pentestUse when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews.
Install via ClawdBot CLI:
clawdbot install veeramanikandanr48/pentestGrade Good — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Accesses sensitive credential files or environment variables
/etc/passwdHardcoded API key or token pattern found in skill definition
AKIAIOSFODNN...Potentially destructive shell commands in tool definitions
eval(Accesses system directories or attempts privilege escalation
/var/log/Generated Mar 1, 2026
Conduct a security review for a fintech mobile banking app, focusing on SAST scans for vulnerabilities like SQL injection and XSS, manual code review of authentication and authorization flows, and compliance with PCI DSS standards. This ensures secure handling of sensitive financial data and prevents breaches.
Perform penetration testing on an e-commerce website to identify vulnerabilities in payment processing, user account management, and infrastructure security. Use automated tools like Burp Suite and manual testing to validate findings, ensuring protection against attacks like credential stuffing and data theft.
Analyze the security of a healthcare provider's cloud infrastructure on AWS, focusing on DevSecOps practices, secrets scanning for HIPAA compliance, and infrastructure hardening using CIS benchmarks. This helps safeguard patient data and meet regulatory requirements like HIPAA and SOC2.
Review code for a SaaS startup's web application, running SAST tools like Semgrep and dependency audits with npm audit to catch vulnerabilities early in development. Include manual review of input handling and crypto functions to prevent common exploits like injection attacks.
Automate security audits for a government agency's internal systems, using the skill to conduct SAST scans, infrastructure security reviews with Checkov, and compliance checks against ISO27001 standards. This streamlines reporting and ensures adherence to strict security policies.
Offer specialized security consulting to businesses, providing on-demand audits, penetration testing, and compliance reviews. Revenue is generated through project-based fees or retainer contracts, targeting industries like finance and healthcare with high security needs.
Integrate the skill into a DevSecOps platform as a service, automating security scans in CI/CD pipelines for continuous monitoring. Revenue comes from subscription fees based on usage or number of scans, appealing to tech companies seeking scalable security solutions.
Provide compliance automation services using the skill to conduct regular audits and generate reports for standards like SOC2 and ISO27001. Revenue is earned through annual subscriptions or per-audit charges, serving regulated industries that require ongoing compliance validation.
💬 Integration Tip
Integrate this skill into CI/CD pipelines using allowed tools like Bash for automated scans, and ensure proper authorization and scope definition before active testing to avoid disruptions.
Scored Apr 16, 2026
Calls external URL not in known-safe list
https://github.com/gitleaks/gitleaksUses known external API (expected, informational)
googleapis.comAI Analysis
The skill definition contains high-risk patterns including a hardcoded AWS credential placeholder ('AKIAIOSFODNN...') and references to accessing sensitive system files (/etc/passwd, /var/log/). While the skill's purpose is legitimate security auditing, these patterns, if executed, could lead to credential harvesting or unauthorized system access if not properly sandboxed.
Audited Apr 16, 2026 · audit v1.0
Scan networks to discover devices, gather MAC addresses, vendors, and hostnames. Includes safety checks to prevent accidental scanning of public networks.
Perform network reconnaissance and port scanning with Nmap to find open ports, detect services, identify vulnerabilities, and enumerate targets accurately.
Security engineering toolkit for threat modeling, vulnerability analysis, secure architecture, and penetration testing. Includes STRIDE analysis, OWASP guida...
Plan and orchestrate authorized Nmap host discovery, port and service enumeration, NSE profiling, and reporting artifacts for in-scope targets.
Automatically generate professional CTF writeups from solving sessions with flag detection, challenge categorization, and proper markdown formatting
Set up authorized C2 simulation workflows and measure defensive detection outcomes.