PentestingEverything Skill
Wires an open-source pentesting knowledge base spanning 23 security domains into your coding agent, so authorized assessments, checklists, and reports are grounded in citable sources.
SKILL.md mandates lawful use, user confirmation before active testing, written scope gates for high-impact actions, placeholder substitution for real targets, and source citation — strong safety design for a docs skill; deducted for: no isolation/rollback mechanisms, fallback reliance on external sites (GitHub, pentesting.m14r41.in), and data-flow transparency partly resting on unaudited repository content.
Docs are self-consistent; path quirks (typos, double spaces, readme casing) are explicitly documented in REPOSITORY_MAP, and failure paths (remote fallback when no local clone) are addressed; deducted for: static review only, no test suite or executed verification, referenced files not independently checked line-by-line, and drift risk in a large repository.
Trigger scenarios (planning engagements, building checklists, looking up vulnerability classes, drafting findings) are clear, non-fit boundaries are declared (no authorization granted, no auto-exploitation), and a routing table aids invocation; deducted for: core function depends on GitHub and a self-hosted docs site whose mainland-China reachability is unverified and undisclosed, and no Chinese-language support is stated.
Good progressive disclosure (SKILL.md → REPOSITORY_MAP → OUTPUT_TEMPLATES → category READMEs), clear MIT license, README shows active maintenance with a changelog commit (v2.1.0); deducted for: SKILL.md frontmatter lacks a version field, versioning is not bound to the skill directory, publisher identity unverified, and maintenance rests on a single author.
Output templates (assumptions, plan, checklist, command sketch, evidence log, finding, summary) are concrete and fillable, with a CVSS vector example and false-positive screening rules — real marginal value over manual assembly; deducted for: static review cannot verify actual output quality, templates require user completion, and knowledge-base accuracy is unexecuted.
Claims are auditable via repo-relative paths and public URLs, REPOSITORY_MAP proactively discloses naming quirks, and fact/inference separation is decent; deducted for: no test or third-party execution evidence, command/methodology accuracy not cross-verified, and static coverage limited to skill files plus partial repository context — cannot exceed 5.
- Static review only; nothing was executed — scores are conservative estimates.
- Core function depends on GitHub and an overseas self-hosted site (pentesting.m14r41.in); mainland-China reachability is unverified — prefer a local clone.
- Safety gates rely on user cooperation and model adherence, not technical enforcement; independently confirm written authorization and scope before use.
- Repository commands and payloads are historical notes that may be outdated or risky; manually review before running anything.
- Publisher identity is unverified and the skill file lacks a version field; re-review diffs after updates.
What does this skill do, and when should you use it?
PentestingEverything is an MIT-licensed, open-source penetration-testing knowledge base maintained by m14r41, covering 23 domains including web, API, mobile, network, cloud, Active Directory, and OSINT, with 108 documentation pages, 104 reference PDFs, and 212+ topics. This Agent Skill lets coding agents such as Cursor and Claude Code ground their answers in the repository's Markdown files instead of memory. The skill enforces strict guardrails: authorized testing only, explicit confirmation gates for high-impact actions, and rate-limit awareness for automated runs. Companion sites pentesting.m14r41.in and checklist.m14r41.in provide searchable online access and a tick-as-you-go checklist.
The skill reads Markdown files organized by domain (Web Application Pentesting, API Pentesting, Active Directory Pentesting, and so on), routes a user request to the narrowest matching topic folder, and extracts methodology, test cases, and commands with real targets replaced by placeholders. It produces engagement assumptions, prioritized checklists, safe command sketches, evidence plans, and report-ready finding drafts; before drafting any finding it runs a false-positive check (WAF echo, timing noise, already-patched behavior) and labels unverified signals as hypotheses. Installation uses npx skills add; it prefers a local clone and falls back to the GitHub tree or the live docs site when unavailable.
- A pentester starting an authorized VAPT engagement asks the agent to generate a prioritized checklist from the repository for their target.
- A bug bounty hunter investigating a specific vulnerability class (SQL injection, SSRF, IDOR) pulls the repository's tested methodology and commands.
- An AppSec team assessing mobile (Android/iOS) or API security looks up hands-on usage of MobSF, Frida, Drozer, and similar tools.
- A red teamer working an Active Directory or Kerberos scenario needs structured guidance on BloodHound, Impacket, and CrackMapExec workflows.
- A security consultant drafting report sections after testing asks the agent to produce evidence-backed findings from repository sources.
What are this skill's strengths and limitations?
- Large, structured knowledge base: 23 domains, 108 doc pages, 104 PDFs, 212+ topics, plus a searchable live site.
- Concrete safety guardrails: authorization confirmation, high-impact action gates, false-positive screening, and request pacing are executable rules, not slogans.
- Every answer must cite exact repository paths and URLs, making outputs verifiable and traceable.
- MIT licensed, actively updated (v2.0.0 added a website, PDF library, learning paths), with new LLM and MCP security modules.
- The repository embeds third-party material such as PDFs; the skill requires summarizing and linking rather than pasting, and attribution of some raw content warrants care.
- The skill provides process and document retrieval only — it runs no scanners or exploit tools; tools like Burp and Nmap must be installed separately.
- Cloud and enterprise infrastructure pentesting modules are still in an exploration/collaboration stage, so coverage depth is uneven.
- There is no evidence of a public test suite; content quality depends on community contributions and some topics may be outdated.
How do you install this skill?
Use the documented Agent Skills commands. Project-local: npx skills add m14r41/PentestingEverything --skill pentesting-everything. Global (across projects): append --global. You can also target a specific agent with flags such as --agent cursor or --agent claude-code. Source lives in .agents/skills/pentesting-everything/. Not documented: per-platform configuration differences; use --list to inspect without installing.
How do you use this skill?
After installation, describe an authorized assessment need in your agent, for example: "Generate a test checklist for an authorized web app pentest" or "Find the SSRF testing methodology in the repo." The skill confirms authorization and scope first, locates and reads repository files, then produces plans, checklists, and evidence-based report drafts. Any active attack step requires the user to confirm targets and constraints first.