Pentest Checklist
Run an authorized penetration-test planning and execution checklist so scope, legal sign-off, findings, and remediation are not skipped before or after launch.
Overview
Pentest Checklist is an agent skill most often used in Ship (also Operate) that guides authorized penetration tests from scope definition through findings and remediation verification.
Install
npx skills add https://github.com/sickn33/antigravity-awesome-skills --skill pentest-checklistWhat is this skill?
- Authorized-use-only guardrail for assessments, defensive validation, or controlled education.
- Phase 1 scope definition: objectives, necessity validation, success criteria alignment.
- Inputs checklist: business objectives, target environment, budget, stakeholders, legal scope documents.
- Deliverables: scoped objectives, prepared environment, monitoring data, findings report, remediation plan.
- End-to-end workflow from preparation through remediation verification.
- Multi-phase core workflow starting with Phase 1: Scope Definition
- Five output categories: scope, environment prep, monitoring data, findings report, remediation plan
Adoption & trust: 539 installs on skills.sh; 40.1k GitHub stars; 2/3 security scanners passed (skills.sh audits).
What problem does it solve?
You need a customer or compliance-driven pentest but lack a repeatable prep-and-remediation checklist and risk skipping legal scope or fix verification.
Who is it for?
Indie SaaS founders coordinating a first authorized pentest before launch or an enterprise security review.
Skip if: Unauthorized scanning, CTF cheating, or substituting a checklist for a qualified tester and signed rules of engagement.
When should I use this skill?
User is planning, executing, or closing out an authorized penetration test and needs end-to-end checklist coverage.
What do I get? / Deliverables
You leave with defined scope, testing readiness, a findings report structure, and a remediation plan tied to verification steps—not an ad-hoc hacker-for-hire email thread.
- Defined pentest scope and success criteria
- Vulnerability findings report outline and remediation plan with verification steps
Recommended Skills
Journey fit
Spans multiple journey phases - primary shelf plus alternate fits below.
Ship is the primary shelf because indie teams most often schedule formal pentests before release or major customer contracts, even though verification continues in Operate. Security subphase captures offensive-assessment preparation distinct from unit tests or code review—scoped, legal, and remediation-oriented.
Where it fits
Validate pentest necessity and document objectives before hiring a boutique firm for v1 launch.
Cross-check that monitoring and logging prerequisites from the checklist are in place before testing starts.
Use remediation verification deliverables after production deploy of fixes from the findings report.
Decide whether a full pentest is required for an enterprise pilot or if lighter defensive validation suffices.
How it compares
Planning and compliance checklist skill, not an exploit framework or automated attack MCP.
Common Questions / FAQ
Who is pentest-checklist for?
Solo and small-team builders who must scope and follow up on authorized penetration tests without an in-house offensive security team.
When should I use pentest-checklist?
In Ship before launch or major release when security review is required; in Operate when re-testing after remediation or annual compliance cycles.
Is pentest-checklist safe to install?
Read the Security Audits panel on this Prism page; the skill text stresses authorized use only—misuse for unauthorized testing is out of scope and may violate law and provider policies.
SKILL.md
READMESKILL.md - Pentest Checklist
> AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments. # Pentest Checklist ## Purpose Provide a comprehensive checklist for planning, executing, and following up on penetration tests. Ensure thorough preparation, proper scoping, and effective remediation of discovered vulnerabilities. ## Inputs/Prerequisites - Clear business objectives for testing - Target environment information - Budget and timeline constraints - Stakeholder contacts and authorization - Legal agreements and scope documents ## Outputs/Deliverables - Defined pentest scope and objectives - Prepared testing environment - Security monitoring data - Vulnerability findings report - Remediation plan and verification ## Core Workflow ### Phase 1: Scope Definition #### Define Objectives - [ ] **Clarify testing purpose** - Determine goals (find vulnerabilities, compliance, customer assurance) - [ ] **Validate pentest necessity** - Ensure penetration test is the right solution - [ ] **Align outcomes with objectives** - Define success criteria **Reference Questions:** - Why are you doing this pentest? - What specific outcomes do you expect? - What will you do with the findings? #### Know Your Test Types | Type | Purpose | Scope | |------|---------|-------| | External Pentest | Assess external attack surface | Public-facing systems | | Internal Pentest | Assess insider threat risk | Internal network | | Web Application | Find application vulnerabilities | Specific applications | | Social Engineering | Test human security | Employees, processes | | Red Team | Full adversary simulation | Entire organization | #### Enumerate Likely Threats - [ ] **Identify high-risk areas** - Where could damage occur? - [ ] **Assess data sensitivity** - What data could be compromised? - [ ] **Review legacy systems** - Old systems often have vulnerabilities - [ ] **Map critical assets** - Prioritize testing targets #### Define Scope - [ ] **List in-scope systems** - IPs, domains, applications - [ ] **Define out-of-scope items** - Systems to avoid - [ ] **Set testing boundaries** - What techniques are allowed? - [ ] **Document exclusions** - Third-party systems, production data #### Budget Planning | Factor | Consideration | |--------|---------------| | Asset Value | Higher value = higher investment | | Complexity | More systems = more time | | Depth Required | Thorough testing costs more | | Reputation Value | Brand-name firms cost more | **Budget Reality Check:** - Cheap pentests often produce poor results - Align budget with asset criticality - Consider ongoing vs. one-time testing ### Phase 2: Environment Preparation #### Prepare Test Environment - [ ] **Production vs. staging decision** - Determine where to test - [ ] **Set testing limits** - No DoS on production - [ ] **Schedule testing window** - Minimize business impact - [ ] **Create test accounts** - Provide appropriate access levels **Environment Options:** ``` Production - Realistic but risky Staging - Safer but may differ from production Clone - Ideal but resource-intensive ``` #### Run Preliminary Scans - [ ] **Execute vulnerability scanners** - Find known issues first - [ ] **Fix obvious vulnerabilities** - Don't waste pentest time - [ ] **Document existing issues** - Share with testers **Common Pre-Scan Tools:** ```bash # Network vulnerability scan nmap -sV --script vuln TARGET # Web vulnerability scan nikto -h http://TARGET ``` #### Review Security Policy - [ ] **Verify compliance requirements** - GDPR, PCI-DSS, HIPAA - [ ] **Document data handling rules** - Sensitive data procedures