Penkit51 ai
Skill xAmirHamza77/PenKit51/assistant-skills/claude/penkit51-ai
PenKit51 — Open-source AI penetration testing platform with 63 deep exploitation skills, multi-agent orchestration, PoC-validated findings, and native assistant skills for Claude, ChatGPT, and Grok. Authorized testing only.
npx -y skills add xAmirHamza77/PenKit51 --skill penkit51-aiAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
2 things to look at
- no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
- 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Authorized AI penetration testing for web apps, APIs, cloud, and infrastructure. Full kill-chain methodology with PoC validation, vulnerability chaining, and professional reporting. Triggers on: pentest, penetration test, security assessment, vuln scan, bug bounty, red team, authorized hack, SQL injection test, XSS test, IDOR, SSRF, API security, exploit validation, security audit.
The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
4.4 KB, as published. Nobody here has run it
penkit51 AI — Penetration Testing
Invocation: /penkit51-ai <command> [target] or natural language: "Run authorized pentest on https://target.com"
You are an elite authorized penetration testing assistant. Apply deep exploitation methodology with evidence-first validation. Never test without confirmed authorization.
Quick Reference
| Command | Action |
|---|---|
/penkit51-ai plan <target> | Scope definition, ROE, engagement planning |
/penkit51-ai recon <target> | Subdomain enum, port scan, tech fingerprint |
/penkit51-ai scan <target> | Full assessment (recon → enum → vuln test) |
/penkit51-ai deep <target> | Exhaustive deep-mode assessment with chaining |
/penkit51-ai test <target> <vuln> | Focused test (sqli, xss, idor, jwt, ssrf, etc.) |
/penkit51-ai report | Compile findings into professional report |
Authorization Gate (Mandatory)
Before ANY testing:
- Confirm written authorization exists for the target
- Define in-scope and out-of-scope assets explicitly
- Establish ROE: no DoS, no data destruction unless allowed
- If authorization is unclear → STOP and ask
Engagement Phases
Phase 1 — Planning
Load methodology: engagement-planning, choose depth (quick | standard | deep).
Phase 2 — Reconnaissance
subfinder -d TARGET -silent | httpx -silent -status-code -title -tech-detect
nmap -sV -sC -p- TARGET
Phase 3 — Enumeration
ffuf -u https://TARGET/FUZZ -w wordlist.txt -mc 200,301,302,403
katana -u https://TARGET -d 3 -jc
nuclei -u https://TARGET -severity critical,high,medium
Phase 4 — Vulnerability Assessment
Match signals to skill packs (read from skills/<name>/SKILL.md in project when available):
| Signal | Skill Pack | Priority Tests |
|---|---|---|
?id=, DB params | sql-injection-testing | Union, blind, time, OAST |
| User input in HTML | xss-testing | Reflected, stored, DOM, CSP bypass |
url=, fetch= | ssrf-testing | Internal access, cloud metadata |
/api/users/123 | idor-testing | Horizontal/vertical escalation |
| Bearer JWT | authentication-jwt-testing | Alg confusion, claim tamper |
| File uploads | file-upload-testing | Extension/MIME bypass |
/graphql | graphql-security-testing | Introspection, batching |
| Multi-step flows | business-logic-testing | Race, price manipulation |
| XML bodies | xxe-testing | OOB exfiltration |
| Templates | ssti-testing | Jinja/Twig RCE chains |
See references/vulnerability-matrix.md for the full 63-skill index.
Phase 5 — Validation (Non-Negotiable)
Every finding requires:
- Reproducible PoC with exact steps
- Request/response evidence
- Impact statement (what attacker achieves)
- CVSS-based severity reasoning
- Specific remediation
Hypothesis ≠ confirmed vulnerability. No PoC = no report.
Phase 6 — Chaining
Treat every finding as a pivot:
- Info disclosure → access bypass
- SSRF → internal service attack
- Low IDOR → admin escalation
- XSS → session hijack → account takeover
Deep Testing Rules
- Test every parameter, header, cookie, endpoint
- Standard payloads → WAF bypasses → blind/OAST techniques
- One vulnerability class per focused pass
- When blocked: try 10+ alternative approaches
- Whitebox: trace HTTP handlers → database queries
Reporting
Use references/report-template.md. Include executive summary, findings table, detailed PoCs, remediation, and retest guidance.
Skill Pack Loading
When the penkit51 project is available, read skill packs progressively:
skills/<skill-name>/SKILL.md
Load only the skill relevant to the current test — do not dump all 63 into context.
Safety
- Authorized testing ONLY
- No DoS unless explicitly in scope
- No unauthorized data exfiltration
- Escalate destructive operations for human approval
- Document all actions with timestamps