# 🛡️ Pi Skill - Pentesting & Security Check
> **Comprehensive security testing skill for Pi coding agent**
[](https://www.npmjs.com/package/@soulofzephir/pi-skill-pentesting)
[](https://opensource.org/licenses/MIT)
[](https://github.com/soulofzephir/pi-skill-pentesting)
---
## 👨💻 Author
### Rz | @soulofzephir
Security enthusiast & automation lover. Building tools for ethical hacking and security assessment.
> *"Empowering developers to secure their applications with comprehensive testing tools."*
---
## 📋 Description
Comprehensive pentesting & security check skill for [Pi coding agent](https://pi.dev). Provides:
| Category | Coverage |
|----------|----------|
| 🔒 **Security Headers** | 9 critical headers analysis |
| 🔌 **Port Scanning** | 20+ common ports detection |
| 💉 **SQL Injection** | Union, Blind, Time-based testing |
| 🖥️ **XSS Testing** | Reflected, Stored, DOM-based |
| ⚡ **Command Injection** | Linux & Windows payloads |
| 📄 **XXE Testing** | XML injection detection |
| 📋 **OWASP Top 10** | Complete A01-A10 checklist |
| 🔐 **SSL/TLS Audit** | Certificate & cipher analysis |
---
## 🚀 Installation
### Option 1: npm (Recommended)
```bash
npm install -g @soulofzephir/pi-skill-pentesting
```
### Option 2: Manual
```bash
# Clone repository
git clone https://github.com/soulofzephir/pi-skill-pentesting.git
# Copy to Pi skills folder
cp -r skills/pentesting ~/.pi/agent/skills/
```
### Option 3: Git Submodule
```bash
# Add as submodule to your project
git submodule add https://github.com/soulofzephir/pi-skill-pentesting.git .pi/skills/pentesting
```
---
## 🎯 Quick Usage
### In Pi, simply type:
```
pentest https://example.com
```
### Or use specific commands:
```
/skill pentesting
security check https://example.com
test SQL injection di endpoint ini
scan headers untuk website saya
OWASP check
```
---
## 📁 Package Structure
```
@ soulofzephir/pi-skill-pentesting/
├── package.json # NPM & Pi manifest
├── README.md # This file
├── LICENSE # MIT License
├── skills/
│ └── pentesting/
│ ├── SKILL.md # Main skill file
│ ├── checklists/
│ │ ├── headers.md # Security headers detail
│ │ ├── owasp.md # OWASP Top 10
│ │ ├── ports.md # Port scanning
│ │ └── injection.md # All injection types
│ ├── tools/
│ │ ├── header-scan.sh # Linux/Mac
│ │ ├── header-scan.ps1 # Windows
│ │ └── security-scan.ps1 # Windows All-in-One
│ └── reports/
│ └── template.md # Report template
```
---
## 🔍 What This Skill Does
### 1️⃣ Security Headers Analysis
Checks 9 critical security headers:
- ✅ CSP (Content-Security-Policy)
- ✅ HSTS (Strict-Transport-Security)
- ✅ X-Content-Type-Options
- ✅ X-Frame-Options
- ✅ Referrer-Policy
- ✅ Permissions-Policy
- ✅ Cache-Control
- ✅ Server header
- ✅ X-Powered-By
### 2️⃣ Port Scanning
Detects open ports and high-risk services:
- Database ports (3306, 5432, 27017, 6379)
- Remote access (22, 3389)
- Web ports (80, 443, 8080)
- Dangerous exposed services (Docker 2375)
### 3️⃣ Injection Testing
Comprehensive payloads for:
- **SQL Injection** - Union, Blind, Time-based, Error-based
- **XSS** - Reflected, Stored, DOM, Polyglots
- **Command Injection** - Linux & Windows
- **XXE** - Basic, Blind, Billion Laughs
- **LDAP Injection** - Auth bypass
- **SSTI** - Jinja2, Twig, Handlebars
### 4️⃣ OWASP Top 10 Checklist
Complete testing for:
- A01: Broken Access Control
- A02: Cryptographic Failures
- A03: Injection
- A04: Insecure Design
- A05: Security Misconfiguration
- A06: Vulnerable Components
- A07: Authentication Failures
- A08: Software & Data Integrity
- A09: Security Logging
- A10: Server-Side Request Forgery (SSRF)
---
## 🛠️ Tools Included
### Automated Scripts
| Script | Platform | Description |
|--------|----------|-------------|
| `header-scan.sh` | Linux/Mac | Security headers scanner |
| `header-scan.ps1` | Windows | Security headers scanner |
| `security-scan.ps1` | Windows | **All-in-one scanner** |
### External Tools Recommended
```
Headers: securityheaders.com, observatory.mozilla.org
Vuln Scan: Nuclei, OWASP ZAP, Nikto
SSL/TLS: testssl.sh, ssllabs.com
SQLi: SQLMap
XSS: Dalfox, XSStrike
Cmd Inj: Commix
Ports: Nmap, RustScan
```
---
## 📊 Output
### Header Security Score (0-100)
```
A (90-100): Excellent
B (70-89): Good
C (50-69): Needs Improvement
D (30-49): Poor
F (0-29): Critical
```
### Vulnerability Severity
```
🔴 CRITICAL → Fix immediately
🟠 HIGH → Fix within 1 week
🟡 MEDIUM → Fix within 1 month
🟢 LOW/INFO → Fix when possible
```
---
## ⚠️ Disclaimer
> **For authorized testing only!**
>
> - ✅ Test your own websites
> - ✅ Test with written permission
> - ❌ **NEVER** test without authorization - it's ILLEGAL
---
## 🤝 Contributing
Contributions welcome! Feel free to submit issues and pull requests.
1. Fork the repository
2. Create your feature branch (`git checkout -b feature/AmazingFeature`)
3. Commit your changes (`git commit -m 'Add AmazingFeature'`)
4. Push to the branch (`git push origin feature/AmazingFeature`)
5. Open a Pull Request
---
## 📝 License
This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.
---
## 🙏 Credits
Built with 💪 by **[Rz (@soulofzephir)](https://github.com/soulofzephir)**
Special thanks to:
- [Pi Coding Agent](https://pi.dev) - The coding harness
- [Agent Skills Standard](https://agentskills.io) - Skill specification
---
## ⭐ Show Your Support
If this skill helped you, give it a ⭐!
```bash
npm install -g @soulofzephir/pi-skill-pentesting
```
---
**Made with ❤️ by Rz | [@soulofzephir](https://github.com/soulofzephir) | [Report Issue](https://github.com/soulofzephir/pi-skill-pentesting/issues)**