pentest-orchestrator

name	pentest-orchestrator
description	Master pentest orchestration — full pipeline from target to report with confirmation gates
triggers	["pentest","security test","security assessment","full scan","penetration test"]

Pentest Orchestrator — Master Skill

Orchestrates a complete penetration test engagement with user confirmations at each phase.

Pipeline

Scope Validation → Recon → Vuln Scan → Targeted Testing → Report
      │              │          │               │              │
   confirm       confirm   confirm        confirm       deliver

Execution

Phase 0: Setup

Create engagement directory:

mkdir -p /tmp/pentest/{target}/{recon,web,network,api,evidence,reports}

Initialize state file /tmp/pentest/{target}/engagement-state.json:

{
  "engagement_id": "engagement-{timestamp}",
  "target": "{target}",
  "status": "initializing",
  "phases_completed": [],
  "current_phase": "recon",
  "findings_count": {"critical":0,"high":0,"medium":0,"low":0}
}

Present to user: target IP, approach, estimated cost/time. Wait for confirmation before proceeding.

Phase 1: Reconnaissance

Delegates to pentest-recon skill. The agent should:

1. Perform passive recon (WHOIS, DNS, subfinder, amass, crt.sh)
2. Perform active recon (httpx, nmap, whatweb)
3. Aggregate results
4. Present summary: subdomain count, live hosts, open ports, technologies

Wait for user confirmation before proceeding to scanning.

Phase 2: Vulnerability Scanning

Delegates to pentest-web, pentest-network, pentest-api skills. Run in parallel where possible:

• Nuclei scan against all live URLs
• Nikto on primary web targets
• FFUF directory fuzzing
• Network vuln scanning on discovered services

Wait for all scans to complete, aggregate findings, present severity breakdown.

Wait for user confirmation before exploitation.

Phase 3: Targeted Testing

For each finding, run targeted verification:

• SQLi candidates → sqlmap
• XSS candidates → browser/injection testing
• SSRF candidates → interactsh OOB
• API endpoints → IDOR/BOLA/GraphQL tests

Phase 4: Evidence Collection

• Screenshot vulnerable endpoints (use browser tool)
• Save all command output logs
• Archive to /tmp/pentest/{target}/evidence-{date}.tar.gz

Phase 5: Reporting

Delegates to pentest-report skill:

• Aggregate all findings from JSON
• Generate markdown report from template
• Convert to PDF if pandoc available

State Tracking

Update /tmp/pentest/{target}/engagement-state.json after each phase using jq:

jq '.status = "scanning" | .phases_completed += ["recon"]' state.json > tmp && mv tmp state.json

Parallel Execution

Run independent scans in parallel (background terminal commands or delegate_task):

• recon: subfinder, amass, crt.sh concurrently
• scanning: nuclei, nikto, ffuf concurrently
• targeted: sequential per finding

Cleanup

After report delivery:

• Archive evidence to tar.gz
• Preserve state and findings JSON
• Optionally remove temp scan files

Cost Budget (DeepSeek V3 via OpenRouter)

Phase	Est. Tokens	Est. Cost
Recon	50-100K	$0.03-0.06
Vuln Scan	100-200K	$0.06-0.12
Web Testing	100-300K	$0.06-0.18
Exploitation	50-150K	$0.03-0.09
Reporting	50-100K	$0.03-0.06
Total	400K-950K	$0.24-0.57

Safety

• Never scan without explicit authorization
• Confirmation gates before each active phase
• All commands logged with timestamps
• Evidence preserved for audit trail
• Rate limiting on all scans (nuclei -rl 150, hydra -t 4)