web-pentest

Perform authorized web application penetration testing with reconnaissance, vulnerability analysis, and proof-based exploitation.

Updated Jun 25, 2026
One-click install
npx skills add https://github.com/Rheasilvia/hermes-desktop --skill web-pentest-rheasilvia
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: web-pentest
Source: https://github.com/Rheasilvia/hermes-desktop/tree/main/optional-skills/security/web-pentest
Command: npx skills add https://github.com/Rheasilvia/hermes-desktop --skill web-pentest-rheasilvia

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires nmap, whatweb, curl, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill provides a structured, safe, and reproducible framework for conducting web application penetration testing, ensuring that security assessments are evidence-based rather than speculative.

Core Features & Use Cases

  • Phased Methodology: Implements a rigorous workflow covering reconnaissance, vulnerability analysis, and proof-based exploitation.
  • Safety Guardrails: Enforces strict scope allowlisting, authorization verification, and rate-limiting to prevent accidental damage or illegal testing.
  • Use Case: Use this Skill to perform a security audit on a staging environment, identifying and verifying vulnerabilities like SQL injection or XSS while maintaining a detailed, audit-ready report of all findings and evidence.

Quick Start

Initiate a new security engagement by running the pentest setup command for your target URL.

Frequently Asked Questions about web-pentest

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform authorized web application penetration testing safely?

Authorized web application penetration testing requires a phased methodology of reconnaissance, vulnerability analysis, and exploitation. This Skill enforces strict scope allowlisting, authorization verification, and rate-limiting to ensure safety while identifying security flaws.

Can I use nmap and curl to test for web vulnerabilities like XSS and SQL injection?

Yes, you can use terminal tools like nmap and curl to test for web vulnerabilities. This Skill utilizes these dependencies to execute controlled security assessments and verify vulnerabilities through proof-based exploitation.

What is the best way to generate audit-ready reports for security assessments?

The best way to generate audit-ready security assessment reports is to use a proof-based methodology. This Skill maintains detailed findings and evidence during controlled exploitation to ensure assessments are evidence-based rather than speculative.

Do I need terminal access to run proof-based exploitation on staging environments?

Yes, you need terminal access to run proof-based exploitation on staging environments. This Skill requires terminal access to execute controlled, rate-limited security assessments using standard tools like nmap and curl.

Does this web security testing approach enforce scope allowlisting?

Yes, this web security testing approach enforces strict scope allowlisting and authorization protocols. Safety guardrails are implemented to prevent accidental damage or illegal testing outside the defined target scope.

Why does my security audit need safety guardrails during vulnerability analysis?

Your security audit needs safety guardrails during vulnerability analysis to prevent accidental damage and ensure legal compliance. Enforcing rate-limiting and scope verification keeps web application penetration testing strictly controlled and safe.