Everything for pentest. | A penetration testing knowledge base that captures security methodologies in an AI Agent-executable format.
This repository also configures its own agents. See what AboutSecurity tells them →
Skill Claude CodeCodex
A methodology for testing the security of AI-agent systems that call tools, work with other agents, or make decisions autonomously. It covers ten risks from the OWASP Agentic AI Security Top 10, including prompt hijacking, excessive tool use, permission problems, and unsafe code execution.
Skill Claude CodeCodex
A security-testing method for AI systems that examines data leaks, training-data exposure, and the integrity of retrieval-augmented generation (RAG) or vector databases. A vector database stores data in a form AI systems use to find related information.
Skill Claude CodeCodex
A methodology for testing identity and permission security in AI systems, including agent authentication, roles, sessions, and MCP or API credentials. It covers attacks such as role escape, unauthorized actions, identity forgery, session hijacking, and credential misuse.
Skill Claude CodeCodex
A security-testing method for attacks on an AI agent's intermediate reasoning in multi-step systems. Chain-of-Thought (CoT) means the reasoning steps an AI uses to reach an answer, while ReAct combines reasoning with actions.
Skill Claude CodeCodex
A security-testing method for systems that combine traditional websites with AI or large language model components. It maps attacks that move from the website into the AI system, and from the AI system back into the website.
Skill Claude CodeCodex
A security-testing method for MCP, or Model Context Protocol, integrations that let AI agents call external tools. It examines tool descriptions, schemas, instructions, tokens, and interactions between multiple MCP servers.
Skill Claude CodeCodex
A security-testing method for indirect prompt injection, where instructions hidden in webpages, documents, emails, databases, or API responses influence an AI system. It also covers attacks on connected tools, retrieved data, and information handling.
Skill Claude CodeCodex
A security-testing method for breaking or bypassing the instructions that control AI chatbots and agents. It covers techniques such as role-playing, code and language changes, context-window pressure, and attempts to replace system instructions.
Skill Claude CodeCodex
A security-testing skill for finding system instructions, settings, tools, and stored information inside applications built with large language models.
Skill Claude CodeCodex
A methodology for security testing of systems hosted on Alibaba Cloud. Alibaba Cloud services include platforms for servers, storage, databases, containers, and access control.
Skill Claude CodeCodex
A method for analysing AWS access policies, including IAM policies, resource policies, Lambda code, and CloudFormation templates. AWS is Amazon’s cloud platform; IAM controls who can access its resources.
Skill Claude CodeCodex
A methodology for finding privilege-escalation paths in AWS Identity and Access Management (IAM), the system that controls access to AWS resources.
Skill Claude CodeCodex
A general method guide for security testing of Amazon Web Services, a cloud platform that hosts storage, servers, functions, databases, and other services.
Skill Claude CodeCodex
An AWS post-compromise security skill for situations where someone already has high-level access to Amazon Web Services accounts or specific services.
Skill Claude CodeCodex
A methodology for attacking Microsoft Azure AD, now called Microsoft Entra ID, and related Microsoft 365 cloud identity systems. It covers ways attackers may obtain access, steal tokens, abuse application identities, and bypass some access controls.
Skill Claude CodeCodex
A methodology for moving from a compromised Azure or Entra ID cloud account into an on-premises Active Directory network. Active Directory is commonly used to manage users and computers inside an organization.
Skill Claude CodeCodex
A methodology for assessing the security of Microsoft Azure and Microsoft 365 cloud environments, including Entra ID, Microsoft's identity service.
Skill Claude CodeCodex
A security-testing methodology for CI/CD pipelines—the automated systems that build, test, and deploy software—and their connected code repositories and cloud environments.
Skill Claude CodeCodex
A playbook for using leaked cloud access keys and secret keys after they have been found in places such as environment files, Git history, or server-side request forgery (SSRF).
Skill Claude CodeCodex
A playbook for auditing cloud IAM, the system that controls which identities can perform which actions. It covers AWS, Azure, GCP, and Tencent Cloud.
Skill Claude CodeCodex
A playbook for using cloud instance metadata, a local service that can reveal information and temporary credentials about a running cloud machine.
Skill Claude CodeCodex
A playbook for testing Docker, a platform that runs applications in isolated containers. It covers the Docker daemon, registries, images, build outputs, and container escape risks.
Skill Claude CodeCodex
A playbook for attacking Google Cloud Platform (GCP) environments, including service accounts, instance metadata, storage buckets, and Kubernetes Engine (GKE).
Skill Claude CodeCodex
A complete playbook for penetration testing Google Cloud Platform (GCP), Google's cloud-computing service. It covers cloud services such as storage buckets, virtual machines, serverless functions, and Kubernetes Engine.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: