MURAGE
How it worksFeaturesSolutionsUse casesComparePricingDocs
DownloadDownload
MURAGE

An AI Chief of Staff and a team that does the work. Free and open source, from Ferrox Labs.

Product

  • Features
  • How it works
  • Engines and apps
  • Privacy and security
  • Pricing
  • Murage Cloud
  • Download
  • Changelog
  • FAQ

Solutions

  • Solopreneurs
  • Founders and startups
  • Agencies
  • Ecommerce
  • Small business
  • Creators and educators
  • Developers
  • SaaS
  • Nonprofits
  • Consultants and freelancers
  • Customer success teams
  • Legal and professional services
  • Small teams
  • Sales teams
  • Operations managers
  • Industries
  • Use cases
  • Build your team

Compare

  • vs Claude Code
  • vs Codex (ChatGPT Work)
  • vs Claude (Cowork)
  • vs Paperclip
  • vs OpenClaw
  • vs Hermes Agent
  • vs Manus
  • vs Genspark
  • vs n8n
  • vs Zapier
  • vs Grok Bot
  • vs Viktor
  • vs Lindy
  • vs Tasklet

Resources

  • Docs
  • Team library
  • Skill library
  • AI Chief of Staff
  • How we test
  • Limits
  • Switching to Murage
  • Open source
  • Blog
  • Release notes

Company

  • About
  • Partners
  • Enterprise
  • Contact
  • Privacy
  • Terms
  • Cookies
© 2026 Ferrox Labs. Murage is open source under AGPL-3.0.
Security skills

Penetration Tester

Penetration testing methodology for authorized security testing covering OWASP Testing Guide, reconnaissance techniques, injection testing, XSS detection, CSRF testing, authentication bypass, privilege escalation, API security testing, and professional report formatting.

Download Murage

Free and open source. macOS, Windows and Ubuntu.

Try it

Add the skill to a bot, then ask your Chief of Staff:

“Use the Penetration Tester skill on this: [describe the job, or paste your notes].”

Penetration testing is the practice of testing a computer system, network, or web application to find security vulnerabilities that an attacker could exploit. This skill covers the methodology, tools, and techniques used in authorized penetration testing engagements.

What it covers

  • IMPORTANT: Authorization and Scope
  • OWASP Testing Guide Methodology
  • Reconnaissance Techniques
  • Injection Testing
  • XSS Detection
  • CSRF Testing
  • Authentication Bypass
  • Privilege Escalation

Skill Guard: clean

Scanned and clear. A bot can use it as soon as you add it.

Subject
Security
Level
intermediate
License
Apache-2.0
securitypenetration-testingguide

How to use it.

  1. 1

    Download Murage

    Free for Mac, Windows and Ubuntu.

  2. 2

    Add the skill

    Open Settings → Skills and switch on Penetration Tester for any bot. Or ask your Chief of Staff to pick skills for a job.

  3. 3

    Give it a job

    The bot reads the skill when the job calls for it, and works the way it lays out.

Put this skill to work.

  • ResearchAsk a real question. Get one page with sources.
  • Skill GuardEvery skill is scanned before a bot can use it.

Questions.

What is the Penetration Tester skill?+

Penetration testing methodology for authorized security testing covering OWASP Testing Guide, reconnaissance techniques, injection testing, XSS detection, CSRF testing, authentication bypass, privilege escalation, API security testing, and professional report formatting.

How much does it cost?+

Nothing. It ships with Murage, which is free and open source. Your bots run on the AI plan you already have.

Can I change it?+

Yes. Open it in Settings → Skills to read, edit or duplicate it. Skill Guard scans it again after every edit.

More security skills.

  • API Security EngineerAPI security expertise covering OWASP API Security Top 10, API authentication and authorization patterns and API key management.
  • Application Secrets SecuritySecrets management expertise covering HashiCorp Vault and AWS Secrets Manager patterns, secret rotation strategies and environment variable management.
  • Compliance CheckerCompliance framework audit expertise covering SOC 2 Type II controls, GDPR technical requirements, HIPAA security rule and PCI DSS for developers.
  • Cryptography EngineerCryptography implementation expertise covering symmetric vs asymmetric encryption, password hashing (bcrypt, argon2), digital signatures and key management.
  • Data Backup StrategistDesign and implement resilient backup strategies using the 3-2-1 rule, encryption best practices and cloud vs local tradeoffs.
  • Device Hardening GuideSystematically secure personal devices through OS hardening, router and network security, IoT device isolation and firmware management.

All security skills

Give your first job to Murage.

Download the free app, connect the AI you already pay for, and tell your Chief of Staff what needs doing. Plan on about ten minutes from install to a working team.

Free · Download Murage

No account needed · Runs on the AI plan you already pay for