mao-pentest

name	mao-pentest
description	Autonomous penetration testing via Shannon — a white-box security testing framework that executes real attacks and reports only confirmed exploits. Pairs with mao-security (static analysis) to provide full security coverage: static review on every PR, dynamic pentest before major releases. Requires Docker and Shannon installed: npx skills add unicodeveloper/shannon
argument-hint	[target-url] [workspace-name]
allowed-tools	Bash

MAO Pentest — Autonomous Security Testing

Dynamic security testing that proves vulnerabilities rather than suggesting them. Shannon executes real attacks in Docker containers and reports only what it can exploit.

When to use this skill:

• Before promoting to production after a major feature release
• After significant auth, API, or database changes
• When mao-security static review found HIGH/CRITICAL findings (confirm exploitability)
• Quarterly security audits on staging environments

When NOT to use this skill:

• On every PR (use mao-security for that — it's fast and free)
• Against production (staging only)
• Without explicit written authorization for the target system

Prerequisites

# Install Shannon skill
npx skills add unicodeveloper/shannon

# Verify Docker is running
docker info

Usage

# Full pentest — all 5 OWASP categories
/shannon http://localhost:3000 myapp

# Scope to specific vulnerability categories
/shannon --scope=xss,injection http://localhost:8080 frontend-api

# Named workspace (resume if interrupted)
/shannon --workspace=audit-q1 http://staging.example.com backend-api

# Skip destructive endpoints
/shannon --avoid=/logout,/admin/delete http://localhost:3000 myapp

# Check status of running pentest
/shannon status

# View latest report
/shannon results

What Shannon Tests (50+ vulnerability types)

Category	Coverage
Injection	SQL (union, blind, time-based), command injection, SSTI, NoSQL
XSS	Reflected, stored, DOM-based, file upload, mutation XSS
SSRF	Internal services, cloud metadata (AWS/GCP/Azure), DNS rebinding, protocol smuggling
Broken Authentication	Default credentials, JWT flaws (none alg, weak signing), session fixation, CSRF, MFA bypass
Broken Authorization	IDOR, privilege escalation, path traversal, forced browsing, mass assignment

The 5-Phase Pipeline

Phase 1: Pre-Recon    — Static source analysis + Nmap/Subfinder/WhatWeb
Phase 2: Recon        — Live attack surface mapping via headless browser
Phase 3: Analysis     — 5 parallel agents (injection/xss/ssrf/auth/authz)
Phase 4: Exploitation — Dedicated exploit agent per finding, real attacks
Phase 5: Reporting    — Executive summary + reproducible PoC per finding

Runtime: ~1–1.5 hours | Cost: ~$50 (Claude Sonnet)

Security Contract

Shannon enforces an authorization gate at every invocation — it will prompt you to confirm you own or have explicit written authorization for the target.

All attack tools execute inside Docker containers. Nothing runs on your host.

Only run against systems you own or have explicit written authorization to test.

Integration with MAO Security Stack

Every PR:    mao-security (static)  →  fast, free, catches patterns
Pre-release: mao-pentest (dynamic)  →  confirms exploitability, proves findings

Use mao-security-reviewer agent for code-level review. Use mao-pentest skill for runtime proof-of-exploit against staging.

The output of mao-pentest feeds directly into correction tasks:

• Each confirmed exploit → HIGH/CRITICAL issue
• Correction task gets: exact PoC, affected endpoint, remediation steps
• Re-run pentest after fixes to confirm resolution

What Shannon Does NOT Cover

Complement with these tools for full coverage:

• Dependency CVEs: npm audit, pip-audit, trivy
• Container image vulnerabilities: trivy image <name>
• Secrets in code/history: trufflehog, gitleaks
• Infrastructure misconfig: checkov, tfsec

Report Output

Shannon generates a report with:

• Executive summary (severity distribution, risk score)
• Per-finding: description, affected endpoint, HTTP request/response proof, remediation
• All findings are confirmed exploits — no false positives

View with: /shannon results