bagelhole/penetration-testing
security/operations/penetration-testing/SKILL.md
Perform basic penetration testing and security assessments. Use reconnaissance, vulnerability discovery, and exploitation techniques. Use when validating security controls or assessing system security.
$ install --global
skillsauthnpx skillsauth add bagelhole/devops-security-agent-skills penetration-testingInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 3, 2026, 5:06 PM5.0s1 file scanned
SKILL.md
- name:
- penetration-testing
- description:
- Perform basic penetration testing and security assessments. Use reconnaissance, vulnerability discovery, and exploitation techniques. Use when validating security controls or assessing system security.
- license:
- MIT
- author:
- devops-skills
- version:
- 1.0
Penetration Testing
Validate security controls through authorized testing.
Phases
pentest_phases:
1_reconnaissance:
- Passive information gathering
- DNS enumeration
- Network mapping
2_scanning:
- Port scanning
- Service identification
- Vulnerability scanning
3_exploitation:
- Attempt exploitation
- Verify vulnerabilities
- Document findings
4_post_exploitation:
- Privilege escalation
- Lateral movement
- Data access
5_reporting:
- Document findings
- Risk assessment
- Remediation recommendations
Reconnaissance
# DNS enumeration
dig example.com ANY
host -l example.com
# Subdomain discovery
subfinder -d example.com
# WHOIS
whois example.com
Scanning
# Port scan
nmap -sV -sC -p- target.com
# Web scanning
nikto -h https://target.com
dirb https://target.com
# Vulnerability scan
nmap --script vuln target.com
Web Testing
# SQL injection test
sqlmap -u "http://target.com/page?id=1"
# XSS testing
# Use Burp Suite or manual testing
# Directory traversal
curl "http://target.com/file?path=../../../etc/passwd"
Rules of Engagement
scope:
in_scope:
- target.com
- api.target.com
out_of_scope:
- production-db.target.com
- third-party services
testing_window: "Weekdays 2-6 AM UTC"
emergency_contact: "[email protected]"
Best Practices
- Always get written authorization
- Define clear scope
- Document everything
- Report critical findings immediately
- Safe exploitation techniques only
Related Skills
- dast-scanning - Automated testing
- vulnerability-scanning - Vulnerability discovery
Related Skills
bagelhole/sre-dashboards
development
VerifiedTrustedCommunity
Design and operationalize SRE dashboards that surface reliability, latency, error, saturation, and capacity signals across services. Use when building observability views for SLOs, incident response, and executive reliability reporting.
28SKILL.mdUpdated May 23, 2026
bagelhole/openclaw-security-hardening
testing
VerifiedTrustedCommunity
Harden OpenClaw self-hosted environments with baseline host controls, auth tightening, secret handling, network segmentation, and safe update/rollback workflows. Use when deploying OpenClaw in home labs, startups, or production-like local AI infrastructure.
28SKILL.mdUpdated Apr 3, 2026
bagelhole/vector-database-ops
devops
VerifiedTrustedCommunity
Deploy, manage, and optimize vector databases for AI applications. Covers Qdrant, Weaviate, pgvector, and Pinecone — collection management, indexing strategies, backup, and performance tuning for production RAG and semantic search workloads.
28SKILL.mdUpdated Apr 3, 2026
bagelhole/model-serving-kubernetes
testing
VerifiedTrustedCommunity
Deploy ML models on Kubernetes with KServe (formerly KFServing) and NVIDIA Triton Inference Server. Includes canary deployments, autoscaling, model versioning, A/B testing, and GPU resource management for production model serving.
28SKILL.mdUpdated Apr 3, 2026