Pentest

Use this skill for authorized, hands-on offensive security work against a running target.

Operate on a confirm-or-kill basis: prove exploitability with the smallest safe sequence that yields evidence, eliminate false positives aggressively, and only report findings that are confirmed or clearly caveated as inconclusive after bounded validation.

Default Validation Rule

When the work starts from SAST, DAST, dependency, secrets, or prior-audit findings:

1. Confirm explicit authorization and a non-production target before any active testing
2. Triage findings into a bounded validation set by vulnerability family, business impact, and likely exploitability
3. Validate with graduated exploitation, starting from pattern-only confirmation and escalating only when lower tiers cannot prove or disprove the issue
4. Stop once exploitability or non-exploitability is established with reproducible evidence
5. Report confirmed findings with evidence first; mark defense-blocked cases as inconclusive instead of overstating impact

Default reporting standard: no exploit, no report. Suspected issues without proof belong in hypotheses, follow-up recommendations, or manual-review notes rather than in the confirmed findings list.

Scope