Verified:Website 𝕏@alvarovillalbap GitHub

pentest

Validate suspected vulnerabilities through authorized offensive testing on staging targets.

Updated Feb 13, 2026

Search Tags:#pentest #responsible disclosure #exploit validation #evidence reporting #authorized testing #staging security #raw http replay

Ready to run

npx skills add https://github.com/alvarovillalbaa/plugins --skill pentest-alvarovillalbaa

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: pentest
Source: https://github.com/alvarovillalbaa/plugins/tree/main/engineering/skills/pentest
Command: npx skills add https://github.com/alvarovillalbaa/plugins --skill pentest-alvarovillalbaa

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires curl, python3, and includes references (resource) and scripts (resource) components.

What problem does it solve?

This Skill helps you turn security hypotheses into confirmed exploit evidence through authorized hands-on pentesting, while aggressively avoiding false positives and preventing overreach into passive review or non-consented targets.

Core Features & Use Cases

Pentest engagement readiness: scopes objectives, constraints, logging/monitoring, and cleanup expectations before active testing.
Exploitability validation for reported findings: runs a graduated validation pipeline (pattern confirmation → bounded evidence → escalation only when needed) and enforces the default rule of no exploit, no report.
Evidence-driven pentest reporting: organizes findings into confirmed, likely, inconclusive, and rejected outcomes based on strict replay criteria and documented blockers.

Quick Start

Use pentest to confirm which of your scanner or review findings are truly exploitable on an explicitly authorized staging target.

Frequently Asked Questions about pentest

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I validate scanner findings for exploitability on a staging target?▼

You validate scanner findings by running a graduated validation pipeline that progresses from pattern confirmation to bounded evidence collection, enforcing explicit stop conditions to confirm or kill suspected vulnerabilities on authorized staging targets.

What is the process for raw HTTP replay verification of reported vulnerabilities?▼

Raw HTTP replay verification reproduces suspected vulnerabilities by reissuing exact HTTP requests against authorized targets, categorizing outcomes into confirmed, likely, inconclusive, or rejected based on strict reproducible replay criteria and documented blockers.

Do I need explicit authorization before testing security vulnerabilities in a sandbox environment?▼

Explicit authorization is required before testing security vulnerabilities, as the workflow enforces non-production scope gates and authorization checks to prevent overreach into non-consented targets, even in sandbox or lab environments.

How do I structure evidence reporting for a pentest engagement?▼

Structure evidence reporting for a pentest engagement by organizing findings into confirmed, likely, inconclusive, and rejected outcomes, ensuring no exploit means no report, and documenting reproducible replay rules alongside scoped objectives and cleanup expectations.

Can I use curl and python3 for hands-on offensive security testing?▼

You can use curl and python3 for hands-on offensive security testing to perform raw HTTP replay and execute exploit validation scripts, producing evidence-backed results that confirm or disprove security hypotheses on staging targets.

What are the limitations of authorized testing against non-production targets?▼

Limitations of authorized testing include strict non-production scope gates, preventing active testing on passive review targets or non-consented systems, and enforcing default rules where unconfirmed exploits cannot be reported without reproducible evidence.