How do I install the Pentest skill?

Run npx skillmds@latest add bg-szy/pentest in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Pentest safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Pentest?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Pentest free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Pentest?

bg-szy (@bg-szy) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Pentest by bg-szy — Agent Skill

Name: Pentest
Author: bg-szy

File contents

Pentest — Clearwing Security Scanner

Authorized security testing using clearwing.

Authorization Check

Before any scanning, confirm authorization with the user. Ask:

Is this target owned by you or your organization?
Do you have written authorization to test it?
What is the scope (source code only, network, or both)?

If authorization is unclear, STOP and do not proceed.

Prerequisites

Check if clearwing is installed:

command -v clearwing && clearwing --version

If not installed:

uv tool install clearwing
clearwing setup  # Interactive LLM provider configuration

Requires: Python 3.10+, uv, Rust toolchain (for native bridge).

Mode 1: Source Code Analysis

Hunt vulnerabilities in source code using the 11-stage pipeline:

# Standard depth — recommended starting point
clearwing sourcehunt <path-to-repo> --depth standard

# Quick scan — faster, less thorough
clearwing sourcehunt <path-to-repo> --depth quick

# Deep scan — comprehensive, takes longer
clearwing sourcehunt <path-to-repo> --depth deep

The pipeline: preprocess → rank files → generate fuzzing harnesses → tiered hunt (6 specialists) → adversarial verification → patch oracle → variant loop → exploit triage → auto-patch → report.

Evidence levels (ascending confidence):

suspicion — pattern match, needs investigation
static_corroboration — confirmed by static analysis
crash_reproduced — fuzzer triggered a crash
root_cause_explained — mechanism understood
exploit_demonstrated — exploitability confirmed
patch_validated — fix verified

Mode 2: Network Scanning

Scan a live target for service vulnerabilities:

# Single host
clearwing scan <target-ip-or-hostname>

# CIDR block (concurrent)
clearwing parallel <CIDR> --max-concurrent 5

Output

Results are stored in SQLite and exported as:

SARIF — for GitHub Code Scanning integration
Markdown — human-readable report
JSON — machine-readable findings

Interactive Mode

For guided exploration:

clearwing interactive
clearwing interactive --resume <session_id>

CI Integration

clearwing ci --sarif-output results.sarif

---name: pentestdescription: Security scanning via clearwing — source code vulnerability hunting and network pentesting.---# Pentest — Clearwing Security ScannerAuthorized security testing using [clearwing](https://github.com/Lazarus-AI/clearwing).## Authorization Check**Before any scanning, confirm authorization with the user.** Ask:1. Is this target owned by you or your organization?2. Do you have written authorization to test it?3. What is the scope (source code only, network, or both)?If authorization is unclear, STOP and do not proceed.## PrerequisitesCheck if clearwing is installed:```bashcommand -v clearwing && clearwing --version```If not installed:```bashuv tool install clearwingclearwing setup # Interactive LLM provider configuration```Requires: Python 3.10+, uv, Rust toolchain (for native bridge).## Mode 1: Source Code AnalysisHunt vulnerabilities in source code using the 11-stage pipeline:```bash# Standard depth — recommended starting pointclearwing sourcehunt <path-to-repo> --depth standard# Quick scan — faster, less thoroughclearwing sourcehunt <path-to-repo> --depth quick# Deep scan — comprehensive, takes longerclearwing sourcehunt <path-to-repo> --depth deep```The pipeline: preprocess → rank files → generate fuzzing harnesses → tiered hunt (6 specialists) → adversarial verification → patch oracle → variant loop → exploit triage → auto-patch → report.Evidence levels (ascending confidence):1. `suspicion` — pattern match, needs investigation2. `static_corroboration` — confirmed by static analysis3. `crash_reproduced` — fuzzer triggered a crash4. `root_cause_explained` — mechanism understood5. `exploit_demonstrated` — exploitability confirmed6. `patch_validated` — fix verified## Mode 2: Network ScanningScan a live target for service vulnerabilities:```bash# Single hostclearwing scan <target-ip-or-hostname># CIDR block (concurrent)clearwing parallel <CIDR> --max-concurrent 5```## OutputResults are stored in SQLite and exported as:- **SARIF** — for GitHub Code Scanning integration- **Markdown** — human-readable report- **JSON** — machine-readable findings## Interactive ModeFor guided exploration:```bashclearwing interactiveclearwing interactive --resume <session_id>```## CI Integration```bashclearwing ci --sarif-output results.sarif```

Frequently asked questions

Pentest