pentest-commands

This skill should be used when the user asks to "run pentest commands", "scan with nmap", "use metasploit exploits", "crack passwords with hydra or john", "scan web vulnerabilities with nikto", "enumerate networks", or needs essential penetration testing command references.

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

72%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable, with concrete executable commands for every major pentest tool, and is reasonably concise. It is weakened by a monolithic single-file structure with no progressive disclosure and by the absence of validation/verification steps for destructive batch operations like brute forcing and exploitation.

Suggestions

Split the per-tool command catalogs into one-level-deep reference files (e.g., references/nmap.md, references/metasploit.md) and have SKILL.md point to them, so the overview stays lean.

Add explicit validation/verification checkpoints for risky batch and destructive operations (e.g., confirm authorization before brute forcing; verify a payload executes before trusting it; check account-lockout state after hydra runs).

Tighten repeated boilerplate blocks such as the series of 'msfconsole -x "use ...; set RHOST ...; exploit"' wrappers into a parameterized pattern to reduce token cost.

Dimension	Reasoning	Score
Conciseness	The body is mostly lean executable commands with terse inline comments and little concept explanation Claude already knows; a few repeated boilerplate blocks (msfconsole -x wrappers) could be tightened.	4 / 5
Actionability	Provides fully executable, copy-paste-ready commands across eight tools (nmap, metasploit, nikto, sqlmap, hydra, john, aircrack-ng, tshark) with concrete examples covering common cases.	5 / 5
Workflow Clarity	It is organized as a per-tool reference catalog with numbered sections, but destructive/batch operations (brute forcing, exploitation, deauth) have no validation or verification checkpoints; the rubric caps such skills at 3.	3 / 5
Progressive Disclosure	All content is inlined into a single ~430-line SKILL.md with no bundle files in references/scripts/assets and no external references signaled; section headers give some structure, but material that belongs in separate reference files is inlined.	3 / 5
	Total	15 / 20 Passed

Description

95%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong: it explicitly answers what the skill does and when to use it, with comprehensive natural trigger phrases tied to named pentest tools. Minor specificity gaps prevent a perfect specificity score, but trigger coverage and completeness are excellent.

Dimension	Reasoning	Score
Specificity	Lists several specific concrete actions (scan with nmap, use metasploit exploits, crack passwords with hydra or john, scan web vulnerabilities with nikto, enumerate networks) tied to named tools, with only minor coverage gaps.	4 / 5
Completeness	Explicitly states the 'what' ('essential penetration testing command references') and the 'when' via a clear 'should be used when the user asks to ...' clause with concrete trigger phrases.	5 / 5
Trigger Term Quality	Provides comprehensive natural quoted phrases a user would actually say ('run pentest commands', 'scan with nmap', 'crack passwords with hydra or john', 'scan web vulnerabilities with nikto', 'enumerate networks'), covering multiple tools and synonyms.	5 / 5
Distinctiveness Conflict Risk	Targets a clear niche (penetration testing command references) with tool-specific triggers (nmap, metasploit, hydra, john, nikto), giving minimal overlap risk with unrelated skills.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: zebbern/claude-code-guide
Path: skills/pentest-commands/SKILL.md
Commit: 3b43482

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.