trigger Term Quality	It provides a strong set of natural phrases a user would actually say ('plan a penetration test', 'create a security assessment checklist', 'define pentest scope'), giving good coverage of likely trigger terms.	3 / 3
Distinctiveness Conflict Risk	Penetration testing is a clear niche and the triggers ('define pentest scope', 'security assessment checklist') are specific enough to be unlikely to fire for an unrelated skill.	3 / 3
	Total	10 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: zebbern/claude-code-guide
Path: skills/pentest-checklist/SKILL.md
Commit: af7d491

Reviewed: about 9 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.