pentest

Scan web apps, APIs, and codebases for verified exploitable vulnerabilities.

115|13|Updated Mar 24, 2026

Search Tags:#penetration testing #security audit #web security #api security #vulnerability scanning #exploit verification #zero false positives

Ready to run

npx skills add https://github.com/Houseofmvps/ultraship --skill pentest-houseofmvps

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: pentest
Source: https://github.com/Houseofmvps/ultraship/tree/main/skills/pentest
Command: npx skills add https://github.com/Houseofmvps/ultraship --skill pentest-houseofmvps

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Manual penetration testing is slow, inconsistent, and often misses critical vulnerabilities or reports false positives, leaving applications exposed to preventable attacks.

Core Features & Use Cases

Full-surface security scanning: Tests web apps, REST/GraphQL APIs, browser clients, GitHub repositories, and local codebases for exploitable flaws.
Verified findings only: Every reported vulnerability includes proof of concept, with no unconfirmed guesses or false positives.
Use case: Run this skill before deploying a new e-commerce web app to catch critical issues like SQL injection, XSS, and exposed secrets before malicious actors can exploit them.

Quick Start

Use the pentest skill to run a full verified security audit on your deployed application at https://your-production-app.com.

Frequently Asked Questions about pentest

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I run a penetration test on my web app without getting false positives?▼

To run a penetration test without false positives, you need a verified security audit approach that validates every finding with a proof of concept. This ensures reported vulnerabilities like SQL injection and XSS are exploitable, eliminating unconfirmed guesses.

Can I scan local codebases and GitHub repositories for exposed secrets?▼

Yes, you can scan local codebases and GitHub repositories for exposed secrets. Full-surface security scanning targets these environments alongside deployed web apps to identify exploitable flaws and misconfigurations before deployment.

What is the best way to verify vulnerability scanning results for a production application?▼

The best way to verify vulnerability scanning results is through exploit verification. This process validates findings by generating a proof of concept, ensuring zero false positives for issues like authentication bypasses or exposed secrets.

Does penetration testing work for pre-deployment security audits on browser clients?▼

Penetration testing works for pre-deployment security audits on browser clients. It tests browser clients, APIs, and web apps to catch critical issues like injection flaws and exposed secrets before malicious actors can exploit them.