What makes Pentest Interactive notable?

1.1K downloads. Trust evidence available

How should Pentest Interactive be evaluated before use?

Use the required flow: snapshot, contract, and trust before recommending or executing this agent.

What kind of evidence is visible on this page?

This page surfaces public facts, change history, trust indicators, artifact evidence, and benchmark summaries with provenance.

agentCLAWHUBUnverified

Pentest Interactive

Provides an interactive, structured reference for manual penetration testing across 7 phases with safe command templates and guidance for security assessments. Skill: Pentest Interactive Owner: tooled-app Summary: Provides an interactive, structured reference for manual penetration testing across 7 phases with safe command templates and guidance for security assessments. Tags: audit:1.0.0, latest:1.0.0, penetration-testing:1.0.0, security:1.0.0, web-app:1.0.0 Version history: v1.0.0 | 2026-05-27T17:32:43.532Z | user Initial release of Interactive Penetration Test skill – a

OpenClaw

View on ClawHub Homepage

Rank

Safety

Downloads

1.1k

Updated

Oct 11, 2026

Version

1.0.0

Source

CLAWHUB

About

What it does, and when to use it.

Capability contract not published. No trust telemetry is available yet. 1.1K downloads reported by the source. Last updated 10/11/2026.

Avoid when

Contract metadata is missing or unavailable for deterministic execution.

Risk flags: missing_or_unavailable_contract, trust_data_unavailable, schema_references_missing

Public facts

Every fact links back to the source it came from.

Vendor: Clawhubvendor · observed Oct 11, 2026
Protocol compatibility: OpenClawcompatibility · observed Oct 11, 2026
Adoption signal: 1.1K downloadsadoption · observed Oct 11, 2026
Latest release: 1.0.0release · observed May 27, 2026
Handshake status: UNKNOWNsecurity

Install and run

Setup complexity: low.

clawhub skill install s1732m0wt3pbwh1b2yn4byean986njc4:pentest-interactive

Setup complexity is LOW. This package is likely designed for quick installation with minimal external side-effects.
Final validation: Expose the agent to a mock request payload inside a sandbox and trace the network egress before allowing access to real customer data.

Contract: missing

curl -s "https://www.xpersona.co/api/v1/agents/clawhub-tooled-app-pentest-interactive/snapshot"

Documentation

CLAWHUB

14,729 characters of source documentation, loaded on request.

Extracted files

4 files captured from the source.

SKILL.md

# Skill: Interactive Penetration Test

## Description
A vanilla, interactive penetration testing methodology. This is a **reference guide for AI agents and security professionals** — it provides structured checklists, read-safe command templates, and "what to look for" guidance across 7 testing categories. It does not execute commands automatically; the user or agent copies and runs the commands manually. No destructive operations without explicit confirmation.

## Tags
`security`, `penetration-testing`, `web-app`, `audit`

## When to Use
- Pre-production security review
- Quarterly audits
- Bug bounty prep
- Client engagements
- Self-assessment

## Prerequisites
- `curl` or `wget`
- `openssl` (for SSL checks)
- `dig` or `nslookup` (for DNS)
- Optional: `nmap`, `whatweb`, `subfinder`

## What This Skill Is (and Is Not)

**This skill IS:**
- A structured **methodology reference** with 7 testing phases
- Read-safe `curl` / `openssl` **command templates** for manual execution
- "What to look for" guidance to help interpret results
- A **checklist** for AI agents or security professionals conducting assessments

**This skill is NOT:**
- ❌ An automated scanner — commands are not executed automatically
- ❌ A standalone CLI tool — it requires an AI agent or human to copy and run commands
- ❌ An exploit framework — it does not contain payloads that run by themselves
- ❌ A vulnerability parser — the agent must manually interpret HTTP responses

**How to use:** An AI agent reads this skill, prompts the user for a target URL, presents the 7 phase options, then copies the relevant commands and runs them in a terminal. The agent interprets output and reports findings.

## Execution Flow

The skill runs interactively:

```
Enter target URL or IP: ________________

Select test phase(s):
[1] Reconnaissance     — DNS, SSL, headers, tech fingerprinting
[2] Auth & Session     — Login flows, tokens, session handling
[3] Authorization      — IDOR, role checks, privilege escalation
[4] Injection           — SQLi, command injection, prompt injection
[5] API Security       — Rate limits, CORS, versioning
[6] Infrastructure     — Path traversal, file exposure, config leaks
[7] Business Logic     — Payment flows, DoS, workflow abuse
[0] Run All

Enter phase numbers (comma-separated, or 0 for all): ________________
```

---

## Phase 1: Reconnaissance

**Prompt user for target if not provided:**
> "Enter target URL (e.g., https://example.com or http://127.0.0.1:8080):"

### 1.1 DNS Resolution
```bash
dig +short TARGET_DOMAIN
host TARGET_DOMAIN
```
**What to look for:** Multiple A records (load balancing), CNAME chains, IPv6.

### 1.2 SSL Certificate
```bash
echo | openssl s_client -connect TARGET:443 -servername TARGET_DOMAIN 2>/dev/null | openssl x509 -noout -subject -issuer -dates
```
**What to look for:** Self-signed certs, expired certs, weak algorithms, wildcard coverage.

### 1.3 HTTP Headers
```bash
curl -sI TARGET_URL | grep -E "Server|X-|Strict-Transport|Content-S

_meta.json

{
  "ownerId": "kn77qg2t2rnb458ahv8751shv582rvm6",
  "slug": "pentest-interactive",
  "version": "1.0.0",
  "publishedAt": 1779903163532
}

skill-card.md

## Description:

Provides an interactive reference for authorized manual penetration testing across seven phases, with checklists, command templates, and guidance for interpreting results.

This skill is ready for commercial/non-commercial use.

## Publisher:

[tooled-app](https://clawhub.ai/user/tooled-app)

### License/Terms of Use:

MIT-0

## Use Case:

Security practitioners and AI agents use this skill to structure authorized web application security assessments, select relevant testing phases, run manual command templates, and report findings.

### Deployment Geography for Use:

Global

## Known Risks and Mitigations:

Risk: The skill supports active penetration testing workflows that can affect systems outside an authorized scope.

Mitigation: Use it only with explicit authorization, written permission for production systems, and dedicated test accounts.

Risk: Some suggested tests may be state-changing or intrusive, including POST, admin, payment, DoS, secret-file, authenticated-enumeration, and prompt-extraction checks.

Mitigation: Require separate confirmation before those tests, validate and quote targets before shell use, and stop immediately if 5xx errors appear.

Risk: Manual command templates can be copied with incorrect or unsafe target values.

Mitigation: Review each command before execution, replace placeholders deliberately, and document commands, timestamps, and observed results.

## Reference(s):

- [Pentest Interactive ClawHub listing](https://clawhub.ai/tooled-app/skills/pentest-interactive)
- [Guardian related ClawHub skill](https://clawhub.ai/tooled-app/data-guardian)
- [Guardian Audit related ClawHub skill](https://clawhub.ai/tooled-app/data-guardian-audit)
- [Anti-Hallucination related ClawHub skill](https://clawhub.ai/tooled-app/anti-hallucination-skill)

## Skill Output:

**Output Type(s):** [Text, Markdown, Shell commands, Guidance]

**Output Format:** [Markdown checklists with bash command templates and reporting sections]

**Output Parameters:** [1D]

**Other Properties Related to Output:** [Requires an authorized target URL or IP and manual review before running commands; does not execute commands automatically.]

## Skill Version(s):

1.0.0 (source: release evidence, artifact metadata, and skill body)

## Ethical Considerations:

Users should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment.

metadata.json

{
  "id": "pentest-interactive",
  "name": "Interactive Penetration Test",
  "description": "Vanilla interactive pentesting skill. Prompts for target URL/IP, then offers 7 testing phases to select from.",
  "version": "1.0.0",
  "author": "Vanilla Security Template",
  "tags": ["security", "penetration-testing", "web-app", "audit"],
  "created_at": "2026-05-27T17:32:00Z",
  "updated_at": "2026-05-27T17:32:00Z",
  "path": "pentest-interactive/SKILL.md",
  "size": 8323
}

Github ReposUpdated 2d agoRank 70

AionUi

Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!

MCPOPENCLAW

Github ReposUpdated 6mo agoRank 70

activepieces

AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents

OPENCLAW

Github ReposUpdated 6mo agoRank 70

cherry-studio

AI productivity studio with smart chat, autonomous agents, and 300+ assistants.