# Pentest

> Security scanning via clearwing — source code vulnerability hunting and network pentesting.

- Skill: `bg-szy/pentest` (Agent Skill)
- Install (CLI): `npx skillmds@latest add bg-szy/pentest`
- Raw SKILL.md: https://api.skillmd.com/api/skills/bg-szy/pentest/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: bg-szy (https://skillmd.com/u/bg-szy)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/bg-szy/pentest

---


# Pentest — Clearwing Security Scanner

Authorized security testing using [clearwing](https://github.com/Lazarus-AI/clearwing).

## Authorization Check

**Before any scanning, confirm authorization with the user.** Ask:
1. Is this target owned by you or your organization?
2. Do you have written authorization to test it?
3. What is the scope (source code only, network, or both)?

If authorization is unclear, STOP and do not proceed.

## Prerequisites

Check if clearwing is installed:

```bash
command -v clearwing && clearwing --version
```

If not installed:
```bash
uv tool install clearwing
clearwing setup  # Interactive LLM provider configuration
```

Requires: Python 3.10+, uv, Rust toolchain (for native bridge).

## Mode 1: Source Code Analysis

Hunt vulnerabilities in source code using the 11-stage pipeline:

```bash
# Standard depth — recommended starting point
clearwing sourcehunt <path-to-repo> --depth standard

# Quick scan — faster, less thorough
clearwing sourcehunt <path-to-repo> --depth quick

# Deep scan — comprehensive, takes longer
clearwing sourcehunt <path-to-repo> --depth deep
```

The pipeline: preprocess → rank files → generate fuzzing harnesses → tiered hunt (6 specialists) → adversarial verification → patch oracle → variant loop → exploit triage → auto-patch → report.

Evidence levels (ascending confidence):
1. `suspicion` — pattern match, needs investigation
2. `static_corroboration` — confirmed by static analysis
3. `crash_reproduced` — fuzzer triggered a crash
4. `root_cause_explained` — mechanism understood
5. `exploit_demonstrated` — exploitability confirmed
6. `patch_validated` — fix verified

## Mode 2: Network Scanning

Scan a live target for service vulnerabilities:

```bash
# Single host
clearwing scan <target-ip-or-hostname>

# CIDR block (concurrent)
clearwing parallel <CIDR> --max-concurrent 5
```

## Output

Results are stored in SQLite and exported as:
- **SARIF** — for GitHub Code Scanning integration
- **Markdown** — human-readable report
- **JSON** — machine-readable findings

## Interactive Mode

For guided exploration:
```bash
clearwing interactive
clearwing interactive --resume <session_id>
```

## CI Integration

```bash
clearwing ci --sarif-output results.sarif
```