Penetration Testing Planner
Generate structured penetration testing plans aligned with OWASP methodology
by myriadprotocolConsulting & Professional ServicesTechnology ConsultingCybersecurity ConsultantPen TestingWhat You Can Do
You can generate formal penetration testing plans that transform vague security testing requests into actionable documents. The skill defines clear scope boundaries, maps test cases to OWASP Top 10 and industry frameworks, recommends appropriate tools and methodologies, and specifies deliverable formats—ensuring consistent, defensible testing approaches that stakeholders and development teams can understand and act on.
Features
Establish in/out of scope targets, testing windows, constraints, and business objectives
Generate specific attack vectors mapped to OWASP Top 10, CVSS scoring, and industry standards
Recommend tools, techniques, and testing phases (reconnaissance, scanning, exploitation, reporting)
Tailor plans to PCI-DSS, HIPAA, SOC 2, and other compliance requirements
Define proof-of-concept requirements, remediation timelines, and report structure
Map test cases to identified threats and business risks
Create sign-off templates and risk-rating frameworks for non-technical audiences
Example Output
Example 1: Web Application Penetration Test Plan
Scope: E-commerce platform (web UI, REST API, authentication system)
Out of Scope: Third-party payment processors, legacy batch systems
Test Window: 2 weeks, off-peak hours (11 PM–6 AM EST)
Phase 1: Reconnaissance & Enumeration
- Identify entry points, tech stack, API endpoints
- Tools: Burp Suite, OWASP ZAP
Phase 2: Vulnerability Testing
- OWASP A01:2021 Broken Access Control → Test privilege escalation, horizontal/vertical access
- OWASP A03:2021 Injection → SQL/NoSQL/LDAP injection payloads
- OWASP A07:2021 Cross-Site Scripting → Stored/reflected XSS vectors
Deliverables: Executive summary, detailed findings (CVSS scored), remediation roadmap, raw evidence (screenshots, logs, payloads)
Example 2: API Security Test Plan
Target: RESTful GraphQL API (v2.1)
Test Focus: Authentication bypass, rate limiting, data exposure, business logic flaws
Test Cases:
- Missing authentication on /admin endpoints
- JWT token manipulation and expiration bypass
- GraphQL query depth exploitation (DoS)
- Unauthorized cross-tenant data access
Expected Output: API security report with exploit proof-of-concepts and remediation priority matrix
What's Included
- penetration-testing-planner.md: Core skill instructions and prompt templates
- Penetration Test Plan Template: Structured markdown outline with scope, methodology, and deliverable sections
- OWASP Test Case Checklist: Pre-built mapping of OWASP Top 10 to specific test cases and tools
- Scope Definition Worksheet: Questions to clarify in/out of scope, stakeholder requirements, and regulatory drivers
- Risk Rating & Remediation Matrix: CVSS scoring framework and prioritization for reporting
Who It's For
- Security Engineers & Penetration Testers — Structure engagements and ensure consistent, defensible methodologies
- QA/Test Engineers — Plan security-focused test phases alongside functional testing
- Security Consultants — Generate formal scope documents and statements of work for client sign-off
- AppSec & DevSecOps Leads — Define internal security testing programs aligned with compliance requirements
- Development Managers — Understand what's being tested, why, and what remediation looks like
Best For
- Planning new penetration test engagements for web applications or APIs
- Defining scope and methodology for regulatory compliance assessments (PCI-DSS, HIPAA, SOC 2)
- Creating actionable test plans from high-level security requirements
- Documenting testing rationale and evidence requirements for stakeholder sign-off
- Standardizing penetration testing approaches across internal security teams or consulting practices
You might also like
Analyze Solidity and other smart contract code for security vulnerabilities, gas inefficiencies, and best practice violations. Get detailed reports with risk scoring, remediation suggestions, and optimization recommendations. Whether you're auditing before deployment or reviewing third-party contracts, this skill identifies critical issues faster than manual review.
You can systematically diagnose database performance bottlenecks by sharing your schema, slow query logs, and execution plans with Claude. It identifies root causes—missing indexes, inefficient joins, lock contention—and provides prioritized recommendations with ready-to-implement SQL. Skip the manual log analysis and get tuning strategies tailored to your workload.
This skill provides a structured approach to analyzing process problems, identifying root causes, and recommending capacity optimizations. You'll get clear bottleneck identification, data-driven recommendations, and a framework to validate whether your solutions actually work. Perfect for diagnosing why workflows are slow and finding the leverage points that matter most.
Use Claude to systematically analyze your database queries, execution plans, and schema to identify performance bottlenecks. The skill generates actionable optimization recommendations with SQL rewrites, index strategies, and configuration tuning. You'll receive detailed before-and-after performance analysis to validate improvements and prioritize work by impact.
You'll design and implement mobile features with architectural rigor, cross-platform considerations, and edge-case handling built-in. This skill generates complete system designs, platform-specific implementation strategies, performance optimization approaches, and testing frameworks. The output is production-ready guidance spanning iOS and Android with security, offline resilience, and deployment strategies included.
Design and optimize injectable formulations by analyzing your active pharmaceutical ingredient (API), selecting compatible excipients, and predicting stability outcomes. You'll receive systematic workflows that guide you through API characterization, formulation architecture, and risk mitigation—enabling faster development cycles and regulatory-ready documentation.
Claude analyzes your code diffs and generates standardized commit messages that follow the Conventional Commits specification. The skill automatically determines the correct commit type, scope, and description based on the changes you've made, ensuring your messages are parseable by automation tools while remaining human-readable for code reviewers.
You can architect multi-node ROS control systems from scratch, including node design patterns, communication flows, and real-time constraints. You'll debug complex node interactions using publisher/subscriber analysis, service call tracing, and action server diagnostics. You can optimize motion controllers through PID tuning, trajectory planning validation, and performance profiling to achieve precise, responsive robotic behavior.