soulofzephir-pi-skill-pentesting

内容来源：README.md（说明文档） · 原始地址 · 查看安装指南

原始内容

# 🛡️ Pi Skill - Pentesting & Security Check

> **Comprehensive security testing skill for Pi coding agent**

[![npm version](https://img.shields.io/npm/v/@soulofzephir/pi-skill-pentesting)](https://www.npmjs.com/package/@soulofzephir/pi-skill-pentesting)
[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![GitHub stars](https://img.shields.io/github/stars/soulofzephir/pi-skill-pentesting?style=social)](https://github.com/soulofzephir/pi-skill-pentesting)

---

## 👨‍💻 Author

### Rz | @soulofzephir

<a href="https://github.com/soulofzephir">
  <img src="https://img.shields.io/badge/GitHub-soulofzephir-181717?style=for-the-badge&logo=github" alt="GitHub"/>
</a>
<a href="https://www.npmjs.com/~soulofzephir">
  <img src="https://img.shields.io/badge/npm-soulofzephir-CB3837?style=for-the-badge&logo=npm" alt="npm"/>
</a>

Security enthusiast & automation lover. Building tools for ethical hacking and security assessment.

> *"Empowering developers to secure their applications with comprehensive testing tools."*

---

## 📋 Description

Comprehensive pentesting & security check skill for [Pi coding agent](https://pi.dev). Provides:

| Category | Coverage |
|----------|----------|
| 🔒 **Security Headers** | 9 critical headers analysis |
| 🔌 **Port Scanning** | 20+ common ports detection |
| 💉 **SQL Injection** | Union, Blind, Time-based testing |
| 🖥️ **XSS Testing** | Reflected, Stored, DOM-based |
| ⚡ **Command Injection** | Linux & Windows payloads |
| 📄 **XXE Testing** | XML injection detection |
| 📋 **OWASP Top 10** | Complete A01-A10 checklist |
| 🔐 **SSL/TLS Audit** | Certificate & cipher analysis |

---

## 🚀 Installation

### Option 1: npm (Recommended)

```bash
npm install -g @soulofzephir/pi-skill-pentesting
```

### Option 2: Manual

```bash
# Clone repository
git clone https://github.com/soulofzephir/pi-skill-pentesting.git

# Copy to Pi skills folder
cp -r skills/pentesting ~/.pi/agent/skills/
```

### Option 3: Git Submodule

```bash
# Add as submodule to your project
git submodule add https://github.com/soulofzephir/pi-skill-pentesting.git .pi/skills/pentesting
```

---

## 🎯 Quick Usage

### In Pi, simply type:

```
pentest https://example.com
```

### Or use specific commands:

```
/skill pentesting
security check https://example.com
test SQL injection di endpoint ini
scan headers untuk website saya
OWASP check
```

---

## 📁 Package Structure

```
@ soulofzephir/pi-skill-pentesting/
├── package.json              # NPM & Pi manifest
├── README.md                 # This file
├── LICENSE                   # MIT License
├── skills/
│   └── pentesting/
│       ├── SKILL.md          # Main skill file
│       ├── checklists/
│       │   ├── headers.md    # Security headers detail
│       │   ├── owasp.md      # OWASP Top 10
│       │   ├── ports.md      # Port scanning
│       │   └── injection.md  # All injection types
│       ├── tools/
│       │   ├── header-scan.sh       # Linux/Mac
│       │   ├── header-scan.ps1       # Windows
│       │   └── security-scan.ps1    # Windows All-in-One
│       └── reports/
│           └── template.md   # Report template
```

---

## 🔍 What This Skill Does

### 1️⃣ Security Headers Analysis
Checks 9 critical security headers:
- ✅ CSP (Content-Security-Policy)
- ✅ HSTS (Strict-Transport-Security)
- ✅ X-Content-Type-Options
- ✅ X-Frame-Options
- ✅ Referrer-Policy
- ✅ Permissions-Policy
- ✅ Cache-Control
- ✅ Server header
- ✅ X-Powered-By

### 2️⃣ Port Scanning
Detects open ports and high-risk services:
- Database ports (3306, 5432, 27017, 6379)
- Remote access (22, 3389)
- Web ports (80, 443, 8080)
- Dangerous exposed services (Docker 2375)

### 3️⃣ Injection Testing
Comprehensive payloads for:
- **SQL Injection** - Union, Blind, Time-based, Error-based
- **XSS** - Reflected, Stored, DOM, Polyglots
- **Command Injection** - Linux & Windows
- **XXE** - Basic, Blind, Billion Laughs
- **LDAP Injection** - Auth bypass
- **SSTI** - Jinja2, Twig, Handlebars

### 4️⃣ OWASP Top 10 Checklist
Complete testing for:
- A01: Broken Access Control
- A02: Cryptographic Failures
- A03: Injection
- A04: Insecure Design
- A05: Security Misconfiguration
- A06: Vulnerable Components
- A07: Authentication Failures
- A08: Software & Data Integrity
- A09: Security Logging
- A10: Server-Side Request Forgery (SSRF)

---

## 🛠️ Tools Included

### Automated Scripts

| Script | Platform | Description |
|--------|----------|-------------|
| `header-scan.sh` | Linux/Mac | Security headers scanner |
| `header-scan.ps1` | Windows | Security headers scanner |
| `security-scan.ps1` | Windows | **All-in-one scanner** |

### External Tools Recommended

```
Headers:    securityheaders.com, observatory.mozilla.org
Vuln Scan:  Nuclei, OWASP ZAP, Nikto
SSL/TLS:    testssl.sh, ssllabs.com
SQLi:       SQLMap
XSS:        Dalfox, XSStrike
Cmd Inj:    Commix
Ports:      Nmap, RustScan
```

---

## 📊 Output

### Header Security Score (0-100)
```
A (90-100): Excellent
B (70-89):  Good
C (50-69):  Needs Improvement
D (30-49):  Poor
F (0-29):   Critical
```

### Vulnerability Severity
```
🔴 CRITICAL   → Fix immediately
🟠 HIGH       → Fix within 1 week
🟡 MEDIUM     → Fix within 1 month
🟢 LOW/INFO   → Fix when possible
```

---

## ⚠️ Disclaimer

> **For authorized testing only!**
> 
> - ✅ Test your own websites
> - ✅ Test with written permission
> - ❌ **NEVER** test without authorization - it's ILLEGAL

---

## 🤝 Contributing

Contributions welcome! Feel free to submit issues and pull requests.

1. Fork the repository
2. Create your feature branch (`git checkout -b feature/AmazingFeature`)
3. Commit your changes (`git commit -m 'Add AmazingFeature'`)
4. Push to the branch (`git push origin feature/AmazingFeature`)
5. Open a Pull Request

---

## 📝 License

This project is licensed under the MIT License - see the [LICENSE](https://github.com/soulofzephir/pi-skill-pentesting/tree/HEAD/LICENSE) file for details.

---

## 🙏 Credits

Built with 💪 by **[Rz (@soulofzephir)](https://github.com/soulofzephir)**

Special thanks to:
- [Pi Coding Agent](https://pi.dev) - The coding harness
- [Agent Skills Standard](https://agentskills.io) - Skill specification

---

## ⭐ Show Your Support

If this skill helped you, give it a ⭐!

```bash
npm install -g @soulofzephir/pi-skill-pentesting
```

---

**Made with ❤️ by Rz | [@soulofzephir](https://github.com/soulofzephir) | [Report Issue](https://github.com/soulofzephir/pi-skill-pentesting/issues)**

🛡️ Pi Skill - Pentesting & Security Check

Comprehensive security testing skill for Pi coding agent

👨‍💻 Author

Rz | @soulofzephir

Security enthusiast & automation lover. Building tools for ethical hacking and security assessment.

"Empowering developers to secure their applications with comprehensive testing tools."

📋 Description

Comprehensive pentesting & security check skill for Pi coding agent. Provides:

Category	Coverage
🔒 Security Headers	9 critical headers analysis
🔌 Port Scanning	20+ common ports detection
💉 SQL Injection	Union, Blind, Time-based testing
🖥️ XSS Testing	Reflected, Stored, DOM-based
⚡ Command Injection	Linux & Windows payloads
📄 XXE Testing	XML injection detection
📋 OWASP Top 10	Complete A01-A10 checklist
🔐 SSL/TLS Audit	Certificate & cipher analysis

🚀 Installation

Option 1: npm (Recommended)

npm install -g @soulofzephir/pi-skill-pentesting

Option 2: Manual

# Clone repository
git clone https://github.com/soulofzephir/pi-skill-pentesting.git

# Copy to Pi skills folder
cp -r skills/pentesting ~/.pi/agent/skills/

Option 3: Git Submodule

# Add as submodule to your project
git submodule add https://github.com/soulofzephir/pi-skill-pentesting.git .pi/skills/pentesting

🎯 Quick Usage

In Pi, simply type:

pentest https://example.com

Or use specific commands:

/skill pentesting
security check https://example.com
test SQL injection di endpoint ini
scan headers untuk website saya
OWASP check

📁 Package Structure

@ soulofzephir/pi-skill-pentesting/
├── package.json              # NPM & Pi manifest
├── README.md                 # This file
├── LICENSE                   # MIT License
├── skills/
│   └── pentesting/
│       ├── SKILL.md          # Main skill file
│       ├── checklists/
│       │   ├── headers.md    # Security headers detail
│       │   ├── owasp.md      # OWASP Top 10
│       │   ├── ports.md      # Port scanning
│       │   └── injection.md  # All injection types
│       ├── tools/
│       │   ├── header-scan.sh       # Linux/Mac
│       │   ├── header-scan.ps1       # Windows
│       │   └── security-scan.ps1    # Windows All-in-One
│       └── reports/
│           └── template.md   # Report template

🔍 What This Skill Does

1️⃣ Security Headers Analysis

Checks 9 critical security headers:

✅ CSP (Content-Security-Policy)
✅ HSTS (Strict-Transport-Security)
✅ X-Content-Type-Options
✅ X-Frame-Options
✅ Referrer-Policy
✅ Permissions-Policy
✅ Cache-Control
✅ Server header
✅ X-Powered-By

2️⃣ Port Scanning

Detects open ports and high-risk services:

Database ports (3306, 5432, 27017, 6379)
Remote access (22, 3389)
Web ports (80, 443, 8080)
Dangerous exposed services (Docker 2375)

3️⃣ Injection Testing

Comprehensive payloads for:

SQL Injection - Union, Blind, Time-based, Error-based
XSS - Reflected, Stored, DOM, Polyglots
Command Injection - Linux & Windows
XXE - Basic, Blind, Billion Laughs
LDAP Injection - Auth bypass
SSTI - Jinja2, Twig, Handlebars

4️⃣ OWASP Top 10 Checklist

Complete testing for:

A01: Broken Access Control
A02: Cryptographic Failures
A03: Injection
A04: Insecure Design
A05: Security Misconfiguration
A06: Vulnerable Components
A07: Authentication Failures
A08: Software & Data Integrity
A09: Security Logging
A10: Server-Side Request Forgery (SSRF)

🛠️ Tools Included

Automated Scripts

Script	Platform	Description
`header-scan.sh`	Linux/Mac	Security headers scanner
`header-scan.ps1`	Windows	Security headers scanner
`security-scan.ps1`	Windows	All-in-one scanner

External Tools Recommended

Headers:    securityheaders.com, observatory.mozilla.org
Vuln Scan:  Nuclei, OWASP ZAP, Nikto
SSL/TLS:    testssl.sh, ssllabs.com
SQLi:       SQLMap
XSS:        Dalfox, XSStrike
Cmd Inj:    Commix
Ports:      Nmap, RustScan

📊 Output

Header Security Score (0-100)

A (90-100): Excellent
B (70-89):  Good
C (50-69):  Needs Improvement
D (30-49):  Poor
F (0-29):   Critical

Vulnerability Severity

🔴 CRITICAL   → Fix immediately
🟠 HIGH       → Fix within 1 week
🟡 MEDIUM     → Fix within 1 month
🟢 LOW/INFO   → Fix when possible

⚠️ Disclaimer

For authorized testing only!

✅ Test your own websites

✅ Test with written permission

❌ NEVER test without authorization - it's ILLEGAL

🤝 Contributing

Contributions welcome! Feel free to submit issues and pull requests.

Fork the repository
Create your feature branch (git checkout -b feature/AmazingFeature)
Commit your changes (git commit -m 'Add AmazingFeature')
Push to the branch (git push origin feature/AmazingFeature)
Open a Pull Request

📝 License

This project is licensed under the MIT License - see the LICENSE file for details.

🙏 Credits

Built with 💪 by Rz (@soulofzephir)

Special thanks to:

Pi Coding Agent - The coding harness
Agent Skills Standard - Skill specification

⭐ Show Your Support

If this skill helped you, give it a ⭐!

npm install -g @soulofzephir/pi-skill-pentesting

Made with ❤️ by Rz | @soulofzephir | Report Issue