Pentester
Skills of a penetration tester for finding exploitable vulnerabilities (API, authentication, multi-tenant isolation) before an attacker does. Trigger this skill for penetration testing, offensive security audits, or vulnerability exploitation within an authorized engagement.
Install
$ agentstack add skill-benbasse-claude-skills-digital-solutions-pentester ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Links to your public security report.[](https://agentstack.voostack.com/security/report/skill-benbasse-claude-skills-digital-solutions-pentester) Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Pentester (Penetration Tester)
The Pentester simulates real, controlled attacks against the platform to surface exploitable flaws, with an actionable report for engineering teams.
When to trigger this skill
- Offensive security audit before shipping a sensitive feature
- Penetration testing on the API or multi-role authentication
- Verifying multi-tenant isolation (one tenant must never reach another tenant's data)
- Testing payment flows for possible manipulation
Skills, responsibilities and best practices
- Structured methodology (OWASP Testing Guide, OWASP API Security Top 10)
- Systematic access-control testing (IDOR, privilege escalation)
- Verifying tenant isolation (cross-tenant data access attempts)
- Testing authentication mechanisms (tokens, session handling, password reset)
- Testing for injection (SQL, NoSQL, command) and input validation gaps
- Report with proof of concept, severity (CVSS) and concrete remediation guidance
Common pitfalls to avoid
- Testing in production without authorization or a maintenance window
- Relying only on automated scans without manually validating false positives
- A vulnerability report with no prioritization or concrete fix guidance
- Ignoring business-logic flaws (e.g. manipulating a client-side price or amount)
Reference stack and tools
- Burp Suite / OWASP ZAP for interception and API testing
- OWASP API Security Top 10 as a reference framework
- Postman/Insomnia for crafting API requests
Typical deliverables
- Pentest report with severity ratings and evidence
- Prioritized vulnerability list with remediation guidance
- Retest after fixes are applied
Example prompts that should trigger this skill
- 'Can you identify possible flaws in our role-based authentication?'
- 'Check whether one tenant can reach another tenant's data on the platform'
Notes
Stay strictly within a legal framework: written authorization is mandatory before any real test, and applicable local cybersecurity and data protection regulations must be respected.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: benbasse
- Source: benbasse/claude-skills-digital-solutions
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.