mcpField
P
pentest

pentest

github.com/ariadossSecurity1268 installsUpdated today
Repository

About pentest

pentest is a skill for authorized security testing with clearwing, intended for security practitioners analyzing source code or scanning network targets. It combines staged vulnerability analysis, network scanning, and several report formats, and requires authorization and scope confirmation before scanning.

Key features

  1. 01Staged source-code vulnerability analysis
  2. 02Quick, standard, and deep scan modes
  3. 03Single-host and CIDR network scans
  4. 04Interactive exploration and session resume
  5. 05Export to SARIF, Markdown, and JSON
  6. 06Generate SARIF output in CI

Use cases

  1. 01Review an authorized codebase for vulnerabilities
  2. 02Choose scan depth for source analysis
  3. 03Scan an approved host or network range
  4. 04Feed findings into code scanning or CI

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/ariadoss/superskills --skill pentest

After installing, type/pentestin Claude Code to confirm it loaded.

Details

From the project README

Pentest — Clearwing Security Scanner

Authorized security testing using clearwing.

Authorization Check

Before any scanning, confirm authorization with the user. Ask:

  1. Is this target owned by you or your organization?
  2. Do you have written authorization to test it?
  3. What is the scope (source code only, network, or both)?

If authorization is unclear, STOP and do not proceed.

Prerequisites

Check if clearwing is installed:

command -v clearwing && clearwing --version

If not installed:

uv tool install clearwing
clearwing setup  # Interactive LLM provider configuration

Requires: Python 3.10+, uv, Rust toolchain (for native bridge).

Mode 1: Source Code Analysis

Hunt vulnerabilities in source code using the 11-stage pipeline:

# Standard depth — recommended starting point
clearwing sourcehunt <path-to-repo> --depth standard

# Quick scan — faster, less thorough
clearwing sourcehunt <path-to-repo> --depth quick

# Deep scan — comprehensive, takes longer
clearwing sourcehunt <path-to-repo> --depth deep

The pipeline: preprocess → rank files → generate fuzzing harnesses → tiered hunt (6 specialists) → adversarial verification → patch oracle → variant loop → exploit triage → auto-patch → report.

Evidence levels (ascending confidence):

  1. suspicion — pattern match, needs investigation
  2. static_corroboration — confirmed by static analysis
  3. crash_reproduced — fuzzer triggered a crash
  4. root_cause_explained — mechanism understood
  5. exploit_demonstrated — exploitability confirmed
  6. patch_validated — fix verified

Mode 2: Network Scanning

Scan a live target for service vulnerabilities:

# Single host
clearwing scan <target-ip-or-hostname>

# CIDR block (concurrent)
clearwing parallel <CIDR> --max-concurrent 5

Output

Results are stored in SQLite and exported as:

  • SARIF — for GitHub Code Scanning integration
  • Markdown — human-readable report
  • JSON — machine-readable findings

Interactive Mode

For guided exploration:

clearwing interactive
clearwing interactive --resume <session_id>

CI Integration

clearwing ci --sarif-output results.sarif

Comments

Markdown supported