penetration-testing

Perform authorized penetration testing on applications, APIs, and network services.

Updated Feb 1, 2026

Search Tags:#security #reconnaissance #remediation #exploitation #api-security #penetration-testing #vulnerability-assessment

Ready to run

npx skills add https://github.com/habrahgithub/node-backend-starter --skill penetration-testing-habrahgithub

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: penetration-testing
Source: https://github.com/habrahgithub/node-backend-starter/tree/main/.codex/skills/penetration-testing
Command: npx skills add https://github.com/habrahgithub/node-backend-starter --skill penetration-testing-habrahgithub

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill provides a structured, safety-conscious workflow for performing authorized penetration testing to find, validate, and communicate exploitable security weaknesses in applications and APIs.

Core Features & Use Cases

Authorization-first workflow: Enforces explicit permission, scoped targets, and non-destructive defaults before any testing begins.
End-to-end testing steps: Guidance for reconnaissance, attack-surface mapping, systematic vulnerability testing, controlled exploitation within scope, evidence capture, and remediation recommendations.
Use Case: Run a scoped assessment of a pre-production API to identify authentication, authorization, injection, and data exposure flaws, and produce a prioritized findings report with reproducible proof steps.

Quick Start

Conduct an authorized penetration test of the target API, enumerate the attack surface, validate vulnerabilities with reproducible evidence, and deliver a prioritized remediation report.

Frequently Asked Questions about penetration-testing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform penetration testing on a pre-production API to find exploitable vulnerabilities?▼

Penetration testing of a pre-production API involves reconnaissance, attack-surface mapping, systematic vulnerability testing, and controlled exploitation within scope to identify authentication, authorization, and data exposure flaws while capturing reproducible evidence.

What authorization is required before starting an authorized penetration test?▼

Authorized penetration testing requires explicit written permission, a defined target scope, and non-destructive approval for exploit attempts before any testing begins to ensure safety-conscious and legally compliant security assessments.

How does vulnerability assessment work during a scoped security engagement?▼

Vulnerability assessment during a security engagement works by systematically testing the attack surface, validating discovered security weaknesses through controlled exploitation, and capturing evidence to confirm the flaws are exploitable.

Can I use this penetration testing workflow for internal red team exercises?▼

Yes, this penetration testing workflow applies to controlled red team exercises, internal pre-production tests, and web or API assessments, provided you maintain explicit authorization and defined target scope throughout the engagement.

What is the best way to document and report exploitable security flaws found in applications?▼

The best way to report exploitable security flaws is to capture reproducible evidence during testing and deliver a prioritized findings report containing actionable remediation recommendations for each discovered vulnerability.