pentest

Scan Spring Boot projects for security vulnerabilities and misconfigurations.

3|2|Updated Jan 16, 2026
One-click install
npx skills add https://github.com/taipt1504/agent-skills --skill pentest-taipt1504
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: pentest
Source: https://github.com/taipt1504/agent-skills/tree/main/skills/pentest
Command: npx skills add https://github.com/taipt1504/agent-skills --skill pentest-taipt1504

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Pentest scans identify hidden security flaws, misconfigurations, and known CVEs in Spring Boot applications, preventing data breaches and compliance failures.

Core Features & Use Cases

  • Automated scanners: Six scripts covering OWASP Top 10, SpEL injection, Actuator exploitation, Jackson deserialization, mass assignment, and Spring Security misconfiguration.
  • Four‑phase methodology: Reconnaissance, OWASP mapping, deep dive on Spring‑specific risks, and detailed reporting.
  • Report generation: Produces a markdown and JSON report with severity classification for quick remediation.
  • Use cases: Ideal for security reviews, penetration testing, vulnerability assessments, and continuous CI security gating.

Quick Start

Run /pentest-scan to perform a full security assessment of the current Spring Boot project.

Frequently Asked Questions about pentest

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan a Spring Boot project for security vulnerabilities and OWASP Top 10 issues?

To scan Spring Boot projects for security vulnerabilities, you can run an automated assessment that targets OWASP Top 10 issues, SpEL injection, and actuator exposure, generating a classified markdown report for remediation.

What is the best way to detect Spring Boot actuator exposure and misconfigurations?

Detecting Spring Boot actuator exposure requires an automated scanner that maps reconnaissance data to specific actuator exploitation risks, identifying misconfigurations and producing a severity-classified markdown report.

Can I automate penetration testing for Spring Boot applications in a CI pipeline?

Automated penetration testing for Spring Boot applications is ideal for continuous CI security gating. It executes bundled Bash scanners to parse results and generate JSON reports for vulnerability assessments.

Does this security scan check for Jackson deserialization and mass assignment flaws?

This security scan checks for Jackson deserialization and mass assignment flaws. It conducts a deep dive on Spring-specific risks, parsing scanner outputs to produce a detailed markdown report for quick remediation.

How do I identify SpEL injection risks during a Spring Boot security review?

Identifying SpEL injection risks during a Spring Boot security review involves running specialized scanners that map OWASP vulnerabilities and execute deep dives on Spring-specific injection flaws.

What limitations exist when using automated Bash scanners for Spring Boot vulnerability assessments?

Automated Bash scanners for Spring Boot vulnerability assessments focus specifically on known CVEs, SpEL injection, and actuator misconfigurations, meaning they may not detect custom business logic flaws outside these targeted categories.