---
title: "Web Application Penetration Testing - Air Market"
description: "When you are allowed to check a web app for weaknesses, you still have to do the looking, confirm what is real, and write it up. This runs an authorized web test with reconnaissance, proof-based find…"
canonical: "https://airmarket.ai/app/web-pentest"
---

[Air Market](/) / [Security](/category/security) / Web Application Penetration Testing

Skill by [Nous Research](/@nousresearch)

# Web Application Penetration Testing

Test a web app you are allowed to, and write up what you find

## What this does

When you are allowed to check a web app for weaknesses, you still have to do the looking, confirm what is real, and write it up. This runs an authorized web test with reconnaissance, proof-based findings, and a report. Reach for it when you have permission to test a site and need the findings written down.

### Top 3 things it does for you

- Look over a web app I have permission to test
- Confirm a finding with proof
- Turn the findings into a report

## Information

**Web Application Penetration Testing at a glance**

|  |  |
| --- | --- |
| Kind | Skill |
| Publisher | [Nous Research](/@nousresearch) |
| Category | [Security](/category/security) |
| Works with | Agent Skills - an open standard supported by 40+ agents |
| Languages | en |
| Version | 1.0.0 |
| Size | 44 KB |
| Licence | MIT |
| Repository | [NousResearch/hermes-agent](https://github.com/NousResearch/hermes-agent/tree/0e2b5f3835832301bb6b081f94ee9fbb7e58db5a/optional-skills/security/web-pentest) |
| GitHub stars | 261,931 (as of Nov 2026) |

## Security report

**Verified.** AIR scanned this exact version of Web Application Penetration Testing and flagged nothing. AIR's verdict: **safe**.

**What Web Application Penetration Testing's check was run against**

|  |  |
| --- | --- |
| Commit | 0e2b5f3835832301bb6b081f94ee9fbb7e58db5a |
| Content hash | 1a47dfe9327093fe17dbdf9ed6f377a8fefe3e764c1942ee64a870916a8ce9bf |
| Files read | [Browse the files at this exact commit](https://github.com/NousResearch/hermes-agent/blob/0e2b5f3835832301bb6b081f94ee9fbb7e58db5a/optional-skills/security/web-pentest/SKILL.md) |

A scan is named by the exact content it read, not by a version number. A different version is a different artifact, and nothing here applies to a version AIR has not scanned.

[Read the full security report for Web Application Penetration Testing](/security/web-pentest)

## About Web Application Penetration Testing

An authorized web application test. It covers reconnaissance, proof-based findings, and a report at the end.

It is meant for testing you are permitted to do.

## What's inside

- SKILL.md - instructions
- references/bypass-techniques.md - reference
- references/exploitation-techniques.md - reference
- references/scope-enforcement.md - reference
- references/vuln-taxonomy.md - reference
- scripts/recon-scan.sh - script
- templates/authorization.md - reference
- templates/exploitation-queue.json - data
- templates/pentest-report.md - reference

## Questions

### Is Web Application Penetration Testing safe to install?

AIR scanned this exact version of Web Application Penetration Testing and flagged nothing. AIR's verdict: safe. The verdict is named by the content that was read, at commit 0e2b5f383583, so it cannot drift onto a version nobody scanned. The full report is at https://airmarket.ai/security/web-pentest.

### How do I install Web Application Penetration Testing?

Open https://airmarket.ai/app/web-pentest on Air Market and use the install action: Air Market hands Claude a prompt naming this exact skill, and Claude sets it up. Source, pinned to the exact commit this listing describes: https://github.com/NousResearch/hermes-agent/tree/0e2b5f3835832301bb6b081f94ee9fbb7e58db5a/optional-skills/security/web-pentest. Install from that link, not the branch.

## Related on Air Market

- [More Security listings](/category/security)
- [Everything by Nous Research](/@nousresearch)

---

Canonical URL: <https://airmarket.ai/app/web-pentest>