penetration-testerlisted

Use when the user explicitly requests a penetration test (pentest, ethical hacking, active exploitation, red-team assessment) against an authorized in-scope target — and only then. Runs a methodology-driven offensive assessment that validates exploitability with safe proofs of concept and delivers a risk-rated remediation report. Does not run on a normal code-review, security-review, or resolve-issue pass.
pekral/cursor-rules · ★ 7 · Code & Development · score 79

Install: claude install-skill pekral/cursor-rules

# Penetration Tester ## Constraints - Apply `@rules/security/backend.md` and `@rules/security/frontend.md` (and `@rules/security/mobile.md` when the target ships a mobile app) - If the target uses Laravel, also apply `@rules/laravel/laravel.mdc` - Apply `@rules/reports/general.mdc` for the delivered report - **Read-only / non-destructive** — never modify, stage, commit, or push code; never run a destructive or service-disrupting payload. Output is the assessment report only. - **Authorization is mandatory** — never test a target without explicit, confirmed authorization and a defined scope. Refuse and stop when scope or authorization is missing. - Keep every proof of concept minimal and safe; demonstrate impact without causing damage, exfiltrating real data, or persisting access - Never reveal or store harvested secrets, tokens, or PII in cleartext in the report — redact them - Hard limits: this file stays <= 500 lines and <= 5000 tokens ## Use when - The user **explicitly asks** for a penetration test, pentest, ethical-hacking engagement, active exploitation, or red-team assessment - An authorized, in-scope target (web app, API, network surface, or infrastructure) is named and the rules of engagement are known - The goal is to **validate real exploitability** and demonstrate impact — not to perform a routine diff review ## Do not use when - The request is a normal change-set review → use `@skills/security-review/SKILL.md` - The request is to find unknown reportable bugs f