home / Security / Penetration Testing Skill by @BagelHole

Penetration Testing Skill by @BagelHole

FREE

github stars★ 1,180updatedJan 2026repo@BagelHole

$git clone https://github.com/BagelHole/DevOps-Security-Agent-Skills

The skill is the security/operations/penetration-testing folder inside that repository. Copy it into the folder your agent loads skills from; check your agent's documentation for where that is.

about Penetration Testing Skill by @BagelHole

Perform basic penetration testing and security assessments.

our take

Covers the phases of a basic penetration test: reconnaissance, scanning and web testing, with rules of engagement. It is aimed at validating security controls.

when to use it

You test your own systems' defences
You want a phased approach to an assessment
You need rules of engagement written down

before you install

Only test systems you own or have written permission to test
Run intrusive scans outside production hours and with approval

what's inside

The original SKILL.md is organised into these sections:

Phases
Reconnaissance
Scanning
Web Testing
Rules of Engagement
Best Practices
Related Skills

source and license

Written and maintained by @BagelHole. It is published under the MIT license, which allows reuse with attribution. SkillDirectory does not claim authorship: this page adds our own review and links back to the original, and the skill's text belongs to its author.

View the full SKILL.md on GitHub ↗

Read the opening of the original SKILL.md

# Penetration Testing

Validate security controls through authorized testing.

## Phases

```yaml
pentest_phases:
  1_reconnaissance:
    - Passive information gathering
    - DNS enumeration
    - Network mapping
    
  2_scanning:
    - Port scanning
    - Service identification
    - Vulnerability scanning
    
  3_exploitation:
    - Attempt exploitation
    - Verify vulnerabilities
    - Document findings
    
  4_post_exploitation:
    - Privilege escalation
    - Lateral movement
    - Data access
    
  5_reporting:
    - Document findings
    - Risk assessment
    - Remediation recommendations
```

## Reconnaissance

```bash
# DNS enumeration
dig example.com ANY
host -l example.com

# Subdomain discovery
subfinder -d example.com

# WHOIS
whois example.com
```

## Scanning

```bash
# Port scan
nmap -sV -sC -p- target.com

# Web scanning
nikto -h https://target.com
dirb https://target.com

# Vulnerability scan
nmap --script vuln target.com
```

## Web Testing

```bash
…

Excerpt only, quoted from the author's repository. Open the repository for the complete file.

↓ download .zip