pentest-web

Analyze code patterns to identify exploitable web application weaknesses.

8|4|Updated Feb 7, 2026

Search Tags:#authorization #authentication #web-security #IDOR #code-analysis #pentest #SSRF

Ready to run

npx skills add https://github.com/adrien-barret/claude-kit --skill pentest-web

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: pentest-web
Source: https://github.com/adrien-barret/claude-kit/tree/main/project-template/.claude/skills/security/pentest-web
Command: npx skills add https://github.com/adrien-barret/claude-kit --skill pentest-web

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps security teams simulate web penetration testing by analyzing code patterns to identify exploitable weaknesses in web applications.

Core Features & Use Cases

Authentication & Authorization Testing: Identify broken auth flows, insecure direct object references, and missing authorization checks.
Vulnerability Pattern Recognition: Detect SSRF, rate-limit bypass, JWT misconfigurations, and API abuse patterns in code or configurations.
Use Case: When auditing a web app, use this Skill to map common attack surfaces and generate recommended mitigations based on the project codebase.

Quick Start

Use the pentest-web skill to simulate targeted testing on your web application's authentication, authorization, and data handling paths.

Frequently Asked Questions about pentest-web

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I identify IDOR and privilege escalation vulnerabilities in my web application code?▼

To identify IDOR and privilege escalation vulnerabilities, this skill simulates web penetration testing by analyzing code patterns to detect missing authorization checks and insecure direct object references. It maps common attack surfaces and generates structured mitigations for your project codebase.

Can I detect SSRF and rate-limit bypass patterns by analyzing source code?▼

Yes, you can detect SSRF and rate-limit bypass patterns through code analysis. This skill recognizes vulnerability patterns in code and configurations, enabling step-by-step attack scenarios to expose API abuse and insecure data handling paths.

What is the best way to simulate authentication and authorization testing during a web app audit?▼

Simulating authentication and authorization testing is best achieved by applying rule-based pattern matching to your codebase. This approach identifies broken auth flows, JWT misconfigurations, and missing access controls to generate structured outputs of identified flaws.

Does this code analysis approach work for finding broken authentication flows and JWT misconfigurations?▼

Yes, this code analysis approach works for finding broken authentication flows and JWT misconfigurations. It scans your web application's authentication paths and configurations to simulate targeted testing and output recommended security mitigations.

How do I generate structured mitigations for API abuse patterns found in my codebase?▼

To generate structured mitigations for API abuse patterns, the skill applies scenario-based detection and rule-based pattern matching to your code. It outputs identified flaws alongside recommended mitigations for vulnerabilities like API abuse and insecure data access.

When should I use code pattern analysis instead of dynamic web penetration testing?▼

You should use code pattern analysis when auditing a web app to map common attack surfaces before dynamic testing. It simulates targeted testing on authentication, authorization, and data handling paths to identify exploitable weaknesses directly from the codebase.