Skip to main content

​
Penthera as an Agent Skill

Starter. For “can my coding agent run it for me?”

​
For your AI coding agent

Penthera ships as an Agent Skill, the open format used by Cursor, Claude Code, Claude.ai, and 40+ agent tools. The skill teaches an agent to run authorized scans, pick the right profile, and summarize findings, so you can describe what you want in plain words. Install (any of these):
Or as a Claude Code plugin (installs the skill):
For Claude.ai (web), zip and upload the skill:
The skill runs the CLI in your agent’s terminal. To give your agent typed, read-only tools instead, add the MCP server: see mcp.md. Prompts that trigger it:
  • “Scan my localhost app on port 3000 for security issues”
  • “Run a pre-deploy audit on staging.myapp.com and summarize critical findings”
  • “Scan this repo for hardcoded secrets and exposed API routes”
  • “Compare today’s scan to last week’s baseline and show only new findings”
  • “Generate a SARIF report for GitHub code scanning”
  • “Audit my MCP servers, skills and Claude Code hooks”
The skill adds an authorization gate: it instructs the agent to refuse targets you do not own or are not authorized to test, and the wizard asks you to confirm before scanning a remote host. It is an agent-level and interactive safeguard, not something the raw CLI enforces. You are responsible for every target you pass it. Run preflight from your project folder before the first scan. The script is in the skill’s own folder: ~/.claude/skills/penthera after npx skills add -g, or skills/penthera in a checkout.
Skill source and workflows live in skills/penthera/SKILL.md. Back to the README · All commands