PenKit51 — Open-source AI penetration testing platform with 63 deep exploitation skills, multi-agent orchestration, PoC-validated findings, and native assistant skills for Claude, ChatGPT, and Grok. Authorized testing only.
Skill Claude CodeCodex
Authorized AI penetration testing assistant for web applications, APIs, and infrastructure. Performs reconnaissance, vulnerability assessment, PoC validation, exploit chaining, and professional reporting. Use when the user asks for pentest, penetration test, security assessment, vulnerability scan, bug bounty…
Skill Claude CodeCodex
A set of methods for testing the security of APIs, which are interfaces that let software exchange data and request actions.
Skill Claude CodeCodex
JWT and OIDC security testing covering token forgery, algorithm confusion, and claim manipulation.
Skill Claude CodeCodex
AWS cloud security testing covering IAM misconfigurations, S3 exposure, metadata abuse, and privilege escalation paths.
Skill Claude CodeCodex
BFLA testing for action-level authorization failures across endpoints, admin functions, and API operations.
Skill Claude CodeCodex
Fast browser automation CLI for AI agents. Chrome/Chromium via CDP, no Playwright or Puppeteer dependency. Accessibility-tree snapshots with compact @eN refs let agents interact with pages in 200-400 tokens instead of parsing raw HTML.
Skill Claude CodeCodex
Business logic testing for workflow bypass, state manipulation, and domain invariant violations.
Skill Claude CodeCodex
A set of methods for auditing cloud security, meaning checking whether systems and data hosted by cloud providers are configured safely.
Skill Claude CodeCodex
RCE testing covering command injection, deserialization, template injection, and code evaluation.
Skill Claude CodeCodex
A set of methods for testing the security of software containers, which package an application and its dependencies together.
Skill Claude CodeCodex
CSRF testing covering token bypass, SameSite cookies, CORS misconfigurations, and state-changing request abuse.
Skill Claude CodeCodex
Exhaustive security assessment with maximum coverage, depth, and vulnerability chaining.
Skill Claude CodeCodex
Insecure deserialization testing for Java, Python, PHP, .NET, Ruby, and Node.js covering gadget chains, type confusion, and safe validation.
Skill Claude CodeCodex
Security testing playbook for Django applications covering ORM injection, middleware gaps, auth/session flaws, and template issues.
Skill Claude CodeCodex
Rules of engagement, scope definition, and authorized penetration test planning.
Skill Claude CodeCodex
Security testing playbook for FastAPI applications covering ASGI, dependency injection, and API vulnerabilities.
Skill Claude CodeCodex
Skill "ffuf-tooling" from xAmirHamza77/PenKit51, covering ffuf tooling, deep exploitation guide, ffuf cli playbook, platform methodology and ffuf tooling.
Skill Claude CodeCodex
File upload security testing covering extension bypass, content-type manipulation, and path traversal.
Skill Claude CodeCodex
Firebase/Firestore security testing covering security rules, Cloud Functions, and client-side trust issues.
Skill Claude CodeCodex
GraphQL security testing covering introspection, resolver injection, batching attacks, and authorization bypass.
Skill Claude CodeCodex
HTTP header injection testing covering CRLF / response splitting, cache poisoning, Host-header confusion, cookie fixation, and proxy / forwarding header smuggling.
Skill Claude CodeCodex
HTTP request smuggling testing covering CL.TE, TE.CL, H2.CL, H2.TE, and HTTP/2 desync techniques with practical detection and exploitation methodology.
Skill Claude CodeCodex
ProjectDiscovery httpx probing syntax, exact probe flags, and automation-safe output patterns.
Skill Claude CodeCodex
IDOR/BOLA testing for object-level authorization failures and cross-account data access.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: