skills.rest
IMIO
IMIOOFFICIAL
Explore all skills by this author →
WebsiteGitHub

security-pentest

Scan SmartWeb staging repositories and HTTP endpoints for security vulnerabilities.

5|1|Updated Feb 26, 2021
Search Tags:#devops#static-analysis#vulnerability-scanning#plone#smartweb#security-pentest#staging-audit
One-click install
npx skills add https://github.com/IMIO/buildout.smartweb --skill security-pentest
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-pentest
Source: https://github.com/IMIO/buildout.smartweb/tree/main/.claude/skills/security-pentest
Command: npx skills add https://github.com/IMIO/buildout.smartweb --skill security-pentest

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Manually running multiple security scanners, checking HTTP vulnerabilities, and prioritizing fixes for SmartWeb staging instances is time-consuming and error-prone when performed ad-hoc by development or DevOps teams.

Core Features & Use Cases

  • Integrated Multi-Scanner Analysis: Runs gitleaks, bandit, semgrep, and OSV-Scanner to detect committed secrets, code vulnerabilities, and CVEs in non-vanilla Plone packages specific to iMio SmartWeb.
  • HTTP Vulnerability Testing: Performs non-destructive checks for missing security headers, sensitive file exposure, path traversal flaws, and unauthenticated REST API access against staging URLs.
  • Exploitation Validation: Actively tests confirmed findings on dedicated scratch instances to validate real-world risk, with clear guardrails to prevent use on production environments.
  • Unified Reporting: Generates a self-contained HTML report with prioritized findings, exploitation status, and exact fix recommendations for each issue. Use case: A DevOps engineer can complete a full security audit of a SmartWeb staging environment in minutes, with clear actionable steps to remediate critical issues instead of manually aggregating results from disparate tools.

Quick Start

Use the security-pentest skill to run a full security audit of your SmartWeb staging instance and receive a prioritized HTML report with fix recommendations.

Frequently Asked Questions about security-pentest

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security pentest on a Plone staging instance?▼

Run a security pentest by scanning local repositories for committed secrets and testing HTTP-level attack vectors against the Plone staging instance. The process validates exploitability on scratch environments and outputs a unified HTML report with prioritized fix recommendations.

How does static analysis vulnerability scanning work for SmartWeb packages?▼

Static analysis vulnerability scanning for SmartWeb packages works by running gitleaks, bandit, semgrep, and OSV-Scanner to detect committed secrets, code vulnerabilities, and CVEs in non-vanilla Plone packages. Results are aggregated into a unified HTML report with exploitation status.

Can I test HTTP vulnerabilities like path traversal on staging environments without impacting production?▼

Testing HTTP vulnerabilities like path traversal on staging environments is supported with clear guardrails to prevent use on production. Exploitation validation actively tests confirmed findings on dedicated scratch instances to validate real-world risk safely.

What's the best way to audit committed secrets and code vulnerabilities in a CI/CD pipeline?▼

The best way to audit committed secrets and code vulnerabilities is integrating gitleaks and semgrep directly into the pipeline to scan local repositories. This detects exposed secrets and CVEs in non-vanilla Plone packages before deployment to staging environments.

Does security-pentest support both local Bash execution and platform agent computer use modes?▼

Security-pentest supports both local Bash execution and platform agent computer use modes for maximum flexibility. This allows DevOps teams to run full security audits of SmartWeb staging environments using their preferred execution method and generate unified HTML reports.

Related Skills

Explore More Software Engineering Skills→
dawsonblockdawsonblock

agentmail

Provision and manage agent-owned email inboxes via AgentMail MCP tools.

Community
Intermediate
jpoleyjpoley
50

security-fixer

Generate secure patches for code vulnerabilities and output unified diffs.

Community
Intermediate
statick88statick88
1

security-scanning

Automate security scanning for JavaScript and Python projects.

Community
Advanced
LeandroBenjaminLLeandroBenjaminL

security-auditor

Automate security audits with static and dynamic analysis tools.

Community
Advanced