@soulofzephir/pi-skill-pentesting 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Rz
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/PUBLISH.md

@@ -0,0 +1,97 @@
+# 🚀 Publish Instructions
+
+## Step 1: Create GitHub Repository
+
+### Option A: Web Browser (Recommended)
+
+1. Go to: **https://github.com/new**
+2. Fill in:
+   - **Repository name:** `pi-skill-pentesting`
+   - **Description:** `Comprehensive pentesting & security check skill for Pi coding agent`
+   - **Visibility:** Public
+   - **⚠️ DO NOT** check "Add a README file" (we already have one)
+3. Click **"Create repository"**
+
+### Option B: If you have `gh` CLI installed
+
+```bash
+gh auth login
+gh repo create pi-skill-pentesting --public --description "Pentesting skill for Pi"
+```
+
+---
+
+## Step 2: Push to GitHub
+
+After creating the repo on GitHub, run:
+
+```bash
+cd H:/belajar/test/pi-skill-pentesting
+git push -u origin main
+```
+
+---
+
+## Step 3: Publish to npm
+
+### First, login to npm:
+
+```bash
+npm login
+# Enter your npm username, email, and password
+# For 2FA: use OTP from your authenticator app
+```
+
+### Then publish:
+
+```bash
+npm publish --access public
+```
+
+> **⚠️ Note:** First time publish may need verification. Check your email!
+
+---
+
+## ✅ After Successful Publish
+
+Your package will be live at:
+- **GitHub:** https://github.com/soulofzephir/pi-skill-pentesting
+- **npm:** https://www.npmjs.com/package/@soulofzephir/pi-skill-pentesting
+
+---
+
+## 📥 Installation (After Publish)
+
+Anyone can now install with:
+
+```bash
+npm install -g @soulofzephir/pi-skill-pentesting
+```
+
+---
+
+## 🔄 Version Updates
+
+```bash
+# 1. Edit version in package.json
+# 2. Commit
+git add .
+git commit -m "v1.0.1"
+git push origin main
+git tag v1.0.1
+git push origin v1.0.1
+
+# 3. Publish
+npm publish
+```
+
+---
+
+## 📋 Quick Summary
+
+```
+GitHub:  https://github.com/soulofzephir/pi-skill-pentesting
+npm:     https://www.npmjs.com/package/@soulofzephir/pi-skill-pentesting
+```
+
+**Package ready to publish! 🎉**

package/README.md

@@ -0,0 +1,255 @@
+# 🛡️ Pi Skill - Pentesting & Security Check
+
+> **Comprehensive security testing skill for Pi coding agent**
+
+[![npm version](https://img.shields.io/npm/v/@soulofzephir/pi-skill-pentesting)](https://www.npmjs.com/package/@soulofzephir/pi-skill-pentesting)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+[![GitHub stars](https://img.shields.io/github/stars/soulofzephir/pi-skill-pentesting?style=social)](https://github.com/soulofzephir/pi-skill-pentesting)
+
+---
+
+## 👨‍💻 Author
+
+### Rz | @soulofzephir
+
+<a href="https://github.com/soulofzephir">
+  <img src="https://img.shields.io/badge/GitHub-soulofzephir-181717?style=for-the-badge&logo=github" alt="GitHub"/>
+</a>
+<a href="https://www.npmjs.com/~soulofzephir">
+  <img src="https://img.shields.io/badge/npm-soulofzephir-CB3837?style=for-the-badge&logo=npm" alt="npm"/>
+</a>
+
+Security enthusiast & automation lover. Building tools for ethical hacking and security assessment.
+
+> *"Empowering developers to secure their applications with comprehensive testing tools."*
+
+---
+
+## 📋 Description
+
+Comprehensive pentesting & security check skill for [Pi coding agent](https://pi.dev). Provides:
+
+| Category | Coverage |
+|----------|----------|
+| 🔒 **Security Headers** | 9 critical headers analysis |
+| 🔌 **Port Scanning** | 20+ common ports detection |
+| 💉 **SQL Injection** | Union, Blind, Time-based testing |
+| 🖥️ **XSS Testing** | Reflected, Stored, DOM-based |
+| ⚡ **Command Injection** | Linux & Windows payloads |
+| 📄 **XXE Testing** | XML injection detection |
+| 📋 **OWASP Top 10** | Complete A01-A10 checklist |
+| 🔐 **SSL/TLS Audit** | Certificate & cipher analysis |
+
+---
+
+## 🚀 Installation
+
+### Option 1: npm (Recommended)
+
+```bash
+npm install -g @soulofzephir/pi-skill-pentesting
+```
+
+### Option 2: Manual
+
+```bash
+# Clone repository
+git clone https://github.com/soulofzephir/pi-skill-pentesting.git
+
+# Copy to Pi skills folder
+cp -r skills/pentesting ~/.pi/agent/skills/
+```
+
+### Option 3: Git Submodule
+
+```bash
+# Add as submodule to your project
+git submodule add https://github.com/soulofzephir/pi-skill-pentesting.git .pi/skills/pentesting
+```
+
+---
+
+## 🎯 Quick Usage
+
+### In Pi, simply type:
+
+```
+pentest https://example.com
+```
+
+### Or use specific commands:
+
+```
+/skill pentesting
+security check https://example.com
+test SQL injection di endpoint ini
+scan headers untuk website saya
+OWASP check
+```
+
+---
+
+## 📁 Package Structure
+
+```
+@ soulofzephir/pi-skill-pentesting/
+├── package.json              # NPM & Pi manifest
+├── README.md                 # This file
+├── LICENSE                   # MIT License
+├── skills/
+│   └── pentesting/
+│       ├── SKILL.md          # Main skill file
+│       ├── checklists/
+│       │   ├── headers.md    # Security headers detail
+│       │   ├── owasp.md      # OWASP Top 10
+│       │   ├── ports.md      # Port scanning
+│       │   └── injection.md  # All injection types
+│       ├── tools/
+│       │   ├── header-scan.sh       # Linux/Mac
+│       │   ├── header-scan.ps1       # Windows
+│       │   └── security-scan.ps1    # Windows All-in-One
+│       └── reports/
+│           └── template.md   # Report template
+```
+
+---
+
+## 🔍 What This Skill Does
+
+### 1️⃣ Security Headers Analysis
+Checks 9 critical security headers:
+- ✅ CSP (Content-Security-Policy)
+- ✅ HSTS (Strict-Transport-Security)
+- ✅ X-Content-Type-Options
+- ✅ X-Frame-Options
+- ✅ Referrer-Policy
+- ✅ Permissions-Policy
+- ✅ Cache-Control
+- ✅ Server header
+- ✅ X-Powered-By
+
+### 2️⃣ Port Scanning
+Detects open ports and high-risk services:
+- Database ports (3306, 5432, 27017, 6379)
+- Remote access (22, 3389)
+- Web ports (80, 443, 8080)
+- Dangerous exposed services (Docker 2375)
+
+### 3️⃣ Injection Testing
+Comprehensive payloads for:
+- **SQL Injection** - Union, Blind, Time-based, Error-based
+- **XSS** - Reflected, Stored, DOM, Polyglots
+- **Command Injection** - Linux & Windows
+- **XXE** - Basic, Blind, Billion Laughs
+- **LDAP Injection** - Auth bypass
+- **SSTI** - Jinja2, Twig, Handlebars
+
+### 4️⃣ OWASP Top 10 Checklist
+Complete testing for:
+- A01: Broken Access Control
+- A02: Cryptographic Failures
+- A03: Injection
+- A04: Insecure Design
+- A05: Security Misconfiguration
+- A06: Vulnerable Components
+- A07: Authentication Failures
+- A08: Software & Data Integrity
+- A09: Security Logging
+- A10: Server-Side Request Forgery (SSRF)
+
+---
+
+## 🛠️ Tools Included
+
+### Automated Scripts
+
+| Script | Platform | Description |
+|--------|----------|-------------|
+| `header-scan.sh` | Linux/Mac | Security headers scanner |
+| `header-scan.ps1` | Windows | Security headers scanner |
+| `security-scan.ps1` | Windows | **All-in-one scanner** |
+
+### External Tools Recommended
+
+```
+Headers:    securityheaders.com, observatory.mozilla.org
+Vuln Scan:  Nuclei, OWASP ZAP, Nikto
+SSL/TLS:    testssl.sh, ssllabs.com
+SQLi:       SQLMap
+XSS:        Dalfox, XSStrike
+Cmd Inj:    Commix
+Ports:      Nmap, RustScan
+```
+
+---
+
+## 📊 Output
+
+### Header Security Score (0-100)
+```
+A (90-100): Excellent
+B (70-89):  Good
+C (50-69):  Needs Improvement
+D (30-49):  Poor
+F (0-29):   Critical
+```
+
+### Vulnerability Severity
+```
+🔴 CRITICAL   → Fix immediately
+🟠 HIGH       → Fix within 1 week
+🟡 MEDIUM     → Fix within 1 month
+🟢 LOW/INFO   → Fix when possible
+```
+
+---
+
+## ⚠️ Disclaimer
+
+> **For authorized testing only!**
+> 
+> - ✅ Test your own websites
+> - ✅ Test with written permission
+> - ❌ **NEVER** test without authorization - it's ILLEGAL
+
+---
+
+## 🤝 Contributing
+
+Contributions welcome! Feel free to submit issues and pull requests.
+
+1. Fork the repository
+2. Create your feature branch (`git checkout -b feature/AmazingFeature`)
+3. Commit your changes (`git commit -m 'Add AmazingFeature'`)
+4. Push to the branch (`git push origin feature/AmazingFeature`)
+5. Open a Pull Request
+
+---
+
+## 📝 License
+
+This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.
+
+---
+
+## 🙏 Credits
+
+Built with 💪 by **[Rz (@soulofzephir)](https://github.com/soulofzephir)**
+
+Special thanks to:
+- [Pi Coding Agent](https://pi.dev) - The coding harness
+- [Agent Skills Standard](https://agentskills.io) - Skill specification
+
+---
+
+## ⭐ Show Your Support
+
+If this skill helped you, give it a ⭐!
+
+```bash
+npm install -g @soulofzephir/pi-skill-pentesting
+```
+
+---
+
+**Made with ❤️ by Rz | [@soulofzephir](https://github.com/soulofzephir) | [Report Issue](https://github.com/soulofzephir/pi-skill-pentesting/issues)**

package/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "@soulofzephir/pi-skill-pentesting",
+  "version": "1.0.0",
+  "description": "Comprehensive pentesting & security check skill for Pi coding agent - headers, ports, SQLi, XSS, OWASP Top 10",
+  "keywords": [
+    "pi",
+    "pi-package", 
+    "pi-skill",
+    "pentesting",
+    "security",
+    "security-audit",
+    "vulnerability-scan",
+    "ethical-hacking"
+  ],
+  "homepage": "https://github.com/soulofzephir/pi-skill-pentesting",
+  "bugs": {
+    "url": "https://github.com/soulofzephir/pi-skill-pentesting/issues"
+  },
+  "license": "MIT",
+  "author": {
+    "name": "Rz",
+    "url": "https://github.com/soulofzephir"
+  },
+  "contributors": [],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/soulofzephir/pi-skill-pentesting.git"
+  },
+  "pi": {
+    "skills": "./skills",
+    "description": "Pentesting & Security Check Skill for Pi"
+  },
+  "scripts": {
+    "install": "echo 'Skill installed! Restart Pi to use: /skill pentesting'"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  }
+}