pentest-validation

Name: pentest-validation
Availability: InStock
Author: aquariuscook

Validate security findings through graduated exploitation tiers and generate evidence.

1|Updated Dec 29, 2025

Search Tags:#exploitation #pentest #shannon #no-exploit-no-report #security-validation #graduated-exploitation

Ready to run

npx skills add https://github.com/aquariuscook/Agent_Modus_Map --skill pentest-validation-aquariuscook

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: pentest-validation
Source: https://github.com/aquariuscook/Agent_Modus_Map/tree/main/.claude/skills/pentest-validation
Command: npx skills add https://github.com/aquariuscook/Agent_Modus_Map --skill pentest-validation-aquariuscook

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill automates the process of validating security findings, ensuring that only genuinely exploitable vulnerabilities are reported, thereby reducing noise and wasted effort.

Core Features & Use Cases

Graduated Exploitation: Employs a tiered approach (pattern, payload, full exploit) to validate vulnerabilities efficiently.
"No Exploit, No Report": Enforces a strict policy where vulnerabilities must have demonstrable proof of exploitability to be included in reports.
Use Case: When a security scanner flags a potential SQL injection, this Skill will attempt to confirm it through various exploitation tiers, providing concrete evidence or definitively marking it as a false positive.

Quick Start

Use the pentest-validation skill to validate security findings against the staging URL 'https://staging.app.com'.

Frequently Asked Questions about pentest-validation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I eliminate false positives in pentest findings before reporting?▼

Security finding validation is the process of confirming exploitability through graduated exploitation tiers, applying pattern, payload, and full exploit attempts to generate concrete evidence and definitively mark unexploitable findings as false positives.

What is the "No Exploit, No Report" principle in security validation?▼

The "No Exploit, No Report" principle is a strict security validation policy requiring vulnerabilities to have demonstrable proof of exploitability, ensuring only genuinely exploitable vulnerabilities are included in reports to reduce noise and wasted effort.

How do I confirm a security scanner flagged a potential SQL injection vulnerability?▼

To confirm a potential SQL injection flagged by a scanner, you apply a tiered exploitation approach that attempts validation through pattern, payload, and full exploit tiers, providing concrete evidence or definitively marking it as a false positive.

Can I use graduated exploitation to validate security findings against a staging environment?▼

Yes, you can use graduated exploitation to validate security findings against a staging environment by orchestrating a multi-phase validation process targeting the staging URL to confirm exploitability and generate evidence.

What are the limitations of automated security validation for vulnerability reporting?▼

Automated security validation limits vulnerability reporting to only genuinely exploitable vulnerabilities with demonstrable proof, which may exclude theoretical risks that do not pass the pattern, payload, or full exploit tiers.