pentest git:20260926.0df99daA

Immutable. This exact content never changes and is served at /api/v1/blob/31f7a7889b41cb74.

---
name: pentest
description: "Authorised dynamic security testing of the project's OWN application (dev/staging or explicitly approved prod) — OWASP ZAP baseline/API scan (OpenAPI/GraphQL), Nuclei, Schemathesis fuzzing, testssl.sh, nmap on the project's own host, manual OWASP checks for auth/IDOR/GraphQL limits; report with CVSS and fixes in docs/security/pentest-<date>.md. Scope must be confirmed first."
argument-hint: "[target-url] [--scope dev|staging|prod] [--quick]"
user-invocable: true
allowed-tools: Read, Glob, Grep, Bash, Write, Task, AskUserQuestion
model: sonnet
agent: appsec-engineer
---

# Pentest (the project's own application)

Reply in the project conversation language (CLAUDE.md → Language); code, identifiers, paths and commit messages stay in English.

Templates `templates/pentest-report.md`, `findings.md`; reference `stack-reference/security-standards.md`. **The scope is fixed before the first request**: only the project's own hosts/domains from technical-preferences/deployment docs; production only with an explicit "yes" and in an agreed window. Targets outside the project are refused.

## Phase 1: Scope and confirmation
`AskUserQuestion`: target (URL), environment, window, accounts for authenticated checks, exclusions (payments, e-mails). Record the scope as the report's first section.

## Phase 2: Tools (whatever is installed; otherwise docker images with consent)
ZAP baseline → full/API scan (OpenAPI or GraphQL introspection on dev); Nuclei (web/misconfig templates); Schemathesis on OpenAPI / GraphQL fuzzing; `testssl.sh`; `nmap -sV` on the project's own host; manual checks: IDOR (two accounts), GraphQL field permissions, depth/batching limits, login rate limit, password reset, uploads, CSRF/CORS, headers.
`--quick` — ZAP baseline + headers + testssl only.

## Phase 3: Findings
Severity/CVSS, steps, evidence (no secrets), fix (code/config), verification after the fix; "clean" areas listed.

## Phase 4: Write
1. Show the report in the chat, then "May I write `docs/security/pentest-<date>.md`?" — one `AskUserQuestion`: write (Recommended) · show the draft/diff first · not now. After the "write" answer: `touch .claude/.write-consent` (rule 7 — the consent-guard hook checks the marker).
2. For every Critical and High finding (and every Medium that needs a decision), one `AskUserQuestion`: record it in `production/findings.md` (template `findings.md`; id `SEC-NNN`, severity, area/feature, the decision needed, source column pointing at the pentest report) (Recommended) · story stubs now via `/create-stories` · report only. The "record" answer is the "May I write `production/findings.md`?" consent: `touch .claude/.write-consent` after it, then write the row. `/create-stories`, `/sprint-plan` and `/help` read `production/findings.md`, so a finding left only in the report never reaches planning.
3. A Critical or High finding that is neither recorded nor turned into a story is named as such in the verdict line.

## Phase 5: Commit (documents lane)
Right after the write (and the findings rows, when any were recorded), one commit gate (rule 7 (4), `.claude/docs/git-workflow.md` § Documents): `docs: pentest <date>`, staging exactly the written files — `docs/security/pentest-<date>.md` and `production/findings.md` when rows were added.
- On the default branch when no story work is in progress: one `AskUserQuestion` — commit (Recommended) · leave uncommitted.
- When HEAD is a story branch, name it and ask one `AskUserQuestion`: switch to the default branch and commit there (Recommended — a pipeline-wide document) · commit here (the document belongs to this story) · leave uncommitted.
- Scan configs or scripts created for the run (a ZAP context, a Schemathesis hook, a compose fragment for the scanner images) are not documents: they never ride the `docs:` commit — name them and offer the chore lane (git-workflow.md § Chore / infra).

Nothing is committed without the answer.

Verdict: `PASS` | `FINDINGS (C/H/M/L)`. Next step — one `AskUserQuestion`: fixes, then `/pentest --quick` again (Recommended) · `/harden` · report only.