pentest-align

name	pentest-align
description	Align pentest suite with current codebase. Use when: 'align pentests', 'sync pentest config', 'check coverage', 'pentest drift', 'update pentest config'.
argument-hint	[focus] — endpoints | rate-limits | auth | endpoint-groups | all
allowed-tools	Read Grep Glob Bash Agent Edit Write
effort	high

User Input

$ARGUMENTS

Purpose

Audit the pentest suite against the current application codebase to ensure tests have full coverage and correct configuration. Detects drift between what the app does and what the tests check.

This skill modifies files. Updates target YAMLs and endpoint_groups. Does NOT run scans — use /pentest for that.

Focus Areas

Focus	Checks
endpoints	All URL patterns in the app appear in the target YAML endpoints: section
endpoint-groups	All kit modules have the endpoint_groups keys they need (no silent SKIP blocks)
rate-limits	Rate limit values in code match YAML rate_limits:
auth	All auth-required endpoints have tests for unauthenticated access
modules	Each module script tests what it claims; no dead code
all	All of the above

Workflow

Phase 1: Extract ground truth from the codebase

# Adapt these to your framework
grep -r "@app.route\|@router\." ~/your-app/
grep -r "require_auth\|@login_required\|auth=" ~/your-app/

Phase 2: Extract pentest state

Read:

• pentest/targets/<target>.yaml — endpoint inventory, rate limits, known vulns, endpoint_groups
• suite/targets/app.example.yaml — full schema of all endpoint_groups keys kit modules use

Phase 3: Cross-reference

3a. Endpoint coverage

For every endpoint in the app:

• Is it in the target YAML endpoints: section?
• Is it covered by at least one endpoint_groups key (so a kit module will actually test it)?

3b. endpoint_groups gap analysis

For each kit module (api, auth, headers, infra, injection, nikto, nuclei, paths, recon, ssrf, tls):

• Which endpoint_groups keys does it read?
• Are those keys configured in the target YAML?
• If not, the module emits [SKIP] — is that intentional?

Key modules and their required endpoint_groups keys:

• auth.sh: mode_endpoint, session_creator, auth_check, logout_endpoint, rate_limited_post
• api.sh: public_api_endpoints, sessionauth_api_endpoints, idor_resources, destructive_api_endpoints
• ssrf.sh: ssrf_target_path, ssrf_url_key
• injection.sh: sqli_search_endpoints, sqli_id_endpoints, xxe_test_endpoints
• headers.sh: header_audit_paths, cache_control_paths

3c. Rate limit alignment

For every rate-limited endpoint:

• Does the YAML rate_limits: have the correct value?
• Does auth.sh's rate_limited_post/rate_limited_get test that limit?

3d. Auth boundary alignment

For every auth-protected endpoint:

• Is it in sessionauth_api_endpoints? (tested with CSRF jar that has session)
• Is it in unauth_probe_endpoints? (tested with NO session at all)
• For cross-user data: is it in idor_resources for IDOR enumeration?

Phase 4: Apply fixes

For each gap found:

1. Add missing endpoints to endpoints: section of target YAML
2. Add/update endpoint_groups keys for uncovered kit modules
3. Update wrong rate limits in rate_limits:
4. Add missing auth boundary tests to unauth_probe_endpoints
5. Run YAML validation after each edit

Phase 5: Validate

python3 -c "import yaml; yaml.safe_load(open('pentest/targets/<target>.yaml'))" && echo "YAML valid"
bash -n pentest/scripts/*.sh 2>/dev/null && echo "Scripts syntax OK"

Rules

1. Never modify the application codebase — only modify the pentest suite config.
2. Only update endpoint_groups when ground truth meaningfully diverged — not for cosmetic differences.
3. A [SKIP] is not always a bug — some modules legitimately have no endpoints to test on a given target.
4. Run shellcheck after every .sh edit in the consumer's pentest/scripts/.