skills.rest
ok-helloworld
ok-helloworldCOMMUNITY
Explore all skills by this author →
GitHub

vibe-pentest

Automate black-box web penetration testing with multi-agent reconnaissance and evidence-based reporting.

241|28|Updated May 20, 2026
Search Tags:#evidence verification#black-box testing#credential extraction#multi-agent pentest#web vulnerability reporting#attack chain analysis
One-click install
npx skills add https://github.com/ok-helloworld/vibe-pentest --skill vibe-pentest
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vibe-pentest
Source: https://github.com/ok-helloworld/vibe-pentest/tree/main
Command: npx skills add https://github.com/ok-helloworld/vibe-pentest --skill vibe-pentest

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires playwright, python-docx, matplotlib, requests, urllib3, httpx, charset-normalizer, chardet, docx, chartjs, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

Vibe Pentest automates end-to-end black-box Web penetration testing for Web apps, APIs, and admin backends by orchestrating multiple agents in parallel and producing stable, evidence-based security reports.

Core Features & Use Cases

  • Black-box multi-agent workflow: Fingerprint target tech, detect admin/login surfaces, map attack surfaces, then run specialized agents (injection/auth/file/api/business/misc) in parallel.

  • Credential capture for authorized testing: Uses Playwright to let you log in and extracts cookies/tokens for session-aware verification.

  • Evidence-driven reporting: Verifies confirmed findings, links attack chains, and exports both JSON + HTML/DOCX reports with HTTP request/response evidence.

  • Use Case Example: You have an authorized scope for a target URL and a test account; you want an agent to crawl, test multiple vulnerability classes, re-verify findings, then output a professional Word/HTML report with actionable remediation guidance.

Quick Start

Ask an AI agent to run the vibe-pentest workflow against your authorized target and then export results to your workspace directory.

Frequently Asked Questions about vibe-pentest

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate black-box web pentesting and generate a vulnerability report?▼

You can automate black-box web pentesting by orchestrating multi-agent reconnaissance, crawling, and vulnerability probing against authorized targets to produce validated JSON, HTML, and DOCX security assessment reports with HTTP request and response evidence.

Can I capture login credentials and cookies for session-aware security testing?▼

Yes, you can capture login credentials and cookies for session-aware security testing by using Playwright to log into the target application, which extracts the necessary session tokens for authenticated vulnerability verification.

How do I verify web vulnerability findings and link attack chains during penetration testing?▼

To verify web vulnerability findings and link attack chains during penetration testing, the workflow applies strict evidence requirements to re-verify confirmed findings before exporting structured security reports with actionable remediation guidance.

Does this multi-agent pentest workflow support testing APIs and admin backends?▼

Yes, this multi-agent pentest workflow supports testing APIs and admin backends by fingerprinting target technologies, detecting login surfaces, and probing discovered routes using specialized injection, authentication, and file agents in parallel.

What formats can I export my web application security assessment results to?▼

You can export your web application security assessment results to structured JSON, HTML, and DOCX formats, providing validated evidence, linked attack chains, and actionable remediation guidance for professional reporting.

What do I need to run an automated web vulnerability scan with Playwright and Python?▼

To run an automated web vulnerability scan with Playwright and Python, you need an authorized scope for a target URL, a test account for credential capture, and a root-entry SKILL.md to execute deterministic HTTP probing and report generation scripts.

Related Skills

Explore More Legal & Compliance Skills→
guaidao2guaidao2
81

httpx

Probe live HTTP and HTTPS hosts and collect response metadata.

Community
Intermediate
salmanabdurrahmansalmanabdurrahman

report-technical

Synthesize penetration testing findings into structured technical reports with remediation guidance.

Community
Advanced
billydeeii136billydeeii136

setup-browser-cookies

Import cookies from a Chromium browser into a headless browser session.

Community
Intermediate
ok-helloworldok-helloworld
241

vuln-analysis-agent

Correlate vulnerability findings from multiple agents into validated attack chains.

Community
Intermediate