pentest_skill

Overview

This skill is a penetration testing orchestrator that coordinates specialized attack agents, produces structured reconnaissance, and generates final deliverables. It focuses on engagement planning, safe delegation to executor agents, and clean report packaging. Use it to plan assessments, run coordinated tests, and produce machine-readable and DOCX reports.

How this skill works

The skill gathers scope and creates an engagement workspace, then runs reconnaissance tools per asset type and assembles inventory files. It prepares a mandatory test plan for user approval, then deploys approved executor agents in parallel to perform vulnerability testing. Findings are aggregated, deduplicated, severity-scored, and exported into a final report structure with DOCX output and an appendix of evidence.

When to use it

• Planning a penetration test or bug bounty engagement
• Coordinating multiple specialized attack agents (SQLi, XSS, SSRF, etc.)
• Producing standardized reconnaissance and final report deliverables
• Creating reproducible, machine-readable test artifacts (.json, .docx)
• When you need strict workspace and reporting hygiene for auditors or clients

Best practices

• Always define scope, testing windows, and explicit restrictions before reconnaissance
• Do not proceed past planning without explicit user approval of the test plan
• Delegate execution to specialized agents; the orchestrator never runs attacks directly
• Keep all intermediate files under processed/ and final deliverables under report/ only
• Require working PoC evidence and NDJSON activity logs from each executor for traceability

Example use cases

• Coordinate a web app assessment: run web recon, deploy XSS and SQLi agents, aggregate findings
• Run a cloud security review: discover S3 buckets, deploy cloud-specific agents, and document misconfigurations
• Plan a bug bounty sprint: generate an attack index and map executors to prioritized targets
• Produce a client-ready pen test report: transform intermediate artifacts into a DOCX deliverable with appendix evidence
• Perform iterative testing: spawn new executors for discoveries while tracking approvals and logs