How do I install the Pentest skill?

Run npx skillmds@latest add zakirkun/pentest in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Pentest safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Pentest?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Pentest free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Pentest?

zakirkun (@zakirkun) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Pentest by zakirkun — Agent Skill

Name: Pentest
Author: zakirkun

Pentest

Authorized penetration testing with Deep Eye (this repo). Use for pentest, penetration test, vulnerability assessment, web/API/mobile scan, OWASP testing, /pentest. Requires written authorization. Never scan unauthorized targets.

zakirkun d3ecdf1 3.5 KB Updated Sep 17, 2026

File contents

Deep Eye — Pentest Skill

Authorized offensive testing only. Work inside this repository’s tool surface.

Preconditions

Written RoE / scope (hosts, paths, time, credentials).
Config present: config/config.yaml (from example or wizard).
No secrets committed; use local config/config.yaml only.

Quick start

pip install -r requirements.txt
cp config/config.example.yaml config/config.yaml   # or:
python deep_eye.py --setup

python deep_eye.py -u https://TARGET -v --formats html,json
python deep_eye.py -u https://TARGET --scope-nl "only /api/* no /logout"
python deep_eye.py -u https://TARGET --retest-new reports/baseline.json

Workflow

1. Scope

CLI: --scope-nl "..." → utils/nl_scope.py → scope config.
YAML: scope.enabled, allowed_hosts, excluded_paths.

2. Recon

scanner.enable_recon: true
Modules: modules/reconnaissance/, optional OSINT (osint config).
OpenAPI seed: openapi.enabled + openapi.source.

3. Authenticated scan

Need	Config
Login macro	`login_replay.enabled`, `macro_path`
Multi-role	`auth_session.enabled`, `roles`
CAPTCHA skip	`captcha.enabled`, `skip_protected`
Challenge (CF)	`challenge_solver.enabled`

4. Checks to enable

Edit vulnerability_scanner.enabled_checks (not CLI). High-value packs:

Goal	Checks
Core inject	`sql_injection`, `xss`, `ssrf`, `lfi`, `rfi`, `ssti`, `command_injection`
Authz	`idor`, `api_bola_deep`, `jwt_deep`, `oauth_testing`
API	`api_security`, `graphql_deep`, `openapi` seed
Cloud	`ssrf_cloud`, `cloud_misconfig`
Client/WS	`cors_csp`, `websocket_deep`, `sse_injection`, `supply_chain_js`
Deep inject	`host_header_deep`, `crlf_header_inject_deep`, `hpp_pollution`, `ssti_engines`
Mobile	`mobile.enabled` + `frida_mobile`, `android_static`, `ios_plist`, `mobile_ssl_pinning`, `mobile_ai_chain`

Payloads: payload_generation.use_ai, cve_database, OAST via scanner.oast_callback_url.

5. Post-process

Order in engine: dedupe → FP replay → evidence → RAG → compliance → AI triage → bounty → report.

Feature	Config
Dedupe	`reporting.dedupe`
CVE enrich	`experimental.enable_cve_matching` (+ optional `cve_live_lookup`)
Triage	`ai_triage.enabled`
Bounty MD	`bug_bounty.enabled`
Templates	`templates.enabled`

6. Manual verify + report

Reproduce High/Critical with minimal request.
Report formats: reporting.formats / --formats html,json,sarif,junit,csv,xlsx.
Diff: python deep_eye.py --diff baseline.json current.json.

Code map

Task	Location
CLI	`deep_eye.py`
Lifecycle	`core/scanner_engine.py`
Checks	`core/vulnerability_scanner.py` + `modules/*`
Multi-surface inject	`core/injection_surfaces.py`
AI	`ai_providers/`, tool calling on OpenAI/Claude
Config truth	`config/config.example.yaml`

Rules

No unauthorized targets.
No destructive DoS unless RoE allows.
Redact secrets/PII in reports.

Output

## Pentest (Deep Eye)
- Target / scope:
- Config highlights:
- Commands run:
- Severity counts:
- Top findings (type → url → impact):
- Retest command:

---name: pentestdescription: Authorized penetration testing with Deep Eye (this repo). Use for pentest, penetration test, vulnerability assessment, web/API/mobile scan, OWASP testing, /pentest. Requires written authorization. Never scan unauthorized targets.---# Deep Eye — Pentest SkillAuthorized offensive testing only. Work inside this repository’s tool surface.## Preconditions1. Written RoE / scope (hosts, paths, time, credentials).2. Config present: `config/config.yaml` (from example or wizard).3. No secrets committed; use local `config/config.yaml` only.## Quick start```bashpip install -r requirements.txtcp config/config.example.yaml config/config.yaml # or:python deep_eye.py --setuppython deep_eye.py -u https://TARGET -v --formats html,jsonpython deep_eye.py -u https://TARGET --scope-nl "only /api/* no /logout"python deep_eye.py -u https://TARGET --retest-new reports/baseline.json```## Workflow### 1. Scope- CLI: `--scope-nl "..."` → `utils/nl_scope.py` → `scope` config.- YAML: `scope.enabled`, `allowed_hosts`, `excluded_paths`.### 2. Recon- `scanner.enable_recon: true`- Modules: `modules/reconnaissance/`, optional OSINT (`osint` config).- OpenAPI seed: `openapi.enabled` + `openapi.source`.### 3. Authenticated scan| Need | Config ||------|--------|| Login macro | `login_replay.enabled`, `macro_path` || Multi-role | `auth_session.enabled`, `roles` || CAPTCHA skip | `captcha.enabled`, `skip_protected` || Challenge (CF) | `challenge_solver.enabled` |### 4. Checks to enableEdit `vulnerability_scanner.enabled_checks` (not CLI). High-value packs:| Goal | Checks ||------|--------|| Core inject | `sql_injection`, `xss`, `ssrf`, `lfi`, `rfi`, `ssti`, `command_injection` || Authz | `idor`, `api_bola_deep`, `jwt_deep`, `oauth_testing` || API | `api_security`, `graphql_deep`, `openapi` seed || Cloud | `ssrf_cloud`, `cloud_misconfig` || Client/WS | `cors_csp`, `websocket_deep`, `sse_injection`, `supply_chain_js` || Deep inject | `host_header_deep`, `crlf_header_inject_deep`, `hpp_pollution`, `ssti_engines` || Mobile | `mobile.enabled` + `frida_mobile`, `android_static`, `ios_plist`, `mobile_ssl_pinning`, `mobile_ai_chain` |Payloads: `payload_generation.use_ai`, `cve_database`, OAST via `scanner.oast_callback_url`.### 5. Post-processOrder in engine: dedupe → FP replay → evidence → RAG → compliance → AI triage → bounty → report.| Feature | Config ||---------|--------|| Dedupe | `reporting.dedupe` || CVE enrich | `experimental.enable_cve_matching` (+ optional `cve_live_lookup`) || Triage | `ai_triage.enabled` || Bounty MD | `bug_bounty.enabled` || Templates | `templates.enabled` |### 6. Manual verify + report- Reproduce High/Critical with minimal request.- Report formats: `reporting.formats` / `--formats html,json,sarif,junit,csv,xlsx`.- Diff: `python deep_eye.py --diff baseline.json current.json`.## Code map| Task | Location ||------|----------|| CLI | `deep_eye.py` || Lifecycle | `core/scanner_engine.py` || Checks | `core/vulnerability_scanner.py` + `modules/*` || Multi-surface inject | `core/injection_surfaces.py` || AI | `ai_providers/`, tool calling on OpenAI/Claude || Config truth | `config/config.example.yaml` |## Rules- No unauthorized targets.- No destructive DoS unless RoE allows.- Redact secrets/PII in reports.## Output```markdown## Pentest (Deep Eye)- Target / scope:- Config highlights:- Commands run:- Severity counts:- Top findings (type → url → impact):- Retest command:```

Frequently asked questions