Skill Claude CodeCodex
Phase 1 required adapter — ports, services, OSINT product paths via Schema. Skill-gate read at Phase 1 start (with pentester-recon). Use when starting Phase 1, intelligence gathering, nmap/service enum planning, or Schema --print-plan 1.
Skill Claude CodeCodex
Phase 4 exploitation — PoC construction, exploit-db/msf search, safe verification. Required Skill-gate read at Phase 4. Use when starting Phase 4, exploitation, exploit, PoC, exploit-db, msf, Metasploit, or payload delivery.
Skill Claude CodeCodex
Phase 6 required adapter — REPORT-SKELETON fill + check-report quality checklist. Skill-gate read at Phase 6. Use when starting Phase 6, reporting, write report.md, or deliver engagement report.
Skill Claude CodeCodex
Phase 0 required adapter — materialize target/${ID}, scope, auth, scan env per schema/env. Skill-gate read at Phase 0 / engagement start. Use when starting a pentest, Phase 0, pre-engagement, init target, or bootstrap workspace.
Skill Claude CodeCodex
Runtime knowledge lookup and tier-1 write under .agents/knowledge. Uses LOOKUP.md. Not for bulk GitHub import (see pentester-knowledge-import).
Skill Claude CodeCodex
Offline bulk import of GitHub / external reference libraries into knowledge tier-2 archives. Maintenance only — not used during PTES phases.
Skill Claude CodeCodex
Optional MCP discovery when .agents/mcp/INDEX.md has registered tools.
Skill Claude CodeCodex
Phases 1b/3/4 authorized browser automation — SPA recon, multi-role auth, route/API catalog, PoC screenshots, Evidence landing (scoped proxy). Skill-gate read for web phases. Use when Phase 1b/3/4 web work, JS-rendered SPA, real browser needed, HAR/network capture, or Playwright PoC evidence.
Skill Claude CodeCodex
Phase 5 required adapter — situational awareness, credentials, lateral (scope-gated). Skill-gate read at Phase 5. Use when starting Phase 5, post-exploitation, lateral movement, credential harvesting, internal recon, or privilege escalation.
Skill Claude CodeCodex
Phase 1 intelligence recon methodology — passive+active recon, stack fingerprint, attack-surface map. Required Skill-gate read at Phase 1 (with pentester-enum-services). Use when starting Phase 1, intelligence gathering, recon, reconnaissance, OSINT prep, target profiling, or attack surface mapping.
Skill Claude CodeCodex
Phase 1/3 adapter — normalize raw scanner output into the Triage ledger (parser, not tool wrapper). Skill-gate read at Phase 3 (and when ingesting Phase 1 scannerraw). Use when starting Phase 3, triage, scan-ingest, nuclei/httpx/nmap raw merge, or vulns/triage.md.
Skill Claude CodeCodex
One-time setup — framework deps (Playwright / Kali / validator), PentesterSpecialDict wordlist submodule, and DotSlash pentest toolset. Use when setting up the pentester environment, first clone, or missing wordlists/tools.
Plugin Claude CodeCodex
Plugin marketplace listing 1 plugin: src-hunter.
Plugin Claude CodeCodex
A collection of tools and instructions for finding security weaknesses through SRC programs, public bug-bounty programs run by companies or platforms.
Skill Claude CodeCodex
Phases 1b/3/4 required playbook adapter — web/SRC corpus via playbook.js --signal. Does not run a separate PTES chain. Skill-gate read at 1b/3/4. Use for playbooks, payload corpus, signal-driven testing, or SRC-style checks.
Skill Claude CodeCodex
Phase 2 required adapter — handoffs → checkable Threat model (STRIDE + Signal mapping). Skill-gate read at Phase 2. Use when starting Phase 2, threat modeling, STRIDE, attack prioritization, or Signal mapping for Phase 3.
Skill Claude CodeCodex
Provision the pinned pentest toolset via DotSlash for the current scanenv (host-kali or kali-target-${ID}). Adapter, not a tool wrapper.
Skill Claude CodeCodex
Target-local engagement notes only. Promote reusable methods via pentester-knowledge-base — not a third phase knowledge bag.
Skill Claude CodeCodex
Phase 4 conditional — WAF/filter bypass for authorized CTF/range/pentest when payloads are blocked. Use at Phase 4 if blocked, or when user mentions WAF bypass, filter evasion, SQL/XSS/command-injection bypass, or security filter analysis.
Skill Claude CodeCodex
A security-assessment guide for AI applications, agents, MCP tools, skills, plugins, memory, retrieval systems, and model services. MCP, or Model Context Protocol, is a way for AI systems to use external tools and data.
Skill Claude CodeCodex
A penetration-testing workflow for Android applications, including APK inspection, runtime testing, traffic capture, and dynamic analysis. An APK is the installable package used by an Android app.
Skill Claude CodeCodex
A workflow for understanding and replaying requests made by Android apps, browser JavaScript, or desktop clients. It uses captured network traffic first and examines client code only when signing, encryption, tokens, or anti-automation rules prevent replay.
Skill Claude CodeCodex
A toolkit for converting, decoding, hashing, and encrypting data. It covers formats such as Base64, hexadecimal, URL encoding, HTML entities, and JWTs, plus hashes and several cipher types.
Skill Claude CodeCodex
A practical knowledge base for attacking cryptography challenges in Capture the Flag (CTF) competitions. It covers RSA, AES, elliptic-curve cryptography, random-number generators, classical ciphers, and lattice-based methods.