Skip to content
Get packs

Thick Client Security Testing

Guides an agent through authorized security testing of desktop thick client apps

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
2 files

What it does

This skill gives an AI agent a structured checklist for testing desktop applications (Windows, macOS, Linux GUI apps or apps with a companion service) for security weaknesses. It walks through mapping trust boundaries, checking local storage, configuration and inter-process communication, inspecting network traffic and certificate pinning, and verifying findings with reverse-engineering tools. It is meant only for authorized testing, and it tells the agent to record scope and test accounts first.

Great for

  • Security testers doing authorized assessments of desktop or Electron/Qt/.NET client software
  • Developers who want a checklist for auditing their own desktop app's local storage, updates and IPC

Skip it if

  • Pure web applications, which the skill itself says are out of scope (the agent must confirm a desktop target first)
  • Testing software you do not own or have written permission to assess, since the skill is built for offensive techniques such as bypassing client-side checks and certificate pinning

Try asking

  • “Run a thick client security test on this Windows installer and map its trust boundaries”
  • “Check this Electron app's asar package and local config files for hardcoded secrets”
  • “Review how this .NET desktop client handles update signature verification and certificate pinning”
Step-by-step guide: how to use Thick Client Security TestingInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 2 original files, the MIT licence and an attribution note.

    thick-client.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip thick-client.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip thick-client.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Confirm written authorization and define scope, including the installer source and test accounts, before any testing begins
  • Work through the trust-boundary map first, then local and network surfaces, and use the included checklist to confirm coverage
  • Keep test traffic and reverse-engineering work inside an isolated lab environment and avoid using real customer credentials

What's inside

  • references/thick-client-checklist.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.