# Pentest Checklist

Should be used when the user asks to "plan a penetration test", "create a security...

- Repository: https://github.com/zebbern/claude-code-guide (4691 stars)
- Category: Testing
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add zebbern/claude-code-guide --skill pentest-checklist -g -a claude-code -y`
Codex: `npx skills add zebbern/claude-code-guide --skill pentest-checklist -g -a codex -y`
Cursor: `npx skills add zebbern/claude-code-guide --skill pentest-checklist -g -a cursor -y`
Gemini CLI: `npx skills add zebbern/claude-code-guide --skill pentest-checklist -g -a gemini-cli -y`

## Description

This skill should be used when the user asks to "plan a penetration test", "create a security assessment checklist", "prepare for penetration testing", "define pentest scope", "follow security testing best practices", or needs a structured methodology for penetration testing engagements.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Pentest Checklist

## Purpose

Provide a comprehensive checklist for planning, executing, and following up on penetration tests. Ensure thorough preparation, proper scoping, and effective remediation of discovered vulnerabilities.

## Inputs/Prerequisites

- Clear business objectives for testing
- Target environment information
- Budget and timeline constraints
- Stakeholder contacts and authorization
- Legal agreements and scope documents

## Outputs/Deliverables

- Defined pentest scope and objectives
- Prepared testing environment
- Security monitoring data
- Vulnerability findings report
- Remediation plan and verification

## Core Workflow

### Phase 1: Scope Definition

#### Define Objectives

- [ ] **Clarify testing purpose** - Determine goals (find vulnerabilities, compliance, customer assurance)
- [ ] **Validate pentest necessity** - Ensure penetration test is the right solution
- [ ] **Align outcomes with objectives** - Define success criteria

**Reference Questions:**
- Why are you doing this pentest?
- What specific outcomes do you expect?
- What will you do with the findings?

#### Know Your Test Types

| Type | Purpose | Scope |
|------|---------|-------|
| External Pentest | Assess external attack surface | Public-facing systems |
| Internal Pentest | Assess insider threat risk | Internal network |
| Web Application | Find application vulnerabilities | Specific applications |
| Social Engineering | Test human security | Employees, processes |
| Red Team | Full adversary simulation | Entire organization |

#### Enumerate Likely Threats

- [ ] **Identify high-risk areas** - Where could damage occur?
- [ ] **Assess data sensitivity** - What data could be compromised?
- [ ] **Review legacy systems** - Old systems often have vulnerabilities
- [ ] **Map critical assets** - Prioritize testing targets

#### Define Scope

The rest: https://github.com/zebbern/claude-code-guide/blob/HEAD/skills/pentest-checklist/SKILL.md