📦
content-creator
88Create Brand-Consistent Marketing Content
Marketing teams need content that stays consistent across channels. This skill helps plan, write, analyze, and optimize content for brand voice and SEO.
Writing & Content View
Skills pentest-checklist
📦
pentest-checklist
v1.1 Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access
Plan Authorized Penetration Tests
Security teams need clear scope, authorization, and follow-up before testing. This skill provides structured checklists for authorized penetration test planning and remediation.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "pentest-checklist" from https://skillstore.io/skills/sickn33-pentest-checklist.md and its manifest at https://skillstore.io/api/skills/sickn33-pentest-checklist/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "pentest-checklist". Plan a five-day web application pentest for a customer portal.
Expected outcome:
- A concise scope with objectives, assets, exclusions, and test window.
- A preparation checklist for accounts, backups, monitoring, and notifications.
- A reporting and remediation plan with owners and retest timing.
Using "pentest-checklist". Help my team prepare monitoring for an approved internal test.
Expected outcome:
The skill produces a monitoring checklist covering authentication logs, application errors, network events, alert routing, and operations contacts.
Using "pentest-checklist". Review our post-test cleanup process.
Expected outcome:
- Remove test accounts and artifacts.
- Restore temporary configuration changes.
- Verify cleanup with logs and owner sign-off.
Security Audit
High Riskv5 • 7/9/2026 Open versioned report
Most static backtick findings are Markdown fence false positives, not runtime execution. Real risks remain because the skill documents active scanning, privileged service commands, packet capture, and social engineering or red team planning. These are legitimate for authorized engagements but need stronger guardrails for marketplace use.
1
Files scanned
335
Lines analyzed
4
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Network scanning tools
nmap -sV --script vuln TARGET
The nmap command performs active service enumeration and vulnerability probing against a target. The intended context is authorized testing, but the command is dual-use.
Medium
Social Engineering and Red Team Planning Scope
The skill lists social engineering and red team testing as scope options. It does not provide attack scripts, but it can help plan human-targeted or broad adversary simulations.
The listed test types explicitly include social engineering and red team work. The content is planning-level, so risk depends on authorization and execution context.
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
sudo privilege escalation
sudo systemctl restart rsyslog
The example instructs users to run sudo systemctl restart rsyslog. This changes host services with elevated privileges and needs explicit administrator approval.
High
sudo privilege escalation
sudo systemctl restart auditd
The example instructs users to run sudo systemctl restart auditd. Restarting audit services can affect security logging and requires privileged review.
Medium
Temp directory access
tcpdump -i eth0 -w /tmp/pentest_capture.pcap &
The tcpdump example writes packet capture data to /tmp. Packet captures can contain sensitive traffic and should use controlled storage and cleanup.
Low
Hardcoded URL
nikto -h http://TARGET
The nikto example performs active web vulnerability scanning against a target placeholder. It is legitimate in authorized tests but still a dual-use network action.
Risk Factors
⚙️ External commands (15)
🌐 Network access (4)
📁 Filesystem access (2)
Detected Patterns
Network scanning tools
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-pentest-checklist/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-pentest-checklist?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-pentest-checklist?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-pentest-checklist/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-pentest-checklist.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). pentest-checklist security audit report (audit version 5) [Author version 1.1]. Skillstore. https://skillstore.io/skills/sickn33-pentest-checklist/audits/5BibTeX citation
@techreport{sickn33-sickn33-pentest-checklist-2026,
author = {sickn33},
title = {pentest-checklist security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-pentest-checklist/audits/5},
note = {Author version 1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "pentest-checklist security audit report (audit version 5)"
version: "1.1"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/sickn33-pentest-checklist/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-pentest-checklist:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
68
Community
83
Spec Compliance
What You Can Build
Prepare a Pentest Scope
Create a clear scope, exclusions, objectives, contacts, and approval steps before hiring testers.
Prepare Monitoring and Logs
Plan logging, alerting, backups, and operations communication before an authorized test window.
Track Remediation Follow-Up
Turn test findings into prioritized remediation tasks, retesting plans, and evidence for auditors.
Try These Prompts
Draft a Basic Pentest Scope
Help me outline an authorized penetration test for a web application. Include objectives, in-scope assets, exclusions, timing, and required approvals.
Prepare Environment Readiness
Create a readiness checklist for an approved internal network pentest. Cover accounts, backups, monitoring, communication, and rollback planning.
Compare Testing Approaches
Compare black box, gray box, and white box approaches for my authorized assessment. Recommend one based on risk, timeline, and available access.
Build an End-to-End Engagement Plan
Build a full authorized pentest plan for a regulated environment. Include scope, provider approvals, monitoring, reporting requirements, cleanup, remediation, and retesting.
Best Practices
- Confirm written authorization and scope before using any scanning or testing guidance.
- Prefer staging or controlled test windows for activities that could disrupt production.
- Record approvals, communication paths, findings, remediation owners, and retest dates.
Avoid
- Running scans against assets that are not clearly in scope.
- Changing production systems without an approved rollback and communication plan.
- Treating checklist output as legal approval or proof of safety.
Frequently Asked Questions
Does this skill perform penetration testing?
No. It helps plan and structure authorized engagements. Testing actions require qualified people and explicit approval.
Can I use it for production systems?
Yes, but only with written authorization, defined limits, monitoring, backups, and a tested rollback plan.
Does it include exploit code?
No. It focuses on planning, monitoring, reporting, cleanup, and remediation.
Why are scanning examples risky?
Active scanners can disrupt systems or violate policy when used outside approved scope.
Who should review the checklist?
Security leaders, system owners, operations teams, legal contacts, and the testing provider should review it.
Does it support Claude, Codex, and Claude Code?
Yes. The content is suitable for Claude, Codex, and Claude Code planning workflows.
Developer Details
Author
sickn33License
MIT
Author version
v1.1
Skillstore revision
r1
Version notice
The author-declared version is not valid SemVer.
Ref
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
Maintenance freshness
7/18/2026
Usage
9 downloads · 81 views
File structure
📄 SKILL.md
More from sickn33
View all📦
prompt-engineering-patterns
85Improve LLM Prompts With Proven Patterns
Inconsistent prompts waste time and make AI outputs hard to trust. This skill guides prompt design with reusable patterns, examples, evaluation steps, and optimization workflows.
Productivity View
📦
senior-architect
81Review Architecture Workflows and Project Paths
Architecture reviews need a consistent starting point and clear project boundaries. This skill provides workspace-scoped tool templates, command examples, and generic design references.
Coding & Development View
📦
senior-fullstack
81Review Fullstack Project Foundations
Fullstack project setup can require many tools and checks. This skill provides basic local wrappers, common commands, and general engineering guidance.
Coding & Development View
📦
prompt-engineer
81Optimize AI Prompts With Prompt Engineer
Writing clear prompts is hard when goals are vague or complex. This skill turns rough requests into structured prompts using proven prompt frameworks.
Productivity View
📦
product-manager-toolkit
80Prioritize Product Work With Research Insights
Product teams need faster ways to rank features, synthesize interviews, and document decisions. This skill provides RICE scoring, interview analysis, and PRD templates for structured planning.
Productivity View
Related Skills
View all📦
security-engineer
38Audit Systems and Applications Securely
by zl2023github
Security reviews require consistent scope, evidence, and remediation guidance across many tools. This skill provides practical workflows for authorized assessment, monitoring, hardening, and reporting.
Security & Compliance View
📦
universal-audit
92Audit Software Releases with Evidence
by glenskii
Release decisions often rely on incomplete evidence and inconsistent standards. This skill applies structured controls, deterministic scoring, and mandatory gates to assess readiness.
Security & Compliance View
📦
senior-security
81Strengthen Application Security Reviews
by alirezarezvani
Security reviews often lack consistent checklists and reusable workflows. This skill provides security review scaffolds, reference guidance, and simple reporting scripts for Claude, Codex, and Claude Code.
Security & Compliance View
📦
senior-secops
81Automate SecOps Checks
by alirezarezvani
Security teams need consistent review workflows across projects. This skill provides SecOps CLI scaffolds and reference guides for repeatable checks.
Security & Compliance View
📦
security-report
78Create Security Assessment Reports
by BytR-Ecosystems
Security findings often become inconsistent reports that are difficult to prioritize. This skill guides structured DOCX reports with risk ratings, evidence, and remediation plans.
Security & Compliance View
📦
security-audit
76Audit Codebases for Security Vulnerabilities
by cloudflare
Security reviews often miss trust-boundary failures or produce weak evidence. This skill structures reconnaissance, isolated validation, independent verification, and actionable reporting.
Security & Compliance View