recording-pentest-engagement

name	recording-pentest-engagement
description	Package an engagement's findings, scan outputs, evidence, and signed ROE into a timestamped archive with a SHA-256 manifest covering every file. Establishes chain of custody so legal counsel, internal audit, or an outside SOC can verify the archive hasn't been modified after closeout. Optionally signs the manifest with GPG for cryptographic attestation. Use when: closing an engagement, snapshotting evidence after each scan day, before handing artifacts to customer, or after an emergency-stop event. Threshold: file in tree without a manifest entry, hash mismatch, out-of-tree path referenced in findings, unsigned manifest when signing was requested. Trigger with: "record engagement", "archive evidence", "create chain of custody", "package pentest artifacts".
allowed-tools	["Read","Bash(python3:*)","Bash(tar:*)","Bash(gpg:*)","Glob"]
disallowed-tools	["Bash(rm:*)","Bash(curl:*)","Bash(wget:*)","Write(.env)","Edit(.env)"]
version	3.30.0
author	Jeremy Longshore <[e-mail]>
license	MIT
compatibility	Designed for Claude Code
tags	["security","engagement-governance","evidence","chain-of-custody","pentest"]

Recording Pentest Engagement

Overview

A penetration test produces a lot of artifacts: scan outputs in multiple formats, screenshots showing the state of vulnerable pages, raw tool logs (nmap, Burp, custom scripts), the ROE and any amendments, exec-summary docs, and the findings themselves. Six months after the engagement closes, a question arises — sometimes benign ("can you remind me what we found?"), sometimes adversarial ("the customer claims we accessed an out-of-scope system; show us the logs"). The answer needs to be: "yes, here's the archive, and here's cryptographic proof it hasn't been touched since the engagement closed."

This skill packages the engagement directory into a single timestamped archive with a SHA-256 manifest covering every file. Optionally signs the manifest with GPG. The result is a portable, self-verifying record of what the engagement produced.

The skill also surfaces inconsistencies that would weaken the chain-of-custody claim: out-of-tree paths referenced in findings (meaning the finding refers to a file not actually in the archive), files in the directory not listed in the manifest, manifest entries whose hashes don't match. These are HIGH findings — they mean the archive is incomplete or has been modified after the fact, neither of which is acceptable for evidence purposes.

When the skill produces findings

Finding	Severity	Threshold	Affected control
File in tree not in manifest	HIGH	Found during walk; manifest entry missing	(evidence integrity)
Manifest entry hash mismatch	CRITICAL	Computed SHA-256 differs from manifest	(evidence integrity)
Manifest entry without file	HIGH	Manifest lists a path that doesn't exist	(evidence integrity)
Findings reference out-of-tree path	MEDIUM	A finding's evidence field points to a file not in the archive	(evidence completeness)
Symlink in tree	MEDIUM	Symlinks break archive portability and integrity	(evidence integrity)
Empty file in tree	INFO	0-byte file; possibly an export error	(operational)
Archive package complete	INFO	All checks pass