Pentest-Lyan Web Security Testing

Skill by ara.so — Security Skills collection.

Pentest-Lyan is an autonomous web penetration testing framework that performs self-directed threat modeling across 12 dimensions, complete JavaScript analysis, and cross-role verification. It validates business impact (not just HTTP 200 responses), maintains state across sessions, and generates both technical Markdown and delivery-ready Word reports.

What It Does

• Autonomous Threat Modeling: Identifies threats based on 12 thinking dimensions rather than fixed vulnerability checklists
• Deep JavaScript Analysis: Reads and understands business logic, signing mechanisms, and frontend parameters before testing APIs
• Business Impact Validation: Verifies database-layer changes, data access, and state transitions actually occur
• Multi-Role Testing: Builds permission matrices and performs cross-role privilege escalation checks
• Stateful Testing: Supports resume (--resume), multi-project isolation, and session pooling
• Dual Report Formats: Markdown for technical details, Word for delivery; separates critical findings from configuration issues

Installation

Prerequisites