pentest · diff
git:20260614.1a96c1b to git:20260618.cc4a876
24 added, 32 removed. Audit F to F.
---
name: pentest
description: "PTES-aligned adversarial security audit for backend, frontend, and mobile applications. Produces a CVSS-scored Hacker Report with verified PoCs and phased remediation."
metadata:
triggers:
keywords:
- pentest
- workflow
---
# Pentest Skill
> [!IMPORTANT]
> PTES-aligned adversarial security audit for backend, frontend, and mobile applications. Produces a CVSS-scored Hacker Report with verified PoCs and phased remediation.
Optional args: slug=<feature>, ticket=<id/url>, mode=interactive|autonomous|channel, channel=<id>, auto_continue=true|false.
## Instructions
When the user asks to perform this workflow, execute the following steps:
# 🕵️♂️ Penetration Test (PTES-Aligned)
- Goal: Execute a 7-phase red-team assessment across backend APIs, frontend web apps, and mobile clients. Deliver an audit-grade Hacker Score (0-100) with verified Proof-of-Concept exploits and per-finding remediation.
+ Goal: Execute a red-team assessment across backend, frontend, and mobile targets with verified PoCs and audit-grade evidence.
## Steps
- 1. **Phase 0 — Scope & Authorization**:
+ 1. Scope and authorization:
- Determine mode (`whitebox`, `greybox`, `blackbox`) and targets.
- - Verify explicit authorization. **Stop if unauthorized.**
- 2. **Phase 1 — Intel Gathering (Recon)**:
- - Identify tech stack, endpoints, parameters, local storage, schemes, and secrets.
- - Use `common-security-audit` and `common-dast-tooling`.
- 3. **Phase 2 — Threat Modeling**:
- - Rank endpoints by risk: `exposure × sensitivity × auth_coverage`.
- - Prioritize attack plan (top-10 highest-risk endpoints).
- 4. **Phase 3 — Vulnerability Analysis**:
- - Run vulnerability scans.
- - Delegate: SAST/SCA to `specialist-aspm-correlator`, dynamic/logic to `specialist-logic-hacker`, binary/mobile to `specialist-mobile-reverser`.
- 5. **Phase 4 — Exploitation (PoC-Required)**:
- - **Policy: No Exploit = No Report.** Unverified findings are discarded.
- - Construct reproducible PoC for each confirmed vulnerability.
- 6. **Phase 5 — Post-Exploitation**:
- - Assess blast radius: lateral movement, privilege escalation, data exfiltration, persistence.
- 7. **Phase 6 — Hacker Score & Reporting**:
- - Score: Deduct from 100: Critical -25 (cap 25), High -15 (cap 40), Medium -8, Low -3.
+ - Verify explicit authorization; stop if unauthorized.
+
+ 2. Intel and threat model:
+ - Identify stack, endpoints, parameters, local storage, schemes, and secrets.
+ - Use `common-security-audit`, `common-dast-tooling`, and architecture docs when available.
+ - Map trust boundaries, secrets, external integrations, and privileged workflows before exploit attempts.
+
+ 3. Vulnerability analysis:
+ - Run scans and delegate: SAST/SCA to `specialist-aspm-correlator`, dynamic/logic to `specialist-logic-hacker`, binary/mobile to `specialist-mobile-reverser`.
+ - Rank targets by `exposure × sensitivity × auth_coverage`.
+
+ 4. Exploit verification:
+ - **No Exploit = No Report.** Discard unverified findings.
+ - Build reproducible PoCs and record preconditions, payloads, evidence, and blast radius.
+
+ 5. Reporting:
+ - Write `artifacts/security-review.md` with assumptions, source provenance, review context, runtime contract, PoCs, blast radius, finding confidence, exploit path, evidence gaps, and handoff notes.
+ - Emit `artifacts/security-review.dev.md`, `artifacts/security-review.appsec.md`, or `artifacts/security-review.exec.md` only when leadership, client, or AppSec reporting is in scope.
+ - Score from 100: Critical -25 (cap 25), High -15 (cap 40), Medium -8, Low -3.
+ - Reuse the existing `security-review.md` record when pentest follows earlier design or PR security review work.
- Deliver findings in the standard template below.
## Output Template
### Executive Summary
- **Hacker Score**: X/100 ([Critical/Vulnerable/Moderate/Hardened])
- **Target Scope**: [repos, URLs, mobile apps]
- **Findings**: [Critical/High/Medium/Low counts]
### Findings Table
| ID | Title | Platform | Severity | CVSS | CWE | PoC |
- |---|---|---|---|---|---|---|
- | SEC-01 | | [backend|frontend|mobile] | [Critical|High|Medium|Low] | | | [Yes|No] |
-
- ### Finding Details
-
- #### SEC-[ID]: [Title]
- - **Affected Component**: [file:line or endpoint]
- - **Proof of Concept**:
- - Preconditions: [auth, configuration]
- - Steps: [command/payload, expected vs actual]
- - Evidence: [response, screenshot, logs]
- - **Impact & Blast Radius**: [access, lateral movement]
- - **Remediation**: [specific code fix, diff, or configuration change]
+ | --- | --- | --- | --- | --- | --- | --- |
+ | SEC-01 | [title] | [backend\|frontend\|mobile] | [Critical\|High\|Medium\|Low] | [score] | [CWE-id] | [Yes\|No] |