How to use the Fast Testing Checklist agent skill

What does the offensive-fast-checking skill make the agent do?

The skill's folder contains a single file, SKILL.md. Its instructions tell the agent to load the full methodology and apply it as an operational checklist, follow the steps in order unless you say otherwise, consider each technique against the current target, track which items are complete, and suggest next steps based on findings.

The checklist is a structured guide for security testers, not an automated scanner. The agent reasons through the steps and can suggest commands, but the file itself contains no executable scripts. The skill's metadata lists it as not running scripts and not using the network.

• Reconnaissance: map visible content, check API documentation, identify technologies and gateways/WAF/CDN, and scope subdomains.
• Finding origin IPs behind CDN/WAF: check historical DNS, certificates and subdomains, then test candidate IPs.
• Authentication: password rules, username enumeration, rate limiting, account recovery, MFA, OAuth, JWT and similar.
• Session handling: token predictability, cookie flags, logout and rotation, CSRF and session fixation.
• Access control: IDOR-style ID manipulation, mass assignment, function-level authorization and older API versions.

Install the skill from the ZIP download

Download the ZIP for offensive-fast-checking from this page and unzip it. You can install it for yourself across all projects, or for a single project.

For a personal install, place the unzipped folder in ~/.claude/skills/. For a project-only install, place it in the project's .claude/skills/ folder. Either way the folder should contain SKILL.md.

If you use the Claude apps instead, you can upload the skill under Settings → Capabilities → Skills.

• Personal: ~/.claude/skills/offensive-fast-checking/
• Project: <your-project>/.claude/skills/offensive-fast-checking/
• Claude apps: Settings → Capabilities → Skills

Trigger the skill with natural requests

The skill activates when your conversation involves its trigger topics. The listed phrases include fast check, quick recon, rapid assessment, quick wins, fast triage, speed checklist, time-boxed, CTF, fast scan and quick vulnerability. You do not need to type these exactly, but using them makes activation clearer.

State your authorisation and scope in the same request. The agent needs the target and context to decide which checklist items apply.

• "Use the fast checking skill for a time-boxed assessment of the staging app I'm authorised to test at example.com."
• "Quick recon on this API: what should I check first?"
• "We're doing a CTF-style run against this login flow. Walk me through the quick wins."
• "Track which checklist items we've done and suggest next steps based on what we found."

What to provide and what you need beforehand

The skill assumes you have authorised access to the target system. The checklist names external tools such as Burp Suite, Wappalyzer, curl and wordlists from SecLists or Assetnote. The skill only names them; it does not install anything, so you must obtain any tools you want to use yourself.

The output uses security terms such as CSRF, JWT and DPoP without explanation, so the skill suits readers with security background.

• Written permission or clear authority to test the target.
• Any tools you plan to use, installed separately.
• Enough security knowledge to read and judge the agent's suggestions.

Safety notes: scripts and network access

According to the skill's listing, it runs no scripts and uses no network. The checklist describes active attack techniques, so the risk lies in how you use the output, not in the file. Only apply it to systems you own or have explicit written permission to assess. Testing other systems may be unlawful.

The one example command in the checklist, curl --resolve, sends a request to a server you specify. Check the IP and hostname are in scope before running it.

• Confirm scope before testing any IP address or subdomain.
• Treat suggested commands as suggestions and read them before running them.
• Do not rely on the checklist for a complete or compliance-grade assessment; it is a fast triage aid and skips depth on many items.

Tips for getting useful results

Give the agent context: the application type, the roles or accounts you have, and the time you have. The checklist asks for multiple accounts when testing access control, so set up at least two if you can.

Ask the agent to keep a running list of completed items. This keeps a time-boxed session organised and helps you see what remains.

• Name the technologies you have seen so the agent can pick relevant items.
• Ask for the next three highest-value items rather than the whole list.
• Use the findings you record to ask for next steps.