| name | pentest |
| description | Run security scans against Rockport deployment. Use when the user says 'pentest', 'security scan', 'check for vulns', 'test WAF', 'security audit', 'run pentest', or 'scan rockport'. |
| user-invocable | true |
| argument-hint | [target] [--module name] [--skip modules] [--rate n] |
| allowed-tools | Read, Grep, Glob, Bash, Agent |
| effort | high |
User Input
$ARGUMENTS
You MUST consider the user input before proceeding (if not empty).
Purpose
Run security tests against the live Rockport deployment and produce a classified findings report.
Workflow
Pre-Flight
- Check tool availability: Run
which curl jq terraform aws and check pentest/tools/ for optional tools (ffuf, nuclei, testssl.sh). Report what's available. Note: terraform and aws are required for auth bootstrap and the infra module
Phase 1: Run Scan
Parse arguments from user input:
- Default target:
rockport
- Extract
--module, --skip, --rate flags if present
- For destructive modules (injection), add
--yes only if user explicitly confirmed
For full scans, run in a background subagent (avoids timeout issues):
cd pentest && ./pentest.sh run rockport [options]
Phase 2: Report Results
After the scan completes, produce a quick module status table from results.json:
REPORT=$(ls -td pentest/reports/rockport/*/ 2>/dev/null | head -1)
jq -r '.modules[] | "\(.module)\t\(.status)\tP:\(.pass) F:\(.fail) S:\(.skip) I:\(.info)\t\(.duration)s"' "$REPORT/results.json"
Output Format
## Pentest Scan Complete: <target>
**Date**: <timestamp>
**Modules**: N run, N passed, N failed, N skipped
### Module Summary
| Module | Status | Duration | Pass | Fail | Skip |
|--------|--------|----------|------|------|------|
| ... | ... | ... | ... | ... | ... |
Run `/pentest-review` for deep analysis and finding classification.
Rules
- Use
run_in_background: true for full scans to avoid timeout issues
- Respect rate limits — default 50 req/s, lower for auth endpoints
- Never store credentials in report files
- For destructive modules (injection), add
--yes only if user explicitly confirmed
- Never generate images or videos during scans (cost control)
- Analysis and classification belong in
/pentest-review, not here
