# Pentesting Checklist Interactive

> Interactive security assessment checklist covering 23 platforms with 1000+ checks for penetration testing, bug bounty, and security audits

- Skill: `aradotso-security-skills/pentesting-checklist-interactive` (Agent Skill)
- Install (CLI): `npx skillmds@latest add aradotso-security-skills/pentesting-checklist-interactive`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aradotso-security-skills/pentesting-checklist-interactive/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: aradotso (https://skillmd.com/u/aradotso-security-skills)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/aradotso-security-skills/pentesting-checklist-interactive

---


# PentestingChecklist Interactive Skill

> Skill by [ara.so](https://ara.so) — Security Skills collection.

## Overview

PentestingChecklist is a comprehensive, client-side security assessment checklist covering 23 platforms with over 1,000 security checks. It runs entirely in the browser with no backend, storing all progress and notes in localStorage. The tool provides hierarchical organization (Platform → Category → Technology → Check), global search, progress tracking, severity filtering, and export capabilities for penetration testers, bug bounty hunters, and security engineers.

**Key platforms covered:** Web Application, API, Mobile, Cloud (AWS/Azure/GCP), Active Directory, Kubernetes, LLM Security, MCP Security, Blockchain, IoT, CI/CD, and 12 more.

**Live instance:** [checklist.m14r41.in](https://checklist.m14r41.in)

## Installation & Setup

### Running Locally

```bash
# Clone the repository
git clone https://github.com/m14r41/PentestingChecklist.git
cd PentestingChecklist

# Install dependencies
npm install

# Start development server
npm run dev

# Build for production
npm run build

# Preview production build
npm run preview
```

### Project Structure

```
PentestingChecklist/
├── src/
│   ├── components/       # React components
│   ├── data/            # Checklist data files
│   ├── types/           # TypeScript type definitions
│   ├── utils/           # Utility functions
│   └── App.tsx          # Main application
├── public/              # Static assets
└── package.json
```

## Core Concepts

### Data Structure

The checklist uses a 4-level hierarchy:

```typescript
interface Platform {
  id: string;
  name: string;
  description: string;
  categories: Category[];
}

interface Category {
  id: string;
  name: string;
  technologies: Technology[];
}

interface Technology {
  id: string;
  name: string;
  checks: Check[];
}

interface Check {
  id: string;
  title: string;
  description: string;
  severity: 'critical' | 'high' | 'medium' | 'low' | 'info';
  tags: string[];
  tools?: string[];
  references?: string[];
}
```

### State Management

All assessment data is stored in localStorage:

```typescript
// Progress tracking structure
interface AssessmentState {
  checkStatus: Record<string, 'open' | 'closed' | 'na'>;
  checkNotes: Record<string, string>;
  progress: {
    overall: number;
    perPlatform: Record<string, number>;
    perCategory: Record<string, number>;
  };
}
```

## Key Features & Usage

### 1. Navigation & Hierarchy

**Expand/Collapse All:**
```typescript
// Expand all sections
const expandAll = () => {
  setExpandedCategories(new Set(categories.map(c => c.id)));
  setExpandedTechnologies(new Set(technologies.map(t => t.id)));
};

// Collapse all sections
const collapseAll = () => {
  setExpandedCategories(new Set());
  setExpandedTechnologies(new Set());
};
```

**Platform-specific views:**
- `/checklist` - All platforms view
- `/web` - Web Application platform
- `/api` - API Security platform
- `/mobile` - Mobile Security platform
- `/cloud` - Cloud Security platform
- `/active-directory` - Active Directory platform
- `/kubernetes` - Kubernetes Security platform
- `/llm` - LLM Security platform
- `/mcp` - MCP Security platform
- (and 14 more platform-specific routes)

### 2. Global Search (⌘K / Ctrl+K)

Search across all content types:

```typescript
// Search implementation
const searchChecklist = (query: string) => {
  const results = [];
  
  platforms.forEach(platform => {
    platform.categories.forEach(category => {
      category.technologies.forEach(technology => {
        technology.checks.forEach(check => {
          const searchable = [
            check.title,
            check.description,
            ...check.tags,
            ...(check.tools || []),
            ...(check.references || [])
          ].join(' ').toLowerCase();
          
          if (searchable.includes(query.toLowerCase())) {
            results.push({
              platform: platform.name,
              category: category.name,
              technology: technology.name,
              check: check
            });
          }
        });
      });
    });
  });
  
  return results;
};
```

### 3. Status Tracking

Mark checks with different statuses:

```typescript
type CheckStatus = 'open' | 'closed' | 'na';

// Set check status
const setCheckStatus = (checkId: string, status: CheckStatus) => {
  const currentState = getAssessmentState();
  currentState.checkStatus[checkId] = status;
  saveAssessmentState(currentState);
};

// Get all open findings
const getOpenFindings = () => {
  const state = getAssessmentState();
  return Object.entries(state.checkStatus)
    .filter(([_, status]) => status === 'open')
    .map(([checkId, _]) => findCheckById(checkId));
};
```

### 4. Notes Management

Add contextual notes to checks:

```typescript
// Add/update note for a check
const updateCheckNote = (checkId: string, note: string) => {
  const state = getAssessmentState();
  if (note.trim()) {
    state.checkNotes[checkId] = note;
  } else {
    delete state.checkNotes[checkId];
  }
  saveAssessmentState(state);
};

// Get note for a check
const getCheckNote = (checkId: string): string => {
  const state = getAssessmentState();
  return state.checkNotes[checkId] || '';
};
```

### 5. Severity Filtering

Filter checks by severity level:

```typescript
type Severity = 'critical' | 'high' | 'medium' | 'low' | 'info';

const filterBySeverity = (
  checks: Check[], 
  severities: Set<Severity>
): Check[] => {
  if (severities.size === 0) return checks;
  return checks.filter(check => severities.has(check.severity));
};

// Example usage
const activeSeverities = new Set<Severity>(['critical', 'high']);
const filteredChecks = filterBySeverity(allChecks, activeSeverities);
```

### 6. Progress Calculation

Track completion percentage:

```typescript
// Calculate platform progress
const calculatePlatformProgress = (platformId: string): number => {
  const platform = findPlatformById(platformId);
  const totalChecks = countChecksInPlatform(platform);
  const completedChecks = countCompletedChecks(platform);
  
  return totalChecks > 0 ? (completedChecks / totalChecks) * 100 : 0;
};

// Calculate overall progress
const calculateOverallProgress = (): number => {
  const totalChecks = platforms.reduce(
    (sum, p) => sum + countChecksInPlatform(p), 
    0
  );
  const completedChecks = platforms.reduce(
    (sum, p) => sum + countCompletedChecks(p), 
    0
  );
  
  return totalChecks > 0 ? (completedChecks / totalChecks) * 100 : 0;
};
```

## Export & Import

### Export Formats

**Markdown Export:**
```typescript
const exportToMarkdown = (): string => {
  const state = getAssessmentState();
  let markdown = `# Security Assessment Report\n\n`;
  markdown += `Generated: ${new Date().toISOString()}\n\n`;
  
  platforms.forEach(platform => {
    markdown += `## ${platform.name}\n\n`;
    
    platform.categories.forEach(category => {
      category.technologies.forEach(technology => {
        technology.checks.forEach(check => {
          const status = state.checkStatus[check.id];
          const note = state.checkNotes[check.id];
          
          if (status === 'open') {
            markdown += `### [${check.severity.toUpperCase()}] ${check.title}\n`;
            markdown += `**Status:** ${status}\n\n`;
            markdown += `${check.description}\n\n`;
            if (note) markdown += `**Notes:** ${note}\n\n`;
          }
        });
      });
    });
  });
  
  return markdown;
};
```

**CSV Export:**
```typescript
const exportToCSV = (): string => {
  const state = getAssessmentState();
  const rows = [
    ['Platform', 'Category', 'Technology', 'Check', 'Severity', 'Status', 'Notes']
  ];
  
  platforms.forEach(platform => {
    platform.categories.forEach(category => {
      category.technologies.forEach(technology => {
        technology.checks.forEach(check => {
          rows.push([
            platform.name,
            category.name,
            technology.name,
            check.title,
            check.severity,
            state.checkStatus[check.id] || 'unchecked',
            state.checkNotes[check.id] || ''
          ]);
        });
      });
    });
  });
  
  return rows.map(row => row.map(cell => `"${cell}"`).join(',')).join('\n');
};
```

**JSON Export:**
```typescript
interface ExportData {
  version: string;
  exportDate: string;
  state: AssessmentState;
  metadata: {
    totalChecks: number;
    completedChecks: number;
    progress: number;
  };
}

const exportToJSON = (): string => {
  const state = getAssessmentState();
  const exportData: ExportData = {
    version: '1.0',
    exportDate: new Date().toISOString(),
    state: state,
    metadata: {
      totalChecks: countAllChecks(),
      completedChecks: countCompletedChecks(),
      progress: calculateOverallProgress()
    }
  };
  
  return JSON.stringify(exportData, null, 2);
};
```

### Import from JSON

```typescript
const importFromJSON = (jsonString: string): boolean => {
  try {
    const data: ExportData = JSON.parse(jsonString);
    
    // Validate version compatibility
    if (data.version !== '1.0') {
      console.warn('Version mismatch, attempting import anyway');
    }
    
    // Restore state
    saveAssessmentState(data.state);
    
    return true;
  } catch (error) {
    console.error('Import failed:', error);
    return false;
  }
};
```

## LocalStorage Management

### Save and Load State

```typescript
const STORAGE_KEY = 'pentesting-checklist-state';

const saveAssessmentState = (state: AssessmentState): void => {
  try {
    localStorage.setItem(STORAGE_KEY, JSON.stringify(state));
  } catch (error) {
    console.error('Failed to save state:', error);
  }
};

const getAssessmentState = (): AssessmentState => {
  try {
    const stored = localStorage.getItem(STORAGE_KEY);
    if (stored) {
      return JSON.parse(stored);
    }
  } catch (error) {
    console.error('Failed to load state:', error);
  }
  
  return {
    checkStatus: {},
    checkNotes: {},
    progress: {
      overall: 0,
      perPlatform: {},
      perCategory: {}
    }
  };
};

const clearAssessmentState = (): void => {
  localStorage.removeItem(STORAGE_KEY);
};
```

## Common Patterns

### Starting a New Assessment

```typescript
// Initialize new assessment for a specific platform
const startNewAssessment = (platformId: string) => {
  // Optionally clear previous state
  const clearPrevious = confirm('Clear previous assessment data?');
  if (clearPrevious) {
    clearAssessmentState();
  }
  
  // Navigate to platform
  navigate(`/${platformId}`);
  
  // Expand all sections for comprehensive review
  expandAll();
};
```

### Filtering Open Findings

```typescript
// Get all open findings with critical/high severity
const getCriticalOpenFindings = () => {
  const state = getAssessmentState();
  
  return platforms.flatMap(platform =>
    platform.categories.flatMap(category =>
      category.technologies.flatMap(technology =>
        technology.checks.filter(check =>
          state.checkStatus[check.id] === 'open' &&
          (check.severity === 'critical' || check.severity === 'high')
        )
      )
    )
  );
};
```

### Bulk Status Update

```typescript
// Mark all checks in a category as N/A
const markCategoryAsNA = (categoryId: string) => {
  const category = findCategoryById(categoryId);
  const state = getAssessmentState();
  
  category.technologies.forEach(technology => {
    technology.checks.forEach(check => {
      state.checkStatus[check.id] = 'na';
    });
  });
  
  saveAssessmentState(state);
};
```

### Platform-Specific Quick Filters

```typescript
// Common filtering scenarios
const filterHelpers = {
  // Get all authentication-related checks
  getAuthChecks: () => 
    searchByTags(['authentication', 'auth', 'login', 'session']),
  
  // Get all injection checks
  getInjectionChecks: () =>
    searchByTags(['injection', 'sqli', 'xss', 'command-injection']),
  
  // Get all configuration checks
  getConfigChecks: () =>
    searchByTags(['configuration', 'hardening', 'misconfiguration']),
  
  // Get OWASP Top 10 related checks
  getOWASPChecks: () =>
    searchByTags(['owasp', 'owasp-top-10'])
};

const searchByTags = (tags: string[]): Check[] => {
  return platforms.flatMap(platform =>
    platform.categories.flatMap(category =>
      category.technologies.flatMap(technology =>
        technology.checks.filter(check =>
          check.tags.some(tag => 
            tags.some(searchTag => 
              tag.toLowerCase().includes(searchTag.toLowerCase())
            )
          )
        )
      )
    )
  );
};
```

## Troubleshooting

### localStorage Issues

```typescript
// Check if localStorage is available
const isLocalStorageAvailable = (): boolean => {
  try {
    const test = '__storage_test__';
    localStorage.setItem(test, test);
    localStorage.removeItem(test);
    return true;
  } catch {
    return false;
  }
};

// Handle quota exceeded errors
const safeLocalStorageSave = (key: string, data: any): boolean => {
  try {
    localStorage.setItem(key, JSON.stringify(data));
    return true;
  } catch (error) {
    if (error.name === 'QuotaExceededError') {
      console.error('localStorage quota exceeded. Consider exporting and clearing old data.');
      // Optionally implement cleanup logic
    }
    return false;
  }
};
```

### State Recovery

```typescript
// Backup state before risky operations
const backupState = (): string => {
  return localStorage.getItem(STORAGE_KEY) || '{}';
};

// Restore from backup
const restoreState = (backup: string): void => {
  localStorage.setItem(STORAGE_KEY, backup);
  window.location.reload();
};
```

### Performance Optimization

```typescript
// Debounce note updates to reduce localStorage writes
const debouncedUpdateNote = debounce((checkId: string, note: string) => {
  updateCheckNote(checkId, note);
}, 500);

function debounce<T extends (...args: any[]) => any>(
  func: T,
  wait: number
): (...args: Parameters<T>) => void {
  let timeout: NodeJS.Timeout;
  return (...args: Parameters<T>) => {
    clearTimeout(timeout);
    timeout = setTimeout(() => func(...args), wait);
  };
}
```

## Best Practices

1. **Regular Exports**: Export assessment data regularly (daily for long assessments)
2. **Browser Consistency**: Use the same browser throughout an assessment to maintain state
3. **Backup Before Clear**: Always export before clearing localStorage
4. **Progressive Review**: Start with critical/high severity items, then work down
5. **Detailed Notes**: Include request/response snippets, payloads, and reproduction steps
6. **Platform Focus**: Complete one platform before moving to another for better context
7. **Status Discipline**: Use 'N/A' for out-of-scope items to accurately track progress

## Integration Examples

### CI/CD Integration (Automated Checks)

```typescript
// Example: Parse checklist data for automated scanning
import checklistData from './src/data/checklist.json';

const getAutomatableChecks = () => {
  return checklistData.platforms.flatMap(platform =>
    platform.categories.flatMap(category =>
      category.technologies.flatMap(technology =>
        technology.checks.filter(check =>
          check.tags.includes('automatable') &&
          check.tools && check.tools.length > 0
        )
      )
    )
  );
};
```

### Custom Report Generation

```typescript
// Generate executive summary
const generateExecutiveSummary = (): string => {
  const state = getAssessmentState();
  const findings = {
    critical: 0,
    high: 0,
    medium: 0,
    low: 0,
    info: 0
  };
  
  Object.entries(state.checkStatus).forEach(([checkId, status]) => {
    if (status === 'open') {
      const check = findCheckById(checkId);
      if (check) findings[check.severity]++;
    }
  });
  
  return `
# Executive Summary

**Total Open Findings:** ${Object.values(findings).reduce((a, b) => a + b, 0)}

- Critical: ${findings.critical}
- High: ${findings.high}
- Medium: ${findings.medium}
- Low: ${findings.low}
- Informational: ${findings.info}

**Overall Progress:** ${calculateOverallProgress().toFixed(1)}%
  `.trim();
};
```

This skill provides comprehensive coverage of the PentestingChecklist tool for AI agents to assist developers and security professionals in conducting thorough security assessments.