Point it at a web app or a network you're authorized to test, and it runs the whole engagement like a methodical penetration tester would.
Enumerates subdomains, endpoints, parameters, and tech to chart the full attack surface.
Works category by category through the OWASP Web Security Testing Guide — auth, access control, injection, and more.
Confirms real issues with the lightest safe proof instead of dumping false positives.
Tests logged-in flows and cross-tenant isolation — where the highest-impact bugs live.
Writes a technical report for engineers, a plain-English stakeholder summary, and a how-to-recreate guide — all as PDF.
Just Markdown instructions and small scripts. No fine-tuning, no black box — read every line.
A disciplined five-phase workflow — each phase feeds the next.
Confirms you're allowed to test the target and records the rules of engagement first.
Builds the attack surface: hosts, endpoints, parameters, technologies, and roles.
Works the OWASP WSTG categories against everything it mapped.
Proves real impact with minimal, non-destructive proof-of-concept.
Turns findings into clear, actionable reports for devs and leadership.
Each skill follows an established methodology from scoping through reporting. Pick the one that matches your target.
Recon of a web application, then category-by-category OWASP WSTG testing, including authenticated and multi-tenant flows.
External perimeter and internal Active Directory testing, from host discovery and enumeration to privilege escalation and lateral movement.
Each skill ships with focused reference guides, so the agent loads only the material it needs for the step in front of it.
Methodology, tooling, post-exploitation, reporting, and lab targets for practice.
Active Directory, privilege escalation, password attacks, pivoting, containers, cloud identity, wireless, and tooling.
Trigger and behavior test cases, including scope refusals, plus recorded benchmark runs for web-pentest.
A render script turns the Markdown reports into PDFs with Chrome, weasyprint, or cupsfilter.
The net-pentest skill on a throwaway Active Directory lab: no credentials, no map, timed from the first command.
First command to confirmed Domain Admin.
On the network, no accounts, no prior knowledge of the domain.
Three reports, rendered. About 1.5 min of that is reporting.
Null-session SMB and SAMR returned the full user list. No login needed.
A lockout-safe seasonal spray recovered two accounts on the first pass.
AS-REP Roast, Kerberoast, and DCSync hit Samba and impacket interop bugs. Recorded as tooling limits, not faked.
≈ 7 min lost to interopAn over-broad ACL let a service account force-reset the built-in Administrator's password.
Authenticated as Administrator, created and verified a new account, then cleaned up.
🧪 Honest by design. Roughly half the time was dead ends. The two privilege-escalation findings were lab-injected with the owner's approval, and the reports say so plainly rather than presenting a clean win. Read the full write-up →
Three timed lab engagements, run end to end with the skills in this repo.
Drop the skill where Claude Code discovers skills, then just ask for a pentest.
# Per project (both skills)
git clone https://github.com/hassan-algo/open-sesame.git
cp -r open-sesame/.claude/skills/* .claude/skills/
# …then in Claude Code:
"Pentest my web app at https://staging.myapp.example — I own it. Start with recon."
"Scan this subnet and enumerate the hosts — it's my lab network."⚠️ Authorized testing only. This skill is for systems you own or have explicit permission to test (your own apps, a signed client engagement, an in-scope bug-bounty target, or a CTF / practice lab). It's designed to refuse unauthorized targets and prefer non-destructive proofs. Using it against systems you don't have permission to test may be illegal — you are responsible for staying within scope and the law.