| name | confirming-pentest-authorization |
| description | Verify that a penetration test has explicit, written, signed
authorization before any scanning begins. Reads a Rules-of-
Engagement (ROE) attestation file, validates required fields
(authorizer, in-scope targets, time window, emergency contact,
signature), checks the signer against an allowlist, and emits a
CRITICAL finding if anything is missing. Designed as the first
skill the orchestrator routes to.
Use when: starting a new engagement, after a scope change, or
before any cluster 1-4 scan skill runs.
Threshold: any missing or unsigned ROE field; any time-window
expiry; any in-scope target outside the authorized list.
Trigger with: "confirm authorization", "verify ROE", "check
pentest authz", "pre-flight authorization".
|
| allowed-tools | ["Read","Bash(python3:*)","Glob"] |
| disallowed-tools | ["Bash(rm:*)","Bash(curl:*)","Bash(wget:*)","Bash(nmap:*)","Bash(nikto:*)","Bash(sqlmap:*)","Write(.env)","Edit(.env)"] |
| version | 3.30.0 |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| license | MIT |
| compatibility | Designed for Claude Code |
| tags | ["security","engagement-governance","authorization","roe","pentest"] |
Confirming Pentest Authorization
Overview
Penetration testing is computer access. Without explicit
authorization from the owner of the system under test, that
access is a crime — Computer Fraud and Abuse Act in the US,
Computer Misuse Act in the UK, equivalent laws everywhere
else. The line between an authorized pentester and an
unauthorized attacker is one signature on one document.
The penetration-tester pack's other skills (TLS analysis, CORS
audit, dependency CVE scan, etc.) all assume that line has been
crossed correctly. This skill is the first gate the orchestrator
routes to. It refuses to declare an engagement authorized until
a Rules of Engagement (ROE) attestation file exists, is signed,
and contains the fields any real-world legal review will look for.
This is not paranoia or paperwork theater. Engagements DO go
sideways: scope creeps mid-test, a tester probes an out-of-scope
adjacent system, an SOC team escalates a "real" attack to legal,
and the question "show us the ROE" comes up. If the ROE is in
order, the answer is "here it is." If not, the conversation gets
expensive fast.
When the skill produces findings
| Finding | Severity | Threshold | Affected control |
|---|
| ROE file missing | CRITICAL | No attestation file at the expected path | (legal) |
| Required field missing | CRITICAL | authorizer, in_scope_targets, time_window, emergency_contact, or signature absent | (legal) |
| Signature missing | CRITICAL | No signature_block in ROE | (legal) |
| Signer not in allowlist | CRITICAL | signer email/key id not in .allowed-authorizers | (legal) |
| Time window expired | HIGH | current time outside time_window.start / time_window.end | (legal) |
| Time window not yet active | HIGH | current time before time_window.start | (legal) |
| In-scope target list empty | HIGH | in_scope_targets field present but empty | (legal) |
| Out-of-scope override (manual flag) | |
