Skill Claude CodeCodex
Coordinate penetration testing and AI self-code audits via schema-enforced, event-driven engine. All attack categories, domains, tools, and checklists are stored in SQLite (findings.db) and loaded JIT by engine/router.py.
Instructions file CodexOpenCode
AGENTS.md instructions for humaidhahm/opencode-pentester, covering security rules, secrets, database, authentication and authorization and input and output.
Instructions file
Claude Code instructions for humaidhahm/opencode-pentester, covering opencode-pentester, architecture, key files, subagents and permissions.
Agent
Available agents (implemented and on disk).
Agent
Before executing ANY command against a target.
Agent
Use this agent when you need to audit the security of a vibe-coded application, identify vulnerabilities, and provide remediation guidance. This agent is designed for projects where code may have been developed rapidly with less formal security review. It is particularly useful after implementing new features…
Plugin Claude Code
Full penetration testing framework - 69 attack categories across 16 domains covering OWASP, injection, authentication, cloud, and more.
Agent
AWS/Azure/GCP security audit, S3 bucket enumeration, container image scanning, Kubernetes RBAC review, IaC misconfiguration detection. 4-phase workflow with approval gate.
Agent
Tests for CSRF vulnerabilities: missing tokens, SameSite bypass, token reuse, method override. Generates browser-loadable PoC HTML. 4-phase workflow with approval gate.
Agent
Identifies tech stacks, researches NVD/Exploit-DB/GitHub, adapts PoC exploits, validates exploitability live. 4-phase workflow with approval gate.
Agent
Subdomain discovery, port scanning, service enumeration, certificate transparency. Builds attack surface inventory. 4-phase workflow with approval gate.
Agent
Tests SQLi, NoSQLi, and OS command injection. Uses sqlmap for automated SQLi detection and curl for manual probing. 4-phase workflow with approval gate.
Agent
Network scanning, SMB/SNMP/LDAP enumeration, AD attack paths, pivoting, and network segmentation testing. 4-phase workflow with approval gate.
Agent
Online brute force (SSH, FTP, HTTP, SMB, RDP), offline hash cracking (hashcat, john), credential spraying, wordlist optimization, and rule-based attacks. 4-phase workflow with approval gate.
Agent
Executes specific vulnerability tests. Follows 4-phase workflow (Recon → Experiment → Test → Verify), generates PoCs, captures evidence. Specialized by attack type.
Agent
Penetration-test PLANNER. Reads confirmed scope and recon results, returns a structured deployment plan (which executors, against which surfaces, in what order, with time allocation and escalation directives). Does NOT deploy executors.
Agent
Privilege escalation (Linux/Windows), lateral movement, persistence, AD post-exploitation, hash extraction, and tunnel pivoting. 4-phase workflow with approval gate.
Agent
OSINT, subdomain enumeration, port scanning, service discovery, tech fingerprinting, web crawling, directory enumeration, parameter discovery, and screenshots. Builds comprehensive attack surface inventory. 4-phase workflow with approval gate.
Agent
Tests for reflected, stored, and DOM-based XSS. Covers framework-specific sinks (React, Vue, Angular), WAF evasion, and CSP bypass. Uses Playwright for browser-based evidence capture. 4-phase workflow with approval gate.
Skill Claude CodeCodex
Coordinate penetration testing. Deploy executors, aggregate results, generate reports.