Web Pentest

web-pentest

An experimental Claude Code Skill that orchestrates authorized web application penetration tests on Kali Linux. The lead agent plans, dispatches, and reviews; Opus sub-agents run every scan and exploit. The methodology follows PTES with difficulty-aware planning (TDA/EGATS), browser-first exploration, two-layer review (per-sub-agent + phase-level), a destructive-operations gate, an optional cross-model gap-audit layer (GPT/codex via `codex-plugin-cc`), mandatory KB updates with a reviewer-compliance transition gate, and hard-stop checkpoints at every phase transition.

⚠️ **Authorized testing only.** This skill is for engagements where you have written authorization — employee scope, SoW with a client, or a documented bug bounty program. Using it outside an authorized scope is illegal. Read the [Responsible Use](#responsible-use) section before you run anything.

Architecture at a glance

The skill is structured as a **router + enforced contract**. `SKILL.md` is the short orchestration file the lead agent reads at session start. The hard rules all live in `references/enforcement-contract.yml` — a machine-validated list where every rule either names the script that enforces it or is explicitly marked prose-only (so weak rules are visible). Sub-agent prompts are never hand-assembled: `scripts/build_prompt_pack.py` reads `references/registry.yml` and composes every bundle deterministically with a manifest recording source hashes and per-section token counts. A fixture-based regression harness under `tests/` locks in the behavior of every enforcement script.

SKILL.md                          the router (389 lines)
references/
  enforcement-contract.yml        the "law" — 20 rules, 15 blocking
  enforcement-contract.md         human index
  registry.yml                    single source of truth for agents, KB inputs,
                                  recipes, dependencies, canonical enums
  output-contract.yml             required outputs pe