ワンクリックでManusで任意のスキルを実行

defining-pentest-scope

Parse the ROE scope definition, enumerate every in-scope target (hostnames, IPs, CIDRs, URLs, cloud accounts, SaaS tenants), validate syntax, detect overlap with out-of-scope or known third-party SaaS ranges, and emit a normalized target list plus IP allowlist for scanning tools. Runs after confirming-pentest- authorization and before any cluster 1-4 scan. Use when: starting an engagement, expanding scope mid-engagement, validating that a target list matches the ROE, or generating an allowlist for an external scanner. Threshold: malformed syntax, in-scope overlap with out-of-scope, reserved or third-party SaaS ranges without acknowledgement. Trigger with: "define scope", "enumerate targets", "validate target list", "generate IP allowlist".

Manusで実行

スター2,344

フォーク332

更新日2026年6月8日 01:18

ソース

jeremylongshore

jeremylongshore/claude-code-plugins-plus-skills

GitHub リポジトリを開く Creator のリポジトリを見る

インストールコマンド

ダウンロード

Manusで実行

ファイルエクスプローラー

4 ファイル

SKILL.md

readonly

このリポジトリの他の Skills

同じリポジトリ

auditing-npm-dependencies

jeremylongshore/claude-code-plugins-plus-skills

Audit a Node.js project's installed npm dependency tree for known CVEs by wrapping the npm audit JSON output and emitting findings in the canonical penetration-tester schema. Detects direct AND transitive vulnerabilities, normalizes npm's severity scale (info/low/moderate/ high/critical) to the shared Severity enum, and parses both v1 and v2 audit output formats so the skill works against npm 6 and npm 7+ lockfiles. Use when: pre-merge gate on a Node project, post-incident sweep after a transitive package compromise (e.g. event-stream, ua-parser, node-ipc, color.js), SOC2 vendor-management evidence collection, or auditing an inherited or acquired Node codebase. Threshold: any HIGH or CRITICAL CVE in the resolved dependency tree. MODERATE / LOW reported informationally. Trigger with: "audit npm deps", "npm vulnerability scan", "check node packages for CVEs", "npm audit".

2026-06-082.3k

auditing-python-dependencies

jeremylongshore/claude-code-plugins-plus-skills

Audit a Python project's installed dependencies for known CVEs by wrapping pip-audit (PyPA's official vulnerability auditor) and emitting findings in the canonical penetration-tester schema. Detects vulnerable direct AND transitive packages, normalizes pip-audit's severity output via OSV severity bands, falls back to pip list --outdated when pip-audit isn't installed, and supports requirements.txt, pyproject.toml (PEP 621), Pipfile.lock, and poetry.lock as input sources. Use when: pre-merge gate on a Python project, post-incident sweep after a PyPI compromise (e.g. ctx, request-toolbelt typosquats, ultralytics 8.3.42 compromise), SOC2 evidence collection, or inheriting an unfamiliar Python codebase. Threshold: any HIGH or CRITICAL CVE in the resolved dependency tree. MODERATE / LOW reported informationally. Trigger with: "audit python deps", "pip vulnerability scan", "check pypi packages for CVEs", "pip-audit run".

2026-06-082.3k

checking-license-compliance

jeremylongshore/claude-code-plugins-plus-skills

Audit a project's dependency licenses against an explicit policy (allow-list / deny-list / review-required) and flag incompatibilities before they ship to production. Reads SPDX license identifiers from npm package manifests, Python METADATA / PKG-INFO files, and pyproject.toml; classifies each license by family (permissive, weak-copyleft, strong-copyleft, proprietary, unknown); detects copyleft contamination and SPDX-incompatible license combinations. Use when: pre-release legal review, M&A code-audit due diligence, preparing an OSS attribution NOTICE file, or switching a project's own license. Threshold: any GPL-family license in a project declaring MIT or Apache-2.0; any UNKNOWN-license package; any metadata-vs-source license mismatch. Trigger with: "check licenses", "license compliance audit", "SPDX scan", "GPL contamination check".

2026-06-082.3k

composing-vulnerability-report

jeremylongshore/claude-code-plugins-plus-skills

Read findings JSONL files from cluster 1-4 skills, deduplicate by fingerprint, group by severity, and compose a deliverable- grade markdown vulnerability report with per-finding sections (title, severity, target, detail, remediation, evidence) and a top-level summary table. The canonical written artifact a customer receives at engagement close; precise, reproducible, machine- checkable against source findings. Use when: closing an engagement, generating an interim report, regenerating after CVE or OWASP enrichment, or producing the input for generating-executive-summary. Threshold: findings missing required fields are dropped. HIGH and CRITICAL findings highlighted in the summary section. Trigger with: "compose vuln report", "write pentest report", "generate vulnerability deliverable", "render findings to report".

2026-06-082.3k

confirming-pentest-authorization

jeremylongshore/claude-code-plugins-plus-skills

Verify that a penetration test has explicit, written, signed authorization before any scanning begins. Reads a Rules-of- Engagement (ROE) attestation file, validates required fields (authorizer, in-scope targets, time window, emergency contact, signature), checks the signer against an allowlist, and emits a CRITICAL finding if anything is missing. Designed as the first skill the orchestrator routes to. Use when: starting a new engagement, after a scope change, or before any cluster 1-4 scan skill runs. Threshold: any missing or unsigned ROE field; any time-window expiry; any in-scope target outside the authorized list. Trigger with: "confirm authorization", "verify ROE", "check pentest authz", "pre-flight authorization".

2026-06-082.3k

generating-executive-summary

jeremylongshore/claude-code-plugins-plus-skills

Compose an exec-readable summary from a unified findings JSONL plus the OWASP coverage report. Computes a single engagement risk score (0-100, severity-weighted with OWASP-breadth and governance terms), rolls up findings into headline counts, names the top-3 remediation priorities with effort + impact estimates, and produces a 1-2 page markdown document for a C-level or board audience. Elides technical detail; the vulnerability report is the deep document. Use when: closing an engagement, preparing the exec-readout meeting, packaging for board review, or producing a one-page narrative for auditor / insurer / board. Threshold: input findings missing produces CRITICAL operational finding; otherwise the deliverable is the document itself. Trigger with: "generate exec summary", "executive summary", "C-level readout", "board pentest summary".

2026-06-082.3k

name	defining-pentest-scope
description	Parse the ROE scope definition, enumerate every in-scope target (hostnames, IPs, CIDRs, URLs, cloud accounts, SaaS tenants), validate syntax, detect overlap with out-of-scope or known third-party SaaS ranges, and emit a normalized target list plus IP allowlist for scanning tools. Runs after confirming-pentest- authorization and before any cluster 1-4 scan. Use when: starting an engagement, expanding scope mid-engagement, validating that a target list matches the ROE, or generating an allowlist for an external scanner. Threshold: malformed syntax, in-scope overlap with out-of-scope, reserved or third-party SaaS ranges without acknowledgement. Trigger with: "define scope", "enumerate targets", "validate target list", "generate IP allowlist".
allowed-tools	["Read","Bash(python3:*)","Glob"]
disallowed-tools	["Bash(rm:)","Bash(curl:)","Bash(wget:)","Bash(nmap:)","Write(.env)","Edit(.env)"]
version	3.0.0-dev
author	Jeremy Longshore <jeremy@intentsolutions.io>
license	MIT
compatibility	Designed for Claude Code
tags	["security","engagement-governance","scope","target-enumeration","pentest"]

Defining Pentest Scope

Overview

A pentest scope is a list of permission boundaries. Get it wrong and you either (a) miss real exposure by failing to test something the customer expected covered, or (b) probe something you weren't allowed to touch and turn the engagement into a liability event. Both failure modes share a root cause: the scope list was a vague narrative ("test the marketing site and the API") rather than a machine-readable, syntactically-validated, conflict-checked artifact.

This skill takes the in-scope and out-of-scope sections from a ROE and produces three deliverables:

Normalized target list — every entry parsed into a structured form (host vs CIDR vs URL path vs cloud account vs SaaS tenant), with explicit type tagging. Downstream cluster 1-4 skills consume this list rather than raw strings.
IP allowlist — flat list of IPv4 and IPv6 addresses / CIDRs ready to paste into scanner configurations (nmap target list, Burp scope file, AWS WAF allowlist, etc.).
Conflict report — Findings flagging syntactically-malformed entries, overlap between in-scope and out-of-scope, inclusion of reserved ranges (RFC1918, link-local, multicast), and known third-party SaaS infrastructure that needs separate authz.

The skill does NOT perform DNS resolution or network probing — that would itself be a "first probe" of the target, which by the governance model must happen AFTER scope is locked.

When the skill produces findings

Finding	Severity	Threshold	Affected control
Malformed target syntax	HIGH	Entry doesn't parse as host / CIDR / URL / account-id	(legal)
In-scope overlaps out-of-scope	CRITICAL	An in-scope target falls within an out-of-scope CIDR	(legal)
Reserved range without acknowledgement	HIGH	RFC1918, link-local (169.254/16), multicast (224/4), broadcast in in-scope list	(operational)
Known third-party SaaS in scope	HIGH	In-scope IP matches a known SaaS range (AWS, Cloudflare, GitHub, etc.) without separate authz	(legal)
Duplicate target	INFO	Same target appears multiple times	(operational)
Wildcard subdomain (e.g. `*.acme.example`)	INFO	Wildcards expand at scan time	(informational)
All targets validated cleanly	INFO	Positive confirmation	(informational)

Prerequisites

Python 3.9+
ROE file at ./roe.yaml (or pass --roe FILE)
Optional .scope-extension.yaml listing additional targets added mid-engagement (each must reference an authz amendment)

Target syntax forms

Form	Example	Notes
Hostname	`app.acme.example`	DNS-resolvable name
Wildcard subdomain	`*.acme.example`	Resolved at scan time; flag for explicit acknowledgement
IPv4 address	`203.0.113.10`	Single host
IPv4 CIDR	`203.0.113.0/24`	Network range
IPv6 address	`2001:db8::10`	Single host
IPv6 CIDR	`2001:db8::/32`	Network range
URL with path	`https://app.acme.example/api/v2`	Path-restricted scope
Cloud account ID	`aws:123456789012` or `gcp:acme-prod`	Cloud control-plane scope
SaaS tenant	`okta:acme-corp` or `auth0:acme`	SaaS-tenant scope

Instructions

Step 1 — Provide the scope source

The skill reads the ROE's in_scope_targets and out_of_scope_targets sections by default. Override with --roe FILE if the engagement ROE isn't at the default path.

Step 2 — Run the scope definition

python3 ./scripts/define_scope.py --roe engagements/acme-2026-q2/roe.yaml

Options:

Usage: define_scope.py [OPTIONS]

Options:
  --roe FILE             Path to ROE YAML (default: ./roe.yaml)
  --emit-allowlist FILE  Write flat IP allowlist to FILE
  --emit-targets FILE    Write normalized target list to FILE
  --extension FILE       Additional scope extension YAML
  --output FILE          Findings output
  --format FMT           json | jsonl | markdown (default: markdown)
  --min-severity SEV     default info

Step 3 — Review the conflict report

CRITICAL findings (overlap between in-scope and out-of-scope) must be resolved before any scan runs. Either narrow the in-scope range or remove the out-of-scope overlap; the customer's authorizer decides which.

HIGH findings (malformed targets, third-party SaaS, reserved ranges) require explicit acknowledgement — either fix the entry or document in the ROE why the range is intentionally included.

Step 4 — Hand off the allowlist

python3 ./scripts/define_scope.py --roe engagements/acme-2026-q2/roe.yaml \
    --emit-allowlist /tmp/allowed-ips.txt \
    --emit-targets /tmp/normalized-targets.json

The allowlist file is one IP/CIDR per line, ready to paste into:

nmap: nmap -iL /tmp/allowed-ips.txt
AWS WAF rule: convert to JSON via your standard tooling
Burp Suite: paste into Target → Scope → Include
This pack's cluster 1 skills: pass via the target argument

Examples

Example 1 — Generate scope artifacts for a new engagement

python3 ./scripts/define_scope.py \
    --roe engagements/acme-2026-q2/roe.yaml \
    --emit-allowlist engagements/acme-2026-q2/scope/allowed-ips.txt \
    --emit-targets engagements/acme-2026-q2/scope/normalized-targets.json \
    --output engagements/acme-2026-q2/scope/scope-report.md

Example 2 — Validate a mid-engagement scope extension

python3 ./scripts/define_scope.py \
    --roe engagements/acme-2026-q2/roe.yaml \
    --extension engagements/acme-2026-q2/scope-extension-20260615.yaml

The extension YAML follows the same target format. The skill validates that every extension entry has an associated authorization reference and emits a CRITICAL finding for any extension entry that doesn't.

Example 3 — Pre-scan validation gate

python3 ./scripts/define_scope.py --roe engagements/acme-2026-q2/roe.yaml \
    --min-severity high \
    --format json --output /tmp/scope-issues.json
jq -e '. == []' /tmp/scope-issues.json || { echo "Scope issues block scan"; exit 1; }

Output

JSON / JSONL / Markdown per lib/report.py. Exit codes: 0 clean, 1 high/critical, 2 error.

Each Finding includes:

id — scope::<issue>::<target> (e.g. scope::malformed::foo[bar)
severity — CRITICAL / HIGH / MEDIUM / INFO
category — engagement-scope
summary — what's wrong with the entry
evidence — original entry, parsed form, conflict source, line in ROE

Error Handling

ROE missing → emits CRITICAL finding, exits 1.
In-scope section missing or empty → CRITICAL finding, exits 1.
Unparseable entry → HIGH finding per entry, scan continues for other entries.
Extension file referenced but missing → HIGH finding.
IPv6 CIDR with very large mask (e.g. ::/0) → CRITICAL — almost certainly a typo; refuse to expand.

Resources

references/THEORY.md — Why scope is the load-bearing artifact of pentest legality, target-type taxonomy, known SaaS-range classification (AWS, Cloudflare, GCP, Azure), DNS resolution policy (when/whether to resolve at scope-definition time), CIDR-overlap detection theory
references/PLAYBOOK.md — Per-engagement-type scope templates (web app, internal network, red team, cloud account, SaaS tenant), scope-extension protocol, allowlist-emission patterns per scanner, common scope-mistake patterns