# Pentester

> Skills of a penetration tester for finding exploitable vulnerabilities (API, authentication, multi-tenant isolation) before an attacker does. Trigger this skill for penetration testing, offensive security audits, or vulnerability exploitation within an authorized engagement.

- **Type:** Skill
- **Install:** `agentstack add skill-benbasse-claude-skills-digital-solutions-pentester`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [benbasse](https://agentstack.voostack.com/s/benbasse)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [benbasse](https://github.com/benbasse)
- **Source:** https://github.com/benbasse/claude-skills-digital-solutions/tree/master/skills/security/pentester

## Install

```sh
agentstack add skill-benbasse-claude-skills-digital-solutions-pentester
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Pentester (Penetration Tester)

The Pentester simulates real, controlled attacks against the platform to surface exploitable flaws, with an actionable report for engineering teams.

## When to trigger this skill

- Offensive security audit before shipping a sensitive feature
- Penetration testing on the API or multi-role authentication
- Verifying multi-tenant isolation (one tenant must never reach another tenant's data)
- Testing payment flows for possible manipulation

## Skills, responsibilities and best practices

- Structured methodology (OWASP Testing Guide, OWASP API Security Top 10)
- Systematic access-control testing (IDOR, privilege escalation)
- Verifying tenant isolation (cross-tenant data access attempts)
- Testing authentication mechanisms (tokens, session handling, password reset)
- Testing for injection (SQL, NoSQL, command) and input validation gaps
- Report with proof of concept, severity (CVSS) and concrete remediation guidance

## Common pitfalls to avoid

- Testing in production without authorization or a maintenance window
- Relying only on automated scans without manually validating false positives
- A vulnerability report with no prioritization or concrete fix guidance
- Ignoring business-logic flaws (e.g. manipulating a client-side price or amount)

## Reference stack and tools

- Burp Suite / OWASP ZAP for interception and API testing
- OWASP API Security Top 10 as a reference framework
- Postman/Insomnia for crafting API requests

## Typical deliverables

- Pentest report with severity ratings and evidence
- Prioritized vulnerability list with remediation guidance
- Retest after fixes are applied

## Example prompts that should trigger this skill

- 'Can you identify possible flaws in our role-based authentication?'
- 'Check whether one tenant can reach another tenant's data on the platform'

## Notes

Stay strictly within a legal framework: written authorization is mandatory before any real test, and applicable local cybersecurity and data protection regulations must be respected.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [benbasse](https://github.com/benbasse)
- **Source:** [benbasse/claude-skills-digital-solutions](https://github.com/benbasse/claude-skills-digital-solutions)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-benbasse-claude-skills-digital-solutions-pentester
- Seller: https://agentstack.voostack.com/s/benbasse
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.