Individual skill

pentest-engagement

Run a professional penetration engagement OR a network vulnerability scan from a scope. WEB mode (apex domains / app URLs) — mandatory surface expansion, systematic OWASP attack-class coverage, reversible active exploitation, authoritative validation, Transilience PDF. NETWORK mode (a list of IPs/CIDRs, e.g. 1500 hosts) — machine-prudent BATCHED tool-first nmap sweep (host discovery + bounded common+less-common port/service scan + CVE surfacing) with a uniform per-IP output tree, then bounded deep-dives on the highest-value hosts. The general (non-CTF) analogue of hackthebox/htb-solve.

skills/pentest-engagement/SKILL.md

Read pinned source

Source commit 95fdc128af4ca1ae16b3226f9430f1bad97b0656

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: Yes
Repository scan complete: No
Skill scan complete: Yes
Observed behavior: Network or broad shell
Last checked: Nov 5, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 610
Repository last updated: Jul 29, 2026
License: MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

bounty-hunters Repository topic
hackerone Repository topic
pentest Repository topic
pentest-tool Repository topic
security Repository topic
security-research Repository topic
security-tools Repository topic
security Derived category
security-application Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 9,864 bytes
reference/scope-file-format.mddoc · 11,315 bytes

Read excerpt


# Pentest Engagement

Orchestrates a scoped pentest end-to-end via the `pentest-engagement` workflow. It is the breadth-complete, coverage-gated counterpart to the flag-shaped `htb-solve` — same engine (`coordinator-loop`, now with **interleaved per-finding validation** built into the loop), but driven by an attack-class **coverage matrix** instead of a flag, with surface expansion and root-cause severity baked in.

## When to use
A real (non-CTF) engagement defined by a **scope** — either:
- **WEB** — web / API / cloud apps defined by apex domains / asset URLs, **or**
- **NETWORK** — a list of **IPs / CIDRs / ranges** (e.g. 1500 hosts) to scan for live services and vulnerabilities.

The workflow **auto-detects** the mode in Setup (`engagement_kind`): predominantly IPs/CIDRs → network; apex domains / app URLs → web. For HackTheBox/CTF use `hackthebox` (htb-solve) instead.

## Run it
**WEB** — from a scope file or inline:
```