pentest

name	pentest
description	Run security tests against the live target. Use when: 'pentest', 'security scan', 'check for vulns', 'run headers', 'is the vuln fixed', 'security audit', 'install pentest-kit'.
argument-hint	[target] [--module name]
allowed-tools	Read Grep Glob Bash
effort	high

User Input

$ARGUMENTS

You MUST consider the user input before proceeding (if not empty).

Purpose

Install pentest-kit for a new project, or run security tests against a live target using the regression suite (suite/). Handles both first-time setup and ongoing scan operations.

Input can be:

• New project setup: install, set up pentesting for https://my-app.example.com
• Target + module: app headers, infra nmap, app --module ssrf
• Full scan: app (all non-skipped modules)
• Targeted: check if SSRF is fixed, test rate limit bypass

Two-Harness Model

pentest-kit has two harnesses:

Harness	When to use	Command
Regression suite (suite/)	Every deploy — deterministic bash modules, fast	pentest.sh run <target>
HexStrike (hexstrike/)	Weekly or post-feature — Claude + 150 tools, broad exploration	./hexstrike/harness.sh

Use this skill for the regression suite. For exploratory HexStrike rounds, use /pentest-review after a round completes.

First-Time Install

If the user hasn't set up pentest-kit yet:

# 1. Clone and set up
git clone https://github.com/matthewdeaves/pentest-kit ~/pentest-kit
cd ~/pentest-kit && ./setup.sh

# 2. Scaffold the consumer
~/pentest-kit/scripts/init-consumer.sh /path/to/your/app

# 3. Edit the generated YAML
# pentest/targets/example.yaml — set url, auth_mode
# endpoint_groups: — configure what your app exposes (see below)

# 4. First scan
/path/to/your/app/pentest/pentest.sh run example

Configuring endpoint_groups

Kit modules SKIP gracefully when endpoint groups are not configured — they never probe cookie-shaped paths. Configure the groups that match your app:

# pentest/targets/myapp.yaml
endpoint_groups:
  mode_endpoint:          # GET that sets the CSRF cookie
    - /api/csrf/
  auth_check:             # cheap GET returning 200 authed / 401 anon
    - /api/auth/me/
  logout_endpoint:
    - /api/auth/logout/
  sessionauth_api_endpoints:  # must return 401/403 unauth
    - GET:/api/posts/
    - GET:/api/users/
  idor_resources:         # resource base paths for IDOR + method tests
    - /api/posts/
    - /api/users/
  ssrf_target_path:       # user-input-URL fetcher (if your app has one)
    - /api/import/

See suite/targets/app.example.yaml for the full schema with all keys documented.

Pre-flight

Before scanning:

command -v nmap curl ffuf nuclei sqlmap

Missing tools will fall back to the hexstrike-ai container if it's running. Start it with ./hexstrike/launch.sh.

Full Scan

./pentest/pentest.sh run <target>

Full scans take 15-30+ minutes — always use run_in_background: true.

Produce a summary when complete:

## Pentest Complete: <target>

**Duration**: Xm Ys
**Modules**: N completed, N skipped

| Module | Status | Pass | Fail | Skip | Duration |
|--------|--------|------|------|------|----------|

**Findings**: N failures — run `/pentest-review` for full analysis.

Targeted Investigation

When asked about a specific vulnerability:

1. Read the target YAML for current known state
2. Run only the relevant module: ./pentest/pentest.sh run app --module ssrf
3. Compare against known_vulnerabilities
4. Give a clear YES/NO with evidence

Rules

1. Full scans run in background. Single modules run in foreground.
2. Respect rate limits. Use --rate 10 for gentler scanning.
3. Never log session tokens, API keys, or credentials in the main context.
4. Modules that mutate state (api, injection) are tagged # kit:destructive — they are skipped for production: true targets unless --allow-destructive is passed.
5. Deep analysis is /pentest-review's job — this skill runs scans and gives a quick summary.