pentest-engagement

name	pentest-engagement
description	Penetration testing engagement planning — scoping, ROE drafting, phased timeline, MITRE ATT&CK mapping, kickoff/closeout documentation. Triggers on engagement plan, ROE, rules of engagement, scoping, pentest plan, phased plan, MITRE mapping, attack matrix, kickoff, closeout.
license	MIT
compatibility	Works with Claude Code
allowed-tools	Read Write Edit Grep
metadata	{"author":"badi","homepage":"https://github.com/fatihkan/badi-skills/tree/main/skills/pentest-engagement","badi-version":">=1.24.0","category":"pentest","scope":"advisory","inspired-by":"0xSteph/pentest-ai-agents engagement-planner"}

pentest-engagement

Produces planning + scoping + ROE documentation for an authorized penetration testing engagement.

Triggers

• "prepare a pentest plan"
• "draft the ROE"
• "scoping document"
• "engagement timeline"
• "MITRE ATT&CK matrix"
• "kickoff meeting agenda"
• "closeout report template"

Deliverables

1. Scope Document (in-scope, out-of-scope, constraints)
2. Rules of Engagement (ROE) (forbidden techniques, working hours, escalation path)
3. Phased Timeline (kickoff -> recon -> exploit -> post-ex -> reporting -> closeout)
4. MITRE ATT&CK Mapping (Tactic + Technique list per phase)
5. Communication Plan (client contact, escalation contact, incident response)
6. Acceptance Criteria (tests covered, reporting, deliverable list)

Scope Document Template

# Engagement Scope — <Client>

## In-Scope
- IP Ranges: 10.0.0.0/16, 192.168.50.0/24
- Domains: *.example.com, app.example.com
- Cloud Accounts: AWS 123456789012 (production us-east-1)
- Test Type: External / Internal / Web App / Cloud / Red Team

## Out-of-Scope
- Production DB direct query
- Email/Phishing a client employee
- DoS / stress testing
- 3rd party SaaS (Stripe, SendGrid, etc.)

## Restrictions
- Working hours: Weekdays 09:00-17:00 (TR)
- Aggressive scan: Only within a user-approved window
- Data exfil: None — evidence files only (max 1MB)

## Authorization
- Letter of authorization: <link>
- Client signature: <name, date>
- Pentest firm signature: <name, date>

Phased Plan Template (5 Phase)

Phase	Duration	Activity	MITRE Tactic
1. Recon	1-2 days	OSINT, subdomain enum, port scan	TA0043 Reconnaissance
2. Initial Access	2-3 days	Web app exploit, phishing sim, AD attack	TA0001 Initial Access
3. Post-Exploit	3-4 days	Privesc, lateral, persistence, exfil sim	TA0004/TA0008/TA0003/TA0010
4. Detection	1-2 days	SIEM/EDR coverage gap	TA0042 Resource Development (defensive)
5. Report	2-3 days	Finding writeup, CVSS, remediation, debrief	—

MITRE ATT&CK Mapping

State at least 1 ATT&CK Technique ID per finding (T1059, T1078, etc.). Mapping:

finding: SQL Injection in /api/users
mitre:
  tactic: TA0001 (Initial Access)
  techniques:
    - T1190 (Exploit Public-Facing Application)
detection:
  - Sigma rule: web/sql_injection.yml
remediation:
  priority: P0
  effort: 8h

Kickoff Meeting Agenda (1 hour)

1. Scope review + signoff (10 min)
2. ROE walkthrough + restrictions (15 min)
3. Communication channel + escalation (10 min)
4. Asset inventory hand-off (15 min)
5. Q&A + first-day planning (10 min)

Closeout Meeting Agenda (1.5 hours)

1. Executive summary (10 min)
2. Top 3 critical finding walkthrough (30 min)
3. Remediation roadmap (20 min)
4. Detection rule hand-off (15 min)
5. Lessons learned (15 min)

Output Location

Create at the start of the engagement:

engagements/<client>-<yyyymmdd>/
  scope.md
  roe.md
  timeline.md
  mitre-mapping.yml
  contacts.md

Out-of-Scope (This Skill Does Not Do)

• Live command composing (pentest-recon, pentest-web, etc. do that)
• Producing exploit guides (pentest-exploit-chain does that)
• Report writing (pentest-report does that)

This skill produces planning + scoping docs only.