pentest

name	pentest
description	Penetration testing orchestrator that coordinates specialized attack agents. Provides attack indexes, methodology frameworks, and documentation. Execution delegated to specialized agents (SQL Injection, XSS, SSRF, etc.). Use for engagement planning and attack coordination.

Coordinate penetration testing. Deploy executors, aggregate results, generate reports. Use it when user requests pentesting, security assessment, or vulnerability testing.

Workflow

Phase 1: Initialization

1. Gather scope: Target URL, restrictions, testing window
2. Create engagement folder: outputs/{engagement-name}/

Phase 2: Reconnaissance (Read reference/RECONNAISSANCE_OUTPUT.md to get outputs format)

1. Select reconnaissance tools based on asset type (domains, web apps, APIs, network, cloud)
2. Run recon in parallel via the inventory agents (web-application-mapping) and domain-assessment
3. Generate asset-specific inventory files in outputs/{engagement}/inventory/ (JSON per asset type) using the defined output format
4. Generate the consolidated analysis/attack-surface.md and analysis/testing-checklist.md using the defined output format

Phase 3: Planning & Approval (MANDATORY)

1. Analyze reconnaissance findings from outputs/{engagement}/inventory/ and outputs/{engagement}/analysis/
2. Create test plan: Executors to deploy, attack surface justification, testing approach
3. Present plan to user via AskUserQuestion
4. Get explicit approval if not already approved in the first phase: "Approve plan?", "Modify executors?", "Cancel?"
5. CRITICAL: Do NOT proceed to Phase 4 without user approval

Phase 4: Vulnerability Testing

1. Deploy approved executors in parallel (single Task call with run_in_background=True)
2. Monitor progress: Periodic TaskOutput(block=False)
3. Recursive spawning: New discoveries trigger new executors (ask approval if major change)

Phase 5: Aggregation

1. Collect findings from all executors
2. Deduplicate (same vuln + location = duplicate)
3. Identify exploit chains
4. Calculate severity metrics

Phase 6: Reporting (Read reference/FINAL_REPORT.md - includes DOCX conversion)

1. CRITICAL: Create folder structure FIRST: report/ and processed/ with subdirectories
2. Move ALL working files to processed/: reconnaissance/, findings/, activity/ → processed/
3. Move ALL intermediate files: ANY .md files, drafts, analysis → processed/intermediate-reports/
4. Generate markdown report: Use reference/FINAL_REPORT.md template → processed/intermediate-reports/pentest-final-report.md
5. REQUIRED: Generate .docx: Run pandoc command → report/Penetration-Test-Report.docx (cover page, TOC, body, appendix section)
6. Optional: Generate PDF: If LaTeX available → report/Penetration-Test-Report.pdf, else skip (DOCX is primary deliverable)
7. Copy referenced evidence: Organize by finding → report/appendix/finding-{id}/
8. Create report README: Document deliverables in report/README.md
9. VERIFY CLEAN STRUCTURE: ls -la outputs/{engagement}/ shows ONLY report/ and processed/
10. CRITICAL: NO intermediate files in root or report/ - Everything goes to processed/ except final deliverables (.docx, .json, README, appendix/)

What This Skill Does

1. Attack Index - References 63 attack categories across 11 domains with documentation paths
2. Methodology Frameworks - PTES, OWASP WSTG, MITRE ATT&CK, Flaw Hypothesis
3. Coordination - Guides pentester agent to deploy specialized attack agents
4. Documentation - PortSwigger labs, cheat sheets, quickstarts per attack

Execution: Delegated to specialized agents (injection-tester, xss-tester, pentester-executor, etc.)

Attack Categories

11 domains, 63 attack categories:

• Injection (9) | Client-Side (6) | Server-Side (6)
• Authentication (4) | API Security (4) | Web Applications (9)
• Cloud & Containers (5) | System (8) | IP Infrastructure (8) | Physical & Social (1) | Essential Skills (3)

See reference/ATTACK_INDEX.md for complete list with agent mappings.

Reconnaissance Asset Types

Five asset-specific output formats:

• Domains - Subdomains, DNS records, tech stack per subdomain
• Web Applications - Endpoints, forms, tech stack, cookies, JS analysis
• APIs - REST/GraphQL/WebSocket, auth methods, Swagger docs
• Network Services - Port scans, service versions, CVE candidates
• Cloud Infrastructure - S3 buckets, EC2 instances, security groups

See reference/RECONNAISSANCE_OUTPUT.md for complete format specifications and JSON schemas.

Final report

See reference/FINAL_REPORT.md for complete format specifications of the final report.

Output Structure

Complete folder organization (See reference/OUTPUT_STRUCTURE.md for details):

outputs/{engagement-name}/
├── report/                         # Complete deliverable package (3 files + appendix)
│   ├── Penetration-Test-Report.docx     # Main report (includes Referenced Files section)
│   ├── Penetration-Test-Report.pdf      # Optional PDF export
│   ├── pentest-report.json              # Machine-readable export
│   └── appendix/                        # Referenced evidence only
│       ├── finding-001/
│       ├── finding-002/
│       └── reconnaissance-summary.json
└── processed/                      # All working/testing artifacts
    ├── reconnaissance/             # Phase 2 outputs
    │   ├── inventory/
    │   └── analysis/
    ├── findings/                   # Phase 4 raw findings
    │   └── {finding-id}/
    ├── activity/                   # NDJSON logs
    │   └── {executor-name}.log
    ├── helpers/                    # Testing utilities
    ├── test-frameworks/            # Testing scripts
    └── intermediate-reports/       # Drafts, markdown source, etc.

Critical: report/ = 3 files max + appendix/ subfolder. ALL intermediate files go to processed/.

Methodologies

PTES - 7-phase engagement lifecycle OWASP WSTG - 11 testing categories MITRE ATT&CK - TTP mapping across 14 phases Flaw Hypothesis - Stack analysis → Predict → Test → Generalize → Correlate

Related Skills

• authenticating — authentication testing (login, signup, 2FA/OTP, CAPTCHA, OAuth)
• domain-assessment — domain reconnaissance
• web-application-mapping — web app reconnaissance
• cve-testing — CVE vulnerability testing

LLM / AI-threat testing is covered under API Security → attacks/api-security/web-llm/ (no separate command or agent).

Critical Rules

Testing Rules

• Orchestration only - Never execute attacks directly
• Delegate execution - Deploy specialized agents for testing
• Documentation index - Reference attack folders for techniques
• Working PoCs required - Specialized agents must provide evidence
• Activity logging - All agents log actions to NDJSON activity logs

Output Organization Rules (PHASE 6 - CRITICAL)

• Two-folder structure ONLY: report/ (final deliverables) and processed/ (working files)
• NO files in engagement root: Everything must be in report/ or processed/
• Report folder contents: ONLY Penetration-Test-Report.docx (+ optional .pdf), pentest-report.json, README.md, and appendix/ folder
• ALL intermediate files → processed/: .md files, drafts, analysis, summaries, checklists
• Reconnaissance → processed/reconnaissance/: ALL recon outputs
• Findings → processed/findings/: ALL raw finding details
• Activity logs → processed/activity/: ALL NDJSON logs
• Test frameworks → processed/test-frameworks/: SQL injection, command injection scripts
• Markdown reports → processed/intermediate-reports/: pentest-final-report.md, executive-summary.md, etc.
• VERIFY CLEAN: Before completing Phase 6, run ls -la outputs/{engagement}/ - must show ONLY report/ and processed/

---

Payload Reference

Each attack category contains a payloads/ subdirectory with curated PATT payloads (<200 lines/file).

• Browse: attacks/<group>/<category>/payloads/
• On-demand fetch: patt-fetcher agent → "<category name>"
• Standard: PATT_STANDARD.md — follow this for future curation sessions
• P1/P2 stubs: stub files with priority: high/medium — ready to fill next session