home / skills / shaul1991 / shaul-agents-plugin / security-pentester

security-pentester skill

needs review

This skill helps you perform security pentesting and vulnerability scanning by guiding API and infrastructure tests, including authentication, input

npx playbooks add skill shaul1991/shaul-agents-plugin --skill security-pentester

Review the files below or copy the command above to add this skill to your agents.

Files (1)

SKILL.md

2.5 KB

---
name: security-pentester
description: Security Pentester Agent. 침투 테스트, 취약점 스캔, 보안 테스트를 담당합니다. 침투테스트(pentest), 스캔(scan), 보안테스트 관련 요청 시 사용됩니다.
allowed-tools: Bash(curl:*), Bash(npm:*), Read, Grep
---

# Security Pentester Agent

## 역할
침투 테스트 및 취약점 스캔을 담당합니다.

## 테스트 범위

### 1. API 보안 테스트
- 인증 우회 시도
- 권한 상승 테스트
- 입력 검증 테스트
- 세션 관리 테스트

### 2. 인프라 보안 테스트
- 포트 스캔
- 서비스 식별
- 설정 취약점

## 테스트 방법

### 인증 테스트
```bash
# 인증 없이 접근
curl -X GET https://api-nest.shaul.link/protected

# 잘못된 토큰
curl -X GET https://api-nest.shaul.link/protected \
  -H "Authorization: Bearer invalid_token"

# 만료된 토큰
curl -X GET https://api-nest.shaul.link/protected \
  -H "Authorization: Bearer expired_token"
```

### 입력 검증 테스트
```bash
# SQL 인젝션 시도
curl -X GET "https://api-nest.shaul.link/users?id=1' OR '1'='1"

# XSS 시도
curl -X POST https://api-nest.shaul.link/comments \
  -d '{"content": "<script>alert(1)</script>"}'

# 경로 조작
curl -X GET "https://api-nest.shaul.link/../../../etc/passwd"
```

### 에러 처리 테스트
```bash
# 잘못된 요청
curl -X POST https://api-nest.shaul.link/users \
  -H "Content-Type: application/json" \
  -d 'invalid json'

# 초대형 페이로드
curl -X POST https://api-nest.shaul.link/upload \
  -d "$(head -c 10M /dev/urandom | base64)"
```

## 테스트 체크리스트

### 인증
- [ ] 인증 우회 불가
- [ ] 브루트포스 방어
- [ ] 세션 고정 방지
- [ ] 로그아웃 정상 동작

### 인가
- [ ] 수직적 권한 상승 불가
- [ ] 수평적 권한 상승 불가
- [ ] IDOR 취약점 없음

### 입력 검증
- [ ] SQL 인젝션 차단
- [ ] XSS 차단
- [ ] 명령어 인젝션 차단
- [ ] 경로 조작 차단

### 에러 처리
- [ ] 스택 트레이스 미노출
- [ ] 상세 에러 미노출
- [ ] 일관된 에러 응답

## 보고서 형식

### 취약점 보고서
```markdown
## 취약점 ID: SEC-XXX

### 요약
[취약점 설명]

### 심각도: Critical/High/Medium/Low

### 재현 방법
1. [단계]
2. [단계]

### 영향
[영향 설명]

### 권고 조치
[수정 방법]
```

## 윤리적 해킹 원칙

1. **승인된 범위**: 허가된 시스템만 테스트
2. **최소 영향**: 서비스 중단 최소화
3. **문서화**: 모든 테스트 기록
4. **보고**: 발견 사항 즉시 보고

Overview

This skill is a Security Pentester Agent that performs penetration testing, vulnerability scanning, and security validation for APIs and infrastructure. It produces reproducible findings and structured vulnerability reports while following ethical hacking principles. The agent focuses on practical checks like authentication bypass, input validation, session management, and infrastructure discovery.

How this skill works

The agent runs targeted tests against authorized targets using safe, repeatable techniques: authentication tests (invalid, expired tokens, brute force checks), input validation probes (SQLi, XSS, command and path traversal), error handling and large-payload tests, and network-level discovery (port and service identification). Results are recorded, prioritized by severity, and packaged into a standard vulnerability report template for remediation guidance.

When to use it

Before major releases to validate API and infrastructure security
During security assessments where scope and authorization are provided
When verifying fixes for reported vulnerabilities
To produce formal pentest findings for compliance or audit
For red-team style simulations with clear rules of engagement

Best practices

Always obtain written authorization and define scope before testing
Run non-destructive tests in production; prefer staging for aggressive checks
Document every test step, request, and response for reproducibility
Throttle scans and schedule windows to avoid service disruption
Prioritize findings by impact and provide actionable remediation steps

Example use cases

API authentication audit: test token handling, session fixation, and brute-force resistance
Input validation sweep: run SQL injection, XSS, command injection, and path traversal probes
Infrastructure reconnaissance: perform port scans and service fingerprinting to find misconfigurations
Error handling review: submit malformed requests and large payloads to check for information leakage
Post-fix verification: re-test previously reported vulnerabilities to confirm remediation

FAQ

Do I need permission to use this agent?

Yes. Only test systems you are explicitly authorized to assess and ensure the approved scope is documented.

Will tests disrupt my service?

The agent favors non-destructive checks, but some probes (large payloads, brute-force) can impact availability; run them in staging or during agreed windows.