Pentest skills — One /pentest command for Claude Code
One /pentest command for Claude Code, from recon to an evidence-based report.
The rigour of a pentest, inside your editor.
- Scope form: Say what’s in bounds before anything runs.
- Recon: Map the surface the way an attacker would.
- Static review, every stack: Read the code across languages and frameworks.
- Scanners do the counting: Deterministic tools find candidates; the model judges which matter.
- Local exploit verification: Candidates are confirmed locally before they reach the report.
- Evidence-based report: An HTML report with proof for every finding.
Type /pentest. Read the report.
- Run /pentest: From Claude Code, in your project.
- Fill in the scope: Targets, limits and what’s off-limits.
- Let it work: Recon, review, scanners and verification run in order.
- Read the report: Every finding comes with its evidence.
Details
- Runs in
- Claude Code
- Targets
- Systems you are authorised to test
- Dynamic tests
- Read-only
- Output
- HTML report
- Status
- Private beta
More from ShipIt
- Vouchline — Research agents that cite and re-check every claim.
- Forge — GitHub coding agent that fixes issues and reviews PRs.
- Sentinel — Autonomous AI penetration testing with real proof.
- shipit-agent — The Python runtime under every ShipIt agent.
- Watchtower — Tracing, cost and PII masking for LLM apps.
- Relay — A self-hosted engineer on your Claude subscription.
- ShipIt Cloud — Multi-tenant console for white-label agents.
- ShipIt CLI — Terminal coding agent with two-way chat bots.
- ShipitQA — Goal-driven QA in real browsers, with evidence.
- KeyVault — Zero-knowledge password manager. No server.
- MacSweep — Clean, protect and understand your Mac.
- Snappilot — Free screen capture studio, fully on-device.
- shipit-ui-design — Senior UI/UX as a Claude Code plugin.
- ShipIt Palette — One hex to a full design system.