AI Pentesting
Use AI agents to autonomously conduct penetration tests on web applications. Combine LLM reasoning with security tools (nmap, subfinder, nuclei, sqlmap, browser automation) to find and prove vulnerabilities with minimal human intervention.
Overview
The AI Pentesting skill, hosted within the TerminalSkills/skills repository, enables autonomous security assessments of web applications. By integrating large language model reasoning with industry-standard security utilities, this skill allows agents like Claude, Gemini, and Codex to perform complex vulnerability discovery. The system utilizes tools such as nmap for network scanning, subfinder for subdomain discovery, and nuclei for template-based scanning. It further incorporates sqlmap and browser automation to identify and validate security flaws with minimal human oversight. This implementation, part of a project with 71 stars on GitHub, provides a structured approach for AI agents to conduct end-to-end security reviews, leveraging Python-based automation to bridge the gap between LLM intelligence and practical security tooling.
Use Cases
Install Notes
# Review source first
open https://github.com/TerminalSkills/skills/blob/main/skills/ai-pentesting/SKILL.mdCopy or clone the skill folder into your agent skills directory after reviewing its instructions and scripts.
Security Notes
This skill executes active security scanning tools and browser automation, which may trigger defensive alerts or impact target system stability. Users should ensure they have explicit authorization before deploying these autonomous agents against any infrastructure, as the LLM-driven reasoning process may perform unpredictable sequences of security tests.
Related Skills
Security And Hardening
addyosmani/agent-skills
Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when checking a login flow is safe against the OWASP Top Ten. Use when building any feature that accepts untrusted data, manages user sess...
Genotoxic
trailofbits/skills
Graph-informed mutation testing triage. Parses codebases with Trailmark, runs mutation testing and necessist, then uses survived mutants, unnecessary test statements, and call graph data to identify false positives, missing test coverage, and fuzzing targets. Use when triaging survived mutants, analyzing mutation te...
Variant Analysis
trailofbits/skills
Hunts for the other instances of a bug already found — the variants of one root cause across a codebase. Use immediately after a vulnerability, logic bug, or bad pattern turns up in a specific file and the question becomes where else it occurs, including the bare conversational form ("are there others like this?", "...
Ossfuzz
trailofbits/skills
Enrolls a project in OSS-Fuzz, Google's free continuous fuzzing service for open source, and drives it locally. Covers project.yaml, Dockerfile and build.sh setup, the helper scripts, reproducing OSS-Fuzz crash reports, and the acceptance criteria. Use when setting up continuous fuzzing for an open-source project, r...
Fuzzing Obstacles
trailofbits/skills
Patches past the barriers that stop a fuzzer making progress — checksum and hash verification, magic-value validation, time-based seeds, and other non-deterministic global state. Covers locating the blocking check, neutering it behind a fuzzing build flag, and avoiding the false positives a patch can introduce. Use...
Supply Chain Risk Auditor
trailofbits/skills
Audits a project's dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned or archived upstreams, npm publisher concentration, and install-time script execution. Use when asked to audit dependencies, assess supply-chain or third-party package risk,...