Security Pentester skill

Security Pentester

Disambiguation: this skill = active offensive testing. For defensive code patterns see security-hardening. For runtime threat intel / URL+wallet scam scanning see security-sentinel.

Autonomous web application penetration testing driven by an LLM-agent pipeline (Shannon), backed by manual validation. Source-aware analysis combines code reading with live exploitation attempts and prioritizes findings that come with a reproducible proof-of-concept.

This skill is tool-agnostic in principle: Shannon is the reference automated driver, but the workflow (recon → analyze → exploit → triage → remediate → regression-test) and every remediation playbook below apply to any pentest engagement (manual, Burp/ZAP-driven, or other agents).

Scope first. Only run against applications you own or have explicit written authorization to test, and never against production. See §8 for the full rules of engagement.

Safety gate

Before executing commands or changing external systems, confirm scope, credentials, target environment, rollback, and required approval. Pin and verify third-party artifacts; never expose secrets to client code or logs.

Reference guide

Read only the references needed for the current request:

• Core Principle: references/core-principle.md
• 1. Vulnerability Coverage: references/1-vulnerability-coverage.md
• 2. Running a Pentest: references/2-running-a-pentest.md
• 3. Understanding the Pipeline: references/3-understanding-the-pipeline.md
• 4. Interpreting Reports: references/4-interpreting-reports.md
• [CRITICAL] SQL Injection in /api/users/search: references/critical-sql-injection-in-api-users-search.md
• 4a. Remediation Playbooks: references/4a-remediation-playbooks.md
• 5. CI/CD Integration: references/5-ci-cd-integration.md
• 6. Post-Pentest Workflow: references/6-post-pentest-workflow.md
• 7. What Shannon Doesn't Cover: references/7-what-shannon-doesn-t-cover.md
• 8. Safe Testing Practices: references/8-safe-testing-practices.md