Agent Skills › zakirkun/deep-eye › pentest

pentest

GitHub

Deep Eye 授权渗透测试技能，涵盖范围确认、侦察、认证扫描及漏洞检测。支持 Web/API/移动等多场景，集成 AI 辅助与自动化报告生成，严格遵循合规与安全边界。

.agents/skills/pentest/SKILL.md zakirkun/deep-eye

Trigger Scenarios

执行渗透测试进行漏洞评估 Web/API/移动端安全扫描 OWASP 合规性检查

Install

npx skills add zakirkun/deep-eye --skill pentest -g -y

More Options

Non-standard path

npx skills add https://github.com/zakirkun/deep-eye/tree/main/.agents/skills/pentest -g -y

Use without installing

npx skills use zakirkun/deep-eye@pentest

指定 Agent (Claude Code)

npx skills add zakirkun/deep-eye --skill pentest -a claude-code -g -y

安装 repo 全部 skill

npx skills add zakirkun/deep-eye --all -g -y

预览 repo 内 skill

npx skills add zakirkun/deep-eye --list

SKILL.md

Frontmatter

{
    "name": "pentest",
    "description": "Authorized penetration testing with Deep Eye (this repo). Use for pentest, penetration test, vulnerability assessment, web\/API\/mobile scan, OWASP testing, \/pentest. Requires written authorization. Never scan unauthorized targets."
}

Deep Eye — Pentest Skill

Authorized offensive testing only. Work inside this repository’s tool surface.

Preconditions

Written RoE / scope (hosts, paths, time, credentials).
Config present: config/config.yaml (from example or wizard).
No secrets committed; use local config/config.yaml only.

Quick start

pip install -r requirements.txt
cp config/config.example.yaml config/config.yaml   # or:
python deep_eye.py --setup

python deep_eye.py -u https://TARGET -v --formats html,json
python deep_eye.py -u https://TARGET --scope-nl "only /api/* no /logout"
python deep_eye.py -u https://TARGET --retest-new reports/baseline.json

Workflow

1. Scope

CLI: --scope-nl "..." → utils/nl_scope.py → scope config.
YAML: scope.enabled, allowed_hosts, excluded_paths.

2. Recon

scanner.enable_recon: true
Modules: modules/reconnaissance/, optional OSINT (osint config).
OpenAPI seed: openapi.enabled + openapi.source.

3. Authenticated scan

Need	Config
Login macro	`login_replay.enabled`, `macro_path`
Multi-role	`auth_session.enabled`, `roles`
CAPTCHA skip	`captcha.enabled`, `skip_protected`
Challenge (CF)	`challenge_solver.enabled`

4. Checks to enable

Edit vulnerability_scanner.enabled_checks (not CLI). High-value packs:

Goal	Checks
Core inject	`sql_injection`, `xss`, `ssrf`, `lfi`, `rfi`, `ssti`, `command_injection`
Authz	`idor`, `api_bola_deep`, `jwt_deep`, `oauth_testing`
API	`api_security`, `graphql_deep`, `openapi` seed
Cloud	`ssrf_cloud`, `cloud_misconfig`
Client/WS	`cors_csp`, `websocket_deep`, `sse_injection`, `supply_chain_js`
Deep inject	`host_header_deep`, `crlf_header_inject_deep`, `hpp_pollution`, `ssti_engines`
Mobile	`mobile.enabled` + `frida_mobile`, `android_static`, `ios_plist`, `mobile_ssl_pinning`, `mobile_ai_chain`

Payloads: payload_generation.use_ai, cve_database, OAST via scanner.oast_callback_url.

5. Post-process

Order in engine: dedupe → FP replay → evidence → RAG → compliance → AI triage → bounty → report.

Feature	Config
Dedupe	`reporting.dedupe`
CVE enrich	`experimental.enable_cve_matching` (+ optional `cve_live_lookup`)
Triage	`ai_triage.enabled`
Bounty MD	`bug_bounty.enabled`
Templates	`templates.enabled`

6. Manual verify + report

Reproduce High/Critical with minimal request.
Report formats: reporting.formats / --formats html,json,sarif,junit,csv,xlsx.
Diff: python deep_eye.py --diff baseline.json current.json.

Code map

Task	Location
CLI	`deep_eye.py`
Lifecycle	`core/scanner_engine.py`
Checks	`core/vulnerability_scanner.py` + `modules/*`
Multi-surface inject	`core/injection_surfaces.py`
AI	`ai_providers/`, tool calling on OpenAI/Claude
Config truth	`config/config.example.yaml`

Rules

No unauthorized targets.
No destructive DoS unless RoE allows.
Redact secrets/PII in reports.

Output

## Pentest (Deep Eye)
- Target / scope:
- Config highlights:
- Commands run:
- Severity counts:
- Top findings (type → url → impact):
- Retest command: