1. NOW

   : Read

   ../field-journal/precedent-pentest.md

   — Confirm that the operations of this skill are authorized routine operations

2. NOW

   : Confirm that scope.md exists and

   auth.status=granted

   ,

   network_profile

   is valid (

   ../ops/scope-contract.md

   ); otherwise run

   case-init.ps1 -AuthGranted -TargetUrl <url> -NetworkProfile authorized_target_only

3. NOW

   : Confirm whether the current task falls within the applicable scope of this skill

4. NEXT

   : Read

   ../tool-index.md

   to verify tool availability and actual paths

5. NEXT

   : Call bootstrap when tools are missing, do not guess paths

6. ACT

   : Prioritize

   references/recon-pipeline.md

   during reconnaissance phase (CF browser headers / Windows nmap / curl

   --globoff

   ); append results to

   timeline.md

   in batches; use

   ../scripts/append-evidence.ps1

   to write Evidence if applicable (hit ≠ verified)

7. ACT

   : Modern web/lab client-side scenarios (DOM XSS / prototype pollution / agent-browser) →

   references/client-side-lab-playbook.md

   ; write observed Evidence + failure latch even if exploitation fails

• Target information gathering (port scanning, subdomain enumeration, service identification)
• Vulnerability scanning (web vulnerabilities, CVE detection, configuration errors)
• Web penetration (SQL injection, XSS, SSRF, directory brute-forcing)
• Password cracking (hash cracking, dictionary attacks)
• Network penetration (service exploitation, lateral movement assistance)

ida-reverse/

radare2/

js-reverse/

browser-automation/

CTF-Sandbox-Orchestrator/

• Need to "scan targets, discover vulnerabilities, exploit vulnerabilities" → This skill
• Need to "analyze internal program logic" → Reverse engineering skills
• Need to "operate browser/desktop" → browser-automation

• Project: https://github.com/ramkansal/pentestmcp
• Features: Packages over 20 tools into a single Docker container, directly exposed via MCP server
• Tools: Nmap, Nuclei, ZAP, SQLMap, FFUF, Nikto, Gobuster, Subfinder, httpx, etc.
• Installation:

undefined

• Project: https://github.com/FuzzingLabs/mcp-security-hub
• Features: Each tool has an independent MCP server, enable on demand
• Tools: Nmap, Ghidra, Nuclei, SQLMap, Hashcat
• Installation: Follow the README of each submodule

powershell -NoProfile -ExecutionPolicy Bypass -File skills\scripts\bootstrap-reverse.ps1 -Capability reqable-mcp

{
  "mcpServers": {
    "reqable-mcp": {
      "command": "npx",
      "args": ["-y", "reqable-mcp-server@1.0.1", "--scope", "minimal"]
    }
  }
}

• Uses Reqable's local API by default; configure

  --host

  ,

  --port

  , or

  --scope minimal|all

  according to official documentation if necessary.

• minimal

  is the recommended default scope;

  all

  will expose more tools that can modify proxies, rules, environments, or saved data.
• Capturing traffic, request replay, and rule modification must still comply with the authorization and network restrictions in

  scope.md

  ; do not expand the target scope just because MCP is registered.

Important: When performing penetration testing, must run according to the autonomous loop framework in

references/pentest-loop.md

. This framework defines complete risk gating, recording specifications, context compression, and completion checking mechanisms.

1. Information Gathering
   - Nmap port scanning → Confirm open services
   - Subfinder subdomain enumeration → Expand attack surface
   - httpx liveliness detection → Filter valid targets

2. Vulnerability Scanning
   - Nuclei template scanning → Quickly discover known vulnerabilities
   - ZAP/Nikto → Deep web application scanning

3. Vulnerability Exploitation
   - SQLMap → SQL injection
   - FFUF → Discover hidden paths/parameters
   - Manual verification → Confirm exploitability

4. Post-Exploitation (if within authorized scope)
   - Privilege escalation
   - Lateral movement
   - Data extraction

5. Reporting
   - Call docs-generator skill to generate penetration testing report

• Authorization Required — All scanning/attack operations must be within authorized scope
• Control Scanning Rate — Avoid triggering WAF/IDS or crashing the target
• Passive Before Active — Gather information first, then scan for vulnerabilities, finally exploit
• Record All Operations — Record every command and result for reporting purposes
• Do Not Blindly Automate — AI should wait for confirmation at each critical step

1. If user has Docker → Recommend pentestMCP (one-click full suite)
2. If no Docker → Install tools individually on demand
3. Prioritize installing Nmap + Nuclei + SQLMap (covers 80% of scenarios)

• awesome-pentest — Penetration testing tool collection with 25k+ stars
• SecLists — Wordlist/payload collection (essential for FFUF/Gobuster)
• PayloadsAllTheThings — Various vulnerability payloads
• HackTricks — Encyclopedia of penetration techniques
• pentest-ai-agents — 35 Claude Code penetration sub-agents (refer to their prompt mode)
• Pentest Swarm AI — Swarm intelligence autonomous penetration framework (multi-agent collaboration, supports MCP server)
• ProxyCat — Proxy pool middleware (prevent IP blocking during batch scanning)
• planning-with-files — Task planning skill (for loop testing)

• references/pentest-loop.md

  — Core Loop Framework (risk gating + recording specifications + context compression)

• references/recon-pipeline.md

  — Authorized Reconnaissance Pipeline (CF headers / nmap / Evidence)

• references/client-side-lab-playbook.md

  — DOM XSS / prototype pollution / agent-browser (lab client-side scenarios)

• references/burpsuite-mcp-guide.md

  — Complete BurpSuite MCP Guide (63 tools + 7 usage scenarios + AI prompt templates)

• references/automation-loop-pattern.md

  — Automated loop testing pattern (lightweight version)

• references/awesome-pentest-digest.md

  — Quick reference for essential penetration tools

• references/pentest-ai-agents-matrix.md

  — 35-agent coverage matrix

• payloads/

  — Custom payload directory (AI priority use)

• templates/

  — Essential penetration testing file templates (scope/rules/plan/findings/progress)

src-hunter/

• 19 attack playbooks (IDOR, RCE, XSS, SQLi, SSRF, OAuth, file upload, etc.)
• 305 structured payloads + 263 WAF/EDR bypass steps
• 2887 disclosed High/Critical reports from HackerOne
• 88,636 statistical cases from WooYun history
• Domestic component fingerprints and default credentials
• CVSS 4.0 report template

src-hunter/SKILL.md

src-hunter/references/

skills/SKILL.md

routing.md

• Further analysis needed for discovered web vulnerabilities →

  js-reverse/

• Reverse engineering needed for discovered binary vulnerabilities →

  ida-reverse/

  or

  radare2/

• Browser operation needed to verify vulnerabilities →

  browser-automation/

• Generate report after completion →

  docs-generator/

CTF-Sandbox-Orchestrator/

• Have I executed every step in the workflow (not just read)?
• Have I used real tool paths based on

  tool-index

  ?
• Have I produced reproducible evidence (commands/scripts/screenshots/reports)?
• Have I completed and written back the Checklist items required by RULES?