Skip to content
Get packs

Pentest Verification Rules

Enforces evidence-based verification so pentest findings are confirmed, tentative, or recorded as negative results.

Source Download skill
Repository
AIPentest/CyberStrikeAI
Stars
8,323
Licence
Apache-2.0
Files
1 file

What it does

This skill gives an AI agent a strict set of rules for security testing work. Search results and public exploit hints are not treated as vulnerabilities; a finding can only be marked confirmed when the agent has saved real evidence such as command output, HTTP responses, file contents, or callback records. Unverified ideas must be labelled tentative or left out, and failed tests are recorded so they are not repeated.

Great for

  • Security professionals running AI-assisted penetration tests who want fewer false positives
  • Red team members organizing project facts and findings in a shared record
  • Developers building or reviewing the CyberStrikeAI pentest workflow

Skip it if

  • General coding or web development, since it only applies to penetration testing records (not useful outside that context)
  • Testing systems you do not have written authorization to test, because the skill is designed to drive active exploitation work and gives no authorization check itself

Try asking

  • “Verify whether this exposed admin endpoint is actually exploitable and record the evidence before marking it confirmed”
  • “Log a negative result for the SQL injection test on the login form so it is not retried”
  • “Mark the vendor advisory lead as tentative until we reproduce it on the target”
  • “Review the findings list and flag any entries that lack supporting evidence”
Step-by-step guide: how to use Pentest Verification RulesInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the Apache-2.0 licence and an attribution note.

    pentest-verification.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip pentest-verification.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip pentest-verification.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Pair this skill with pentest-blackboard, since the SKILL.md defers tool alignment to it
  • Ask the agent to attach raw command output or HTTP responses as evidence for every confirmed fact
  • Review tentative items regularly so leads do not sit unresolved indefinitely

What's inside

  • SKILL.md

Redistributed unmodified from AIPentest/CyberStrikeAI under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.