[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6R3ZFJ6BFSG7DG4PB9HXM7G":3,"skill-same:01M6R3ZFJ6BFSG7DG4PB9HXM7G":73},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":52,"commitSha":53,"skillDirectory":54,"forksCount":55,"repositoryHtmlUrl":56,"repositoryHomepageUrl":6,"ownerHtmlUrl":57,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":58,"install":59,"resources":72},"01M6R3ZFJ6BFSG7DG4PB9HXM7G","Pentest Checklist",null,"This skill should be used when the user asks to \"plan a penetration test\", \"create a security assessment checklist\", \"prepare for penetration testing\", \"define pentest scope\", \"follow security testing best practices\", or needs a structured methodology for penetration testing engagements.","Mishit18\u002Fclaude-code-templates","Mishit18","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F244127857?v=4","01M6QXBYKWM76HSKYDNWSKKE41","Mishit Sharma","01M6QXBYRJ0CAVM51S1RTEKTZZ",1,"MIT","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fpentest-checklist\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"checklist","pentest checklist","pentest","testing best practices","when","for","penetration","scope","define","Security Testing","security assessment","testing","plan","methodology","penetration testing","best practices","create","assessment","test","security","2026-11-10 10:12:30",false,"---\nname: Pentest Checklist\ndescription: This skill should be used when the user asks to \"plan a penetration test\", \"create a security assessment checklist\", \"prepare for penetration testing\", \"define pentest scope\", \"follow security testing best practices\", or needs a structured methodology for penetration testing engagements.\nmetadata:\n  author: zebbern\n  version: \"1.1\"\n---\n\n# Pentest Checklist\n\n## Purpose\n\nProvide a comprehensive checklist for planning, executing, and following up on penetration tests. Ensure thorough preparation, proper scoping, and effective remediation of discovered vulnerabilities.\n\n## Inputs\u002FPrerequisites\n\n- Clear business objectives for testing\n- Target environment information\n- Budget and timeline constraints\n- Stakeholder contacts and authorization\n- Legal agreements and scope documents\n\n## Outputs\u002FDeliverables\n\n- Defined pentest scope and objectives\n- Prepared testing environment\n- Security monitoring data\n- Vulnerability findings report\n- Remediation plan and verification\n\n## Core Workflow\n\n### Phase 1: Scope Definition\n\n#### Define Objectives\n\n- [ ] **Clarify testing purpose** - Determine goals (find vulnerabilities, compliance, customer assurance)\n- [ ] **Validate pentest necessity** - Ensure penetration test is the right solution\n- [ ] **Align outcomes with objectives** - Define success criteria\n\n**Reference Questions:**\n- Why are you doing this pentest?\n- What specific outcomes do you expect?\n- What will you do with the findings?\n\n#### Know Your Test Types\n\n| Type | Purpose | Scope |\n|------|---------|-------|\n| External Pentest | Assess external attack surface | Public-facing systems |\n| Internal Pentest | Assess insider threat risk | Internal network |\n| Web Application | Find application vulnerabilities | Specific applications |\n| Social Engineering | Test human security | Employees, processes |\n| Red Team | Full adversary simulation | Entire organization |\n\n#### Enumerate Likely Threats\n\n- [ ] **Identify high-risk areas** - Where could damage occur?\n- [ ] **Assess data sensitivity** - What data could be compromised?\n- [ ] **Review legacy systems** - Old systems often have vulnerabilities\n- [ ] **Map critical assets** - Prioritize testing targets\n\n#### Define Scope\n\n- [ ] **List in-scope systems** - IPs, domains, applications\n- [ ] **Define out-of-scope items** - Systems to avoid\n- [ ] **Set testing boundaries** - What techniques are allowed?\n- [ ] **Document exclusions** - Third-party systems, production data\n\n#### Budget Planning\n\n| Factor | Consideration |\n|--------|---------------|\n| Asset Value | Higher value = higher investment |\n| Complexity | More systems = more time |\n| Depth Required | Thorough testing costs more |\n| Reputation Value | Brand-name firms cost more |\n\n**Budget Reality Check:**\n- Cheap pentests often produce poor results\n- Align budget with asset criticality\n- Consider ongoing vs. one-time testing\n\n### Phase 2: Environment Preparation\n\n#### Prepare Test Environment\n\n- [ ] **Production vs. staging decision** - Determine where to test\n- [ ] **Set testing limits** - No DoS on production\n- [ ] **Schedule testing window** - Minimize business impact\n- [ ] **Create test accounts** - Provide appropriate access levels\n\n**Environment Options:**\n```\nProduction  - Realistic but risky\nStaging     - Safer but may differ from production\nClone       - Ideal but resource-intensive\n```\n\n#### Run Preliminary Scans\n\n- [ ] **Execute vulnerability scanners** - Find known issues first\n- [ ] **Fix obvious vulnerabilities** - Don't waste pentest time\n- [ ] **Document existing issues** - Share with testers\n\n**Common Pre-Scan Tools:**\n```bash\n# Network vulnerability scan\nnmap -sV --script vuln TARGET\n\n# Web vulnerability scan\nnikto -h http:\u002F\u002FTARGET\n```\n\n#### Review Security Policy\n\n- [ ] **Verify compliance requirements** - GDPR, PCI-DSS, HIPAA\n- [ ] **Document data handling rules** - Sensitive data procedures\n- [ ] **Confirm legal authorization** - Get written permission\n\n#### Notify Hosting Provider\n\n- [ ] **Check provider policies** - What testing is allowed?\n- [ ] **Submit authorization requests** - AWS, Azure, GCP requirements\n- [ ] **Document approvals** - Keep records\n\n**Cloud Provider Policies:**\n- AWS: https:\u002F\u002Faws.amazon.com\u002Fsecurity\u002Fpenetration-testing\u002F\n- Azure: https:\u002F\u002Fdocs.microsoft.com\u002Fsecurity\u002Fpentest\n- GCP: https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Foverview\n\n#### Freeze Developments\n\n- [ ] **Stop deployments during testing** - Maintain consistent environment\n- [ ] **Document current versions** - Record system states\n- [ ] **Avoid critical patches** - Unless security emergency\n\n### Phase 3: Expertise Selection\n\n#### Find Qualified Pentesters\n\n- [ ] **Seek recommendations** - Ask trusted sources\n- [ ] **Verify credentials** - OSCP, GPEN, CEH, CREST\n- [ ] **Check references** - Talk to previous clients\n- [ ] **Match expertise to scope** - Web, network, mobile specialists\n\n**Evaluation Criteria:**\n\n| Factor | Questions to Ask |\n|--------|------------------|\n| Experience | Years in field, similar projects |\n| Methodology | OWASP, PTES, custom approach |\n| Reporting | Sample reports, detail level |\n| Communication | Availability, update frequency |\n\n#### Define Methodology\n\n- [ ] **Select testing standard** - PTES, OWASP, NIST\n- [ ] **Determine access level** - Black box, gray box, white box\n- [ ] **Agree on techniques** - Manual vs. automated testing\n- [ ] **Set communication schedule** - Updates and escalation\n\n**Testing Approaches:**\n\n| Type | Access Level | Simulates |\n|------|-------------|-----------|\n| Black Box | No information | External attacker |\n| Gray Box | Partial access | Insider with limited access |\n| White Box | Full access | Insider\u002Fdetailed audit |\n\n#### Define Report Format\n\n- [ ] **Review sample reports** - Ensure quality meets needs\n- [ ] **Specify required sections** - Executive summary, technical details\n- [ ] **Request machine-readable output** - CSV, XML for tracking\n- [ ] **Agree on risk ratings** - CVSS, custom scale\n\n**Report Should Include:**\n- Executive summary for management\n- Technical findings with evidence\n- Risk ratings and prioritization\n- Remediation recommendations\n- Retesting guidance\n\n### Phase 4: Monitoring\n\n#### Implement Security Monitoring\n\n- [ ] **Deploy IDS\u002FIPS** - Intrusion detection systems\n- [ ] **Enable logging** - Comprehensive audit trails\n- [ ] **Configure SIEM** - Centralized log analysis\n- [ ] **Set up alerting** - Real-time notifications\n\n**Monitoring Tools:**\n```bash\n# Check security logs\ntail -f \u002Fvar\u002Flog\u002Fauth.log\ntail -f \u002Fvar\u002Flog\u002Fapache2\u002Faccess.log\n\n# Monitor network\ntcpdump -i eth0 -w capture.pcap\n```\n\n#### Configure Logging\n\n- [ ] **Centralize logs** - Aggregate from all systems\n- [ ] **Set retention periods** - Keep logs for analysis\n- [ ] **Enable detailed logging** - Application and system level\n- [ ] **Test log collection** - Verify all sources working\n\n**Key Logs to Monitor:**\n- Authentication events\n- Application errors\n- Network connections\n- File access\n- System changes\n\n#### Monitor Exception Tools\n\n- [ ] **Track error rates** - Unusual spikes indicate testing\n- [ ] **Brief operations team** - Distinguish testing from attacks\n- [ ] **Document baseline** - Normal vs. pentest activity\n\n#### Watch Security Tools\n\n- [ ] **Review IDS alerts** - Separate pentest from real attacks\n- [ ] **Monitor WAF logs** - Track blocked attempts\n- [ ] **Check endpoint protection** - Antivirus detections\n\n### Phase 5: Remediation\n\n#### Ensure Backups\n\n- [ ] **Verify backup integrity** - Test restoration\n- [ ] **Document recovery procedures** - Know how to restore\n- [ ] **Separate backup access** - Protect from testing\n\n#### Reserve Remediation Time\n\n- [ ] **Allocate team availability** - Post-pentest analysis\n- [ ] **Schedule fix implementation** - Address findings\n- [ ] **Plan verification testing** - Confirm fixes work\n\n#### Patch During Testing Policy\n\n- [ ] **Generally avoid patching** - Maintain consistent environment\n- [ ] **Exception for critical issues** - Security emergencies only\n- [ ] **Communicate changes** - Inform pentesters of any changes\n\n#### Cleanup Procedure\n\n- [ ] **Remove test artifacts** - Backdoors, scripts, files\n- [ ] **Delete test accounts** - Remove pentester access\n- [ ] **Restore configurations** - Return to original state\n- [ ] **Verify cleanup complete** - Audit all changes\n\n#### Schedule Next Pentest\n\n- [ ] **Determine frequency** - Annual, quarterly, after changes\n- [ ] **Consider continuous testing** - Bug bounty, ongoing assessments\n- [ ] **Budget for future tests** - Plan ahead\n\n**Testing Frequency Factors:**\n- Release frequency\n- Regulatory requirements\n- Risk tolerance\n- Past findings severity\n\n## Quick Reference\n\n### Pre-Pentest Checklist\n\n```\n□ Scope defined and documented\n□ Authorization obtained\n□ Environment prepared\n□ Hosting provider notified\n□ Team briefed\n□ Monitoring enabled\n□ Backups verified\n```\n\n### Post-Pentest Checklist\n\n```\n□ Report received and reviewed\n□ Findings prioritized\n□ Remediation assigned\n□ Fixes implemented\n□ Verification testing scheduled\n□ Environment cleaned up\n□ Next test scheduled\n```\n\n## Constraints\n\n- Production testing carries inherent risks\n- Budget limitations affect thoroughness\n- Time constraints may limit coverage\n- Tester expertise varies significantly\n- Findings become stale quickly\n\n## Examples\n\n### Example 1: Quick Scope Definition\n\n```markdown\n**Target:** Corporate web application (app.company.com)\n**Type:** Gray box web application pentest\n**Duration:** 5 business days\n**Excluded:** DoS testing, production database access\n**Access:** Standard user account provided\n```\n\n### Example 2: Monitoring Setup\n\n```bash\n# Enable comprehensive logging\nsudo systemctl restart rsyslog\nsudo systemctl restart auditd\n\n# Start packet capture\ntcpdump -i eth0 -w \u002Ftmp\u002Fpentest_capture.pcap &\n```\n\n## Troubleshooting\n\n| Issue | Solution |\n|-------|----------|\n| Scope creep | Document and require change approval |\n| Testing impacts production | Schedule off-hours, use staging |\n| Findings disputed | Provide detailed evidence, retest |\n| Remediation delayed | Prioritize by risk, set deadlines |\n| Budget exceeded | Define clear scope, fixed-price contracts |\n\n","# Pentest Checklist\n\n## Purpose\n\nProvide a comprehensive checklist for planning, executing, and following up on penetration tests. Ensure thorough preparation, proper scoping, and effective remediation of discovered vulnerabilities.\n\n## Inputs\u002FPrerequisites\n\n- Clear business objectives for testing\n- Target environment information\n- Budget and timeline constraints\n- Stakeholder contacts and authorization\n- Legal agreements and scope documents\n\n## Outputs\u002FDeliverables\n\n- Defined pentest scope and objectives\n- Prepared testing environment\n- Security monitoring data\n- Vulnerability findings report\n- Remediation plan and verification\n\n## Core Workflow\n\n### Phase 1: Scope Definition\n\n#### Define Objectives\n\n- [ ] **Clarify testing purpose** - Determine goals (find vulnerabilities, compliance, customer assurance)\n- [ ] **Validate pentest necessity** - Ensure penetration test is the right solution\n- [ ] **Align outcomes with objectives** - Define success criteria\n\n**Reference Questions:**\n- Why are you doing this pentest?\n- What specific outcomes do you expect?\n- What will you do with the findings?\n\n#### Know Your Test Types\n\n| Type | Purpose | Scope |\n|------|---------|-------|\n| External Pentest | Assess external attack surface | Public-facing systems |\n| Internal Pentest | Assess insider threat risk | Internal network |\n| Web Application | Find application vulnerabilities | Specific applications |\n| Social Engineering | Test human security | Employees, processes |\n| Red Team | Full adversary simulation | Entire organization |\n\n#### Enumerate Likely Threats\n\n- [ ] **Identify high-risk areas** - Where could damage occur?\n- [ ] **Assess data sensitivity** - What data could be compromised?\n- [ ] **Review legacy systems** - Old systems often have vulnerabilities\n- [ ] **Map critical assets** - Prioritize testing targets\n\n#### Define Scope\n\n- [ ] **List in-scope systems** - IPs, domains, applications\n- [ ] **Define out-of-scope items** - Systems to avoid\n- [ ] **Set testing boundaries** - What techniques are allowed?\n- [ ] **Document exclusions** - Third-party systems, production data\n\n#### Budget Planning\n\n| Factor | Consideration |\n|--------|---------------|\n| Asset Value | Higher value = higher investment |\n| Complexity | More systems = more time |\n| Depth Required | Thorough testing costs more |\n| Reputation Value | Brand-name firms cost more |\n\n**Budget Reality Check:**\n- Cheap pentests often produce poor results\n- Align budget with asset criticality\n- Consider ongoing vs. one-time testing\n\n### Phase 2: Environment Preparation\n\n#### Prepare Test Environment\n\n- [ ] **Production vs. staging decision** - Determine where to test\n- [ ] **Set testing limits** - No DoS on production\n- [ ] **Schedule testing window** - Minimize business impact\n- [ ] **Create test accounts** - Provide appropriate access levels\n\n**Environment Options:**\n```\nProduction  - Realistic but risky\nStaging     - Safer but may differ from production\nClone       - Ideal but resource-intensive\n```\n\n#### Run Preliminary Scans\n\n- [ ] **Execute vulnerability scanners** - Find known issues first\n- [ ] **Fix obvious vulnerabilities** - Don't waste pentest time\n- [ ] **Document existing issues** - Share with testers\n\n**Common Pre-Scan Tools:**\n```bash\n# Network vulnerability scan\nnmap -sV --script vuln TARGET\n\n# Web vulnerability scan\nnikto -h http:\u002F\u002FTARGET\n```\n\n#### Review Security Policy\n\n- [ ] **Verify compliance requirements** - GDPR, PCI-DSS, HIPAA\n- [ ] **Document data handling rules** - Sensitive data procedures\n- [ ] **Confirm legal authorization** - Get written permission\n\n#### Notify Hosting Provider\n\n- [ ] **Check provider policies** - What testing is allowed?\n- [ ] **Submit authorization requests** - AWS, Azure, GCP requirements\n- [ ] **Document approvals** - Keep records\n\n**Cloud Provider Policies:**\n- AWS: https:\u002F\u002Faws.amazon.com\u002Fsecurity\u002Fpenetration-testing\u002F\n- Azure: https:\u002F\u002Fdocs.microsoft.com\u002Fsecurity\u002Fpentest\n- GCP: https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Foverview\n\n#### Freeze Developments\n\n- [ ] **Stop deployments during testing** - Maintain consistent environment\n- [ ] **Document current versions** - Record system states\n- [ ] **Avoid critical patches** - Unless security emergency\n\n### Phase 3: Expertise Selection\n\n#### Find Qualified Pentesters\n\n- [ ] **Seek recommendations** - Ask trusted sources\n- [ ] **Verify credentials** - OSCP, GPEN, CEH, CREST\n- [ ] **Check references** - Talk to previous clients\n- [ ] **Match expertise to scope** - Web, network, mobile specialists\n\n**Evaluation Criteria:**\n\n| Factor | Questions to Ask |\n|--------|------------------|\n| Experience | Years in field, similar projects |\n| Methodology | OWASP, PTES, custom approach |\n| Reporting | Sample reports, detail level |\n| Communication | Availability, update frequency |\n\n#### Define Methodology\n\n- [ ] **Select testing standard** - PTES, OWASP, NIST\n- [ ] **Determine access level** - Black box, gray box, white box\n- [ ] **Agree on techniques** - Manual vs. automated testing\n- [ ] **Set communication schedule** - Updates and escalation\n\n**Testing Approaches:**\n\n| Type | Access Level | Simulates |\n|------|-------------|-----------|\n| Black Box | No information | External attacker |\n| Gray Box | Partial access | Insider with limited access |\n| White Box | Full access | Insider\u002Fdetailed audit |\n\n#### Define Report Format\n\n- [ ] **Review sample reports** - Ensure quality meets needs\n- [ ] **Specify required sections** - Executive summary, technical details\n- [ ] **Request machine-readable output** - CSV, XML for tracking\n- [ ] **Agree on risk ratings** - CVSS, custom scale\n\n**Report Should Include:**\n- Executive summary for management\n- Technical findings with evidence\n- Risk ratings and prioritization\n- Remediation recommendations\n- Retesting guidance\n\n### Phase 4: Monitoring\n\n#### Implement Security Monitoring\n\n- [ ] **Deploy IDS\u002FIPS** - Intrusion detection systems\n- [ ] **Enable logging** - Comprehensive audit trails\n- [ ] **Configure SIEM** - Centralized log analysis\n- [ ] **Set up alerting** - Real-time notifications\n\n**Monitoring Tools:**\n```bash\n# Check security logs\ntail -f \u002Fvar\u002Flog\u002Fauth.log\ntail -f \u002Fvar\u002Flog\u002Fapache2\u002Faccess.log\n\n# Monitor network\ntcpdump -i eth0 -w capture.pcap\n```\n\n#### Configure Logging\n\n- [ ] **Centralize logs** - Aggregate from all systems\n- [ ] **Set retention periods** - Keep logs for analysis\n- [ ] **Enable detailed logging** - Application and system level\n- [ ] **Test log collection** - Verify all sources working\n\n**Key Logs to Monitor:**\n- Authentication events\n- Application errors\n- Network connections\n- File access\n- System changes\n\n#### Monitor Exception Tools\n\n- [ ] **Track error rates** - Unusual spikes indicate testing\n- [ ] **Brief operations team** - Distinguish testing from attacks\n- [ ] **Document baseline** - Normal vs. pentest activity\n\n#### Watch Security Tools\n\n- [ ] **Review IDS alerts** - Separate pentest from real attacks\n- [ ] **Monitor WAF logs** - Track blocked attempts\n- [ ] **Check endpoint protection** - Antivirus detections\n\n### Phase 5: Remediation\n\n#### Ensure Backups\n\n- [ ] **Verify backup integrity** - Test restoration\n- [ ] **Document recovery procedures** - Know how to restore\n- [ ] **Separate backup access** - Protect from testing\n\n#### Reserve Remediation Time\n\n- [ ] **Allocate team availability** - Post-pentest analysis\n- [ ] **Schedule fix implementation** - Address findings\n- [ ] **Plan verification testing** - Confirm fixes work\n\n#### Patch During Testing Policy\n\n- [ ] **Generally avoid patching** - Maintain consistent environment\n- [ ] **Exception for critical issues** - Security emergencies only\n- [ ] **Communicate changes** - Inform pentesters of any changes\n\n#### Cleanup Procedure\n\n- [ ] **Remove test artifacts** - Backdoors, scripts, files\n- [ ] **Delete test accounts** - Remove pentester access\n- [ ] **Restore configurations** - Return to original state\n- [ ] **Verify cleanup complete** - Audit all changes\n\n#### Schedule Next Pentest\n\n- [ ] **Determine frequency** - Annual, quarterly, after changes\n- [ ] **Consider continuous testing** - Bug bounty, ongoing assessments\n- [ ] **Budget for future tests** - Plan ahead\n\n**Testing Frequency Factors:**\n- Release frequency\n- Regulatory requirements\n- Risk tolerance\n- Past findings severity\n\n## Quick Reference\n\n### Pre-Pentest Checklist\n\n```\n□ Scope defined and documented\n□ Authorization obtained\n□ Environment prepared\n□ Hosting provider notified\n□ Team briefed\n□ Monitoring enabled\n□ Backups verified\n```\n\n### Post-Pentest Checklist\n\n```\n□ Report received and reviewed\n□ Findings prioritized\n□ Remediation assigned\n□ Fixes implemented\n□ Verification testing scheduled\n□ Environment cleaned up\n□ Next test scheduled\n```\n\n## Constraints\n\n- Production testing carries inherent risks\n- Budget limitations affect thoroughness\n- Time constraints may limit coverage\n- Tester expertise varies significantly\n- Findings become stale quickly\n\n## Examples\n\n### Example 1: Quick Scope Definition\n\n```markdown\n**Target:** Corporate web application (app.company.com)\n**Type:** Gray box web application pentest\n**Duration:** 5 business days\n**Excluded:** DoS testing, production database access\n**Access:** Standard user account provided\n```\n\n### Example 2: Monitoring Setup\n\n```bash\n# Enable comprehensive logging\nsudo systemctl restart rsyslog\nsudo systemctl restart auditd\n\n# Start packet capture\ntcpdump -i eth0 -w \u002Ftmp\u002Fpentest_capture.pcap &\n```\n\n## Troubleshooting\n\n| Issue | Solution |\n|-------|----------|\n| Scope creep | Document and require change approval |\n| Testing impacts production | Schedule off-hours, use staging |\n| Findings disputed | Provide detailed evidence, retest |\n| Remediation delayed | Prioritize by risk, set deadlines |\n| Budget exceeded | Define clear scope, fixed-price contracts |\n\n",{"name":5,"metadata":49,"description":7},{"author":50,"version":51},"zebbern","1.1","main","015422534a7457348a313b6381f0255d3364eb8c","cli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fpentest-checklist",0,"https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates","https:\u002F\u002Fgithub.com\u002FMishit18","2026-11-14 17:36:32",{"source":8,"skillName":5,"commands":60,"prompt":70,"zipAvailable":71},[61,64,67],{"tool":62,"command":63},"npx","npx skills add Mishit18\u002Fclaude-code-templates --skill \"Pentest Checklist\"",{"tool":65,"command":66},"bunx","bunx skills add Mishit18\u002Fclaude-code-templates --skill \"Pentest Checklist\"",{"tool":68,"command":69},"pnpm","pnpm dlx skills add Mishit18\u002Fclaude-code-templates --skill \"Pentest Checklist\"","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fpentest-checklist\u002FSKILL.md",true,[],[74,103,133,155,181,192],{"skillNo":75,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":79,"sourceHtmlUrl":80,"categories":81,"keywords":85,"publishedAt":102},"01M6R194Y2CS39V9VPAVRVW1ZV","skill-creation-guide","Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Claude's capabilities with specialized knowledge, workflows, or tool integrations.","Apache-2.0","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdevelopment\u002Fskill-creation-guide\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdevelopment\u002Fskill-creation-guide\u002FSKILL.md",[82],{"categoryNo":83,"categoryName":84,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[86,87,88,89,90,40,91,92,93,94,95,96,97,98,99,100,29,101,28],"skill creation guide","guide","creation","skill creation","workflows","update","capabilities","knowledge","tool","integrations","specialized","new skill","existing skill","users","with","Existing","2026-11-11 15:11:14",{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":107,"sourceHtmlUrl":108,"categories":109,"keywords":113,"publishedAt":44},"01M6R4ARN4W2VZRDERDTMN1KP0","web-artifacts-builder","Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn\u002Fui). Use for complex artifacts requiring state management, routing, or shadcn\u002Fui components - not for simple single-file HTML\u002FJSX artifacts.","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FSKILL.md",[110],{"categoryNo":111,"categoryName":112,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000009","前端开发",[114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,29,132],"web artifacts builder","web","artifacts","artifacts builder","builder","frontend","css","components","react","routing","state management","state","file","Tailwind","use","single-file","ui components","multi","single",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":137,"sourceHtmlUrl":138,"categories":139,"keywords":142,"publishedAt":44},"01M6R45GXREM5DP8T08MAC788H","webapp-testing","Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FSKILL.md",[140,141],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":111,"categoryName":112,"taxonomyType":21,"taxonomyTypeDesc":22},[35,143,144,119,145,146,115,147,148,149,150,151,152,153,154,100,29],"webapp testing","webapp","screenshots","playwright","debugging","toolkit","browser","ui","logs","applications","behavior","local",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":159,"sourceHtmlUrl":160,"categories":161,"keywords":162,"publishedAt":44},"01M6R2GYJ470X8EB7R58V0B68K","think-tank","Run a Virtual Think Tank — a structured multi-persona debate — before planning or making architectural\u002Fdesign\u002Fstrategic decisions. Use this skill whenever the user is about to plan a system, make a technology choice, evaluate trade-offs, decide on an approach, or faces any decision where multiple perspectives would sharpen the outcome. Also trigger when the user says \"think tank\", \"debate this\", \"perspectives on\", \"trade-offs\", \"should I use X or Y\", \"help me decide\", \"before we plan\", or asks for pros\u002Fcons of competing approaches. This skill should run BEFORE any implementation planning begins — it produces a structured analysis that feeds into better plans.","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fthink-tank\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fthink-tank\u002FSKILL.md",[],[163,164,165,166,167,168,169,36,170,171,172,173,174,175,176,177,178,179,180,28],"think tank","think","design","run","feeds","analysis","persona","sharpen","virtual","decision","choice","decide","perspectives","outcome","me","debate","make","trade-offs",{"skillNo":182,"name":183,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":184,"sourceHtmlUrl":185,"categories":186,"keywords":188,"publishedAt":44},"01M6R2FSR55AVRFA9YZ8SC2GZG","skill-creator","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fskill-creator\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fskill-creator\u002FSKILL.md",[187],{"categoryNo":83,"categoryName":84,"taxonomyType":21,"taxonomyTypeDesc":22},[189,190,90,40,91,92,93,94,95,96,87,97,98,99,100,29,101,28,191],"skill creator","creator","new",{"skillNo":193,"name":194,"nameZh":6,"description":195,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":196,"categories":197,"keywords":198,"publishedAt":44},"01M6R2FK42ZZ4HJTJVVK9WJBBP","ship-learn-next","Transform learning content (like YouTube transcripts, articles, tutorials) into actionable implementation plans using the Ship-Learn-Next framework. Use when user wants to turn advice, lessons, or educational content into concrete action steps, reps, or a learning quest.","https:\u002F\u002Fgithub.com\u002FMishit18\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fship-learn-next\u002FSKILL.md",[],[199,200,201,202,203,204,205,206,128,207,208,209,210,211,212,213,214,215,216,28],"learn","ship learn next","ship","next","framework","learning","read","write","advice","implementation","youtube","plans","quest","transform","actionable","action","lessons","youtube transcripts"]