pentest-scan

name	pentest-scan
description	Security configuration scan. Headers, SSL/TLS, CORS, SRI checks.
user-invocable	true
allowed-tools	["Bash","Agent","Read"]

/pentest-scan — Security Configuration Scan

Scan a target application for security misconfigurations including HTTP headers, SSL/TLS settings, CORS policy, and WAF presence.

Input

The target URL is provided via $ARGUMENTS. If no URL is provided, ask the user for one.

Steps

1. Parse the target URL from $ARGUMENTS.

2. Delegate to scanner-agent using the Agent tool. The agent must run the following commands, collecting all JSON output:

   pentest -k -j -o ./findings scan headers <url>
   pentest -k -j -o ./findings scan ssl <url>
   pentest -k -j -o ./findings scan cors <url>
   pentest -k -j -o ./findings cloud waf <url>
   

3. Read the JSON outputs from ./findings/ to gather all results.

4. Present findings organized by severity:

   • Critical: Missing or misconfigured security headers (CSP, HSTS), expired/weak SSL certificates
   • High: Overly permissive CORS policies, weak TLS versions or cipher suites
   • Medium: Missing optional headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy)
   • Low: Informational findings (WAF detection, server version disclosure)
   • Info: Positive findings (properly configured headers, strong TLS)

Notes

• All scan commands are passive and safe to run without explicit consent.
• Use -k to skip SSL verification for targets with self-signed certs.
• Use -j for machine-readable JSON output.
• Use -o ./findings to persist results for later reporting.