Conduct authorized web application penetration tests and validate vulnerabilities with reproducible evidence.
npx skills add https://github.com/HeaSec/Pentest-Lyan --skill pentest-lyan
Please help me install this Agent Skill. Skill: pentest-lyan Source: https://github.com/HeaSec/Pentest-Lyan/tree/main Command: npx skills add https://github.com/HeaSec/Pentest-Lyan --skill pentest-lyan
This Skill helps security professionals systematically assess authorized web applications without relying on a fixed vulnerability checklist, while preserving test state, evidence, coverage, and reporting details across multi-stage engagements.
Use the pentest-lyan skill to perform an authorized security assessment of the specified web application URL using the available test accounts.
High-intent search queries and answers about installing and using this skill.
Authorized web penetration testing requires structured validation of discovered vulnerabilities with reproducible evidence. It involves frontend JavaScript analysis, API discovery, and cross-role access control testing, persisting multi-project test state in JSON files to maintain coverage and evidence across multi-stage engagements.
Autonomous threat modeling identifies feature-specific threats across data flows, authorization boundaries, state changes, client-controlled inputs, injection surfaces, and business logic. It avoids relying on a fixed vulnerability checklist by dynamically mapping threats based on application behavior and architecture.
Testing cross-role access control requires building session and permission matrices to perform cross-role testing. You validate real business impact beyond HTTP status codes by manipulating business workflows and client-controlled inputs, ensuring authorization boundaries are properly enforced.
Web penetration testing requires browser automation or curl to interact with application endpoints and validate discovered vulnerabilities. It also needs python-docx when generating DOCX deliverables, alongside persistent JSON state files to track test progress, evidence, and coverage details.
Generating DOCX security reports uses python-docx to transform structured audit results into delivery documents. The process enforces schema and coverage gates, records evidence and blind spots, and produces complete Markdown reports plus DOCX files for formal client delivery.
EntroVyxDetects session fixation, invalidation failures, weak ID entropy via dual-session comparative analysis using curl and jq.
ShinyGuaConvert Markdown manuscripts into PDF and DOCX exports.
xalgordAnalyze JavaScript assets to identify API endpoints, hardcoded secrets, and source maps.
seb1nRun SAST scans with Semgrep and CodeQL to detect vulnerabilities in source code.
