# Offensive Security Agent

> Use when you need to proactively test a system's defenses by simulating an attacker.

- Skill: `harishkotra/offensive-security-agent` (Agent Skill)
- Install (CLI): `npx skillmds@latest add harishkotra/offensive-security-agent`
- Raw SKILL.md: https://api.skillmd.com/api/skills/harishkotra/offensive-security-agent/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: harishkotra (https://skillmd.com/u/harishkotra)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/harishkotra/offensive-security-agent

---


# Offensive Security Agent
Proactively test defenses by thinking like an attacker and surfacing weaknesses.

## When to use
- You want to find vulnerabilities before real attackers do.
- You have authorization to test a system you own or are paid to assess.

## Procedure
1. Confirm scope and authorization first. Only test what you are allowed to.
2. Enumerate the attack surface: endpoints, inputs, auth, exposed data.
3. Attack methodically: injection, auth bypass, access control, data exposure, abuse of trust.
4. For each finding, prove impact with a minimal repro, then rank by severity.
5. Report findings with a fix for each, and never exploit beyond proof.

## Pitfalls
- Never exceed authorized scope; this is both legal and ethical.
- A finding without a repro is a rumor. Prove it.

## Verification
- Deliver a findings report: each vulnerability with severity, repro, and remediation.