pentest

name	pentest
description	Run security scans against Rockport deployment. Use when the user says 'pentest', 'security scan', 'check for vulns', 'test WAF', 'security audit', 'run pentest', or 'scan rockport'.
user-invocable	true
argument-hint	[target] [--module name] [--skip modules] [--rate n]
allowed-tools	Read, Grep, Glob, Bash, Agent
effort	high

User Input

$ARGUMENTS

You MUST consider the user input before proceeding (if not empty).

Purpose

Run security tests against the live Rockport deployment and produce a classified findings report.

Workflow

Pre-Flight

1. Check tool availability: Run which curl jq terraform aws and check pentest/tools/ for optional tools (ffuf, nuclei, testssl.sh). Report what's available. Note: terraform and aws are required for auth bootstrap and the infra module

Phase 1: Run Scan

Parse arguments from user input:

• Default target: rockport
• Extract --module, --skip, --rate flags if present
• For destructive modules (injection), add --yes only if user explicitly confirmed

For full scans, run in a background subagent (avoids timeout issues):

cd pentest && ./pentest.sh run rockport [options]

Phase 2: Report Results

After the scan completes, produce a quick module status table from results.json:

REPORT=$(ls -td pentest/reports/rockport/*/ 2>/dev/null | head -1)
jq -r '.modules[] | "\(.module)\t\(.status)\tP:\(.pass) F:\(.fail) S:\(.skip) I:\(.info)\t\(.duration)s"' "$REPORT/results.json"

Output Format

## Pentest Scan Complete: <target>

**Date**: <timestamp>
**Modules**: N run, N passed, N failed, N skipped

### Module Summary

| Module | Status | Duration | Pass | Fail | Skip |
|--------|--------|----------|------|------|------|
| ...    | ...    | ...      | ...  | ...  | ...  |

Run `/pentest-review` for deep analysis and finding classification.

Rules

• Use run_in_background: true for full scans to avoid timeout issues
• Respect rate limits — default 50 req/s, lower for auth endpoints
• Never store credentials in report files
• For destructive modules (injection), add --yes only if user explicitly confirmed
• Never generate images or videos during scans (cost control)
• Analysis and classification belong in /pentest-review, not here