Pentest

Skill bg-szy/TOP-SKILLS/skills/superskills/pentest

全球最大的 Claude Code 技能聚合库 · 收录 3900+ 来自 12+ 来源的技能，提供在线搜索与趋势分析看板 / The world's largest Claude Code skill aggregation hub — 3900+ skills from 12+ sources with online search and trend dashboard

Install

npx -y skills add bg-szy/TOP-SKILLS --skill pentest

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
4 stars4 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Security scanning via clearwing — source code vulnerability hunting and network pentesting.

SKILL.md

2.4 KB, 546 tokens by cl100k_base, as published. Nobody here has run it

Pentest — Clearwing Security Scanner

Authorized security testing using clearwing.

Authorization Check

Before any scanning, confirm authorization with the user. Ask:

Is this target owned by you or your organization?
Do you have written authorization to test it?
What is the scope (source code only, network, or both)?

If authorization is unclear, STOP and do not proceed.

Prerequisites

Check if clearwing is installed:

command -v clearwing && clearwing --version

If not installed:

uv tool install clearwing
clearwing setup  # Interactive LLM provider configuration

Requires: Python 3.10+, uv, Rust toolchain (for native bridge).

Mode 1: Source Code Analysis

Hunt vulnerabilities in source code using the 11-stage pipeline:

# Standard depth — recommended starting point
clearwing sourcehunt <path-to-repo> --depth standard

# Quick scan — faster, less thorough
clearwing sourcehunt <path-to-repo> --depth quick

# Deep scan — comprehensive, takes longer
clearwing sourcehunt <path-to-repo> --depth deep

The pipeline: preprocess → rank files → generate fuzzing harnesses → tiered hunt (6 specialists) → adversarial verification → patch oracle → variant loop → exploit triage → auto-patch → report.

Evidence levels (ascending confidence):

suspicion — pattern match, needs investigation
static_corroboration — confirmed by static analysis
crash_reproduced — fuzzer triggered a crash
root_cause_explained — mechanism understood
exploit_demonstrated — exploitability confirmed
patch_validated — fix verified

Mode 2: Network Scanning

Scan a live target for service vulnerabilities:

# Single host
clearwing scan <target-ip-or-hostname>

# CIDR block (concurrent)
clearwing parallel <CIDR> --max-concurrent 5

Output

Results are stored in SQLite and exported as:

SARIF — for GitHub Code Scanning integration
Markdown — human-readable report
JSON — machine-readable findings

Interactive Mode

For guided exploration:

clearwing interactive
clearwing interactive --resume <session_id>

CI Integration

clearwing ci --sarif-output results.sarif

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.