Penetration testing

Skill BagelHole/DevOps-Security-Agent-Skills/security/operations/penetration-testing

Agent-ready DevOps, security, infrastructure, and compliance knowledge base with 80+ skills across Kubernetes, Terraform, AWS/Azure/GCP, AI platform operations, container hardening, SOC2/ISO27001, and incident response—plus ready-to-run scripts, templates, and playbooks for SRE, platform, and security teams.

Install

npx -y skills add BagelHole/DevOps-Security-Agent-Skills --skill penetration-testing

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Perform basic penetration testing and security assessments. Use reconnaissance, vulnerability discovery, and exploitation techniques. Use when validating security controls or assessing system security.

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.1 KB, 451 tokens by cl100k_base, as published. Nobody here has run it

Penetration Testing

Validate security controls through authorized testing.

Phases

pentest_phases:
  1_reconnaissance:
    - Passive information gathering
    - DNS enumeration
    - Network mapping
    
  2_scanning:
    - Port scanning
    - Service identification
    - Vulnerability scanning
    
  3_exploitation:
    - Attempt exploitation
    - Verify vulnerabilities
    - Document findings
    
  4_post_exploitation:
    - Privilege escalation
    - Lateral movement
    - Data access
    
  5_reporting:
    - Document findings
    - Risk assessment
    - Remediation recommendations

Reconnaissance

# DNS enumeration
dig example.com ANY
host -l example.com

# Subdomain discovery
subfinder -d example.com

# WHOIS
whois example.com

Scanning

# Port scan
nmap -sV -sC -p- target.com

# Web scanning
nikto -h https://target.com
dirb https://target.com

# Vulnerability scan
nmap --script vuln target.com

Web Testing

# SQL injection test
sqlmap -u "http://target.com/page?id=1"

# XSS testing
# Use Burp Suite or manual testing

# Directory traversal
curl "http://target.com/file?path=../../../etc/passwd"

Rules of Engagement

scope:
  in_scope:
    - target.com
    - api.target.com
  out_of_scope:
    - production-db.target.com
    - third-party services
  
  testing_window: "Weekdays 2-6 AM UTC"
  emergency_contact: "[email protected]"

Best Practices

Always get written authorization
Define clear scope
Document everything
Report critical findings immediately
Safe exploitation techniques only

Related Skills

dast-scanning - Automated testing
vulnerability-scanning - Vulnerability discovery

Gives 0 of the 12 instructions most test skills give in 451 tokens

Counted across 964 of the 1,571 authors here whose files we hold, read 2026-08-06

close the browser when donein 55 of 964, across 12 files
wait for network idle statein 51 of 964, across 6 files
launch chromium in headless modein 49 of 964, across 6 files
use descriptive selectors for elementsin 49 of 964, across 6 files
run provided scripts with help flag firstin 49 of 964, across 6 files
add appropriate explicit waitsin 48 of 964, across 5 files
use bundled scripts as black boxesin 46 of 964, across 3 files
do not read script source codein 46 of 964, across 3 files
use sync playwright for scriptsin 46 of 964, across 3 files
inspect dom before executing actionsin 46 of 964, across 3 files
run the full test suitein 36 of 964, across 34 files
write the failing test firstin 25 of 964, across 18 files

Said here and by no other author read

get written authorization
define clear scope
perform passive information gathering
enumerate dns
scan ports
scan for vulnerabilities

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.