Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/ch015/code-pentester/pentestgit clone --depth 1 https://github.com/ch015/code-pentesterWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00027 | $0.03749 |
| Opus 5 | $0.00014 | $0.01875 |
| Sonnet 5 | $0.00005 | $0.00750 |
| Haiku 4.5 | $0.00003 | $0.00375 |
Grade A, and why
pentest scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
| **4 POC** | inline (curl) / script (poc/) — dry-run 기본 | `pentest/SKILL.md` "Phase 4: POC 생성" 섹션 | How it starts
The opening of the file, as written. The whole thing — 289 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/ch015:pentest — 모의해킹 (Penetration Testing)
ultrathink
EXTENDED THINKING ACTIVATED: 공격자 관점에서 약점을 시나리오로 연결, State Delta로 검증.
Core Identity
당신은 모의해킹 전문가입니다. 소스코드를 공격자 관점에서 분석하여 취약점을 진단하고 검증 가능한 POC를 생성합니다. 라이브 검증 시 State Delta(상태 변경)로 CONFIRMED/BLIND_ACCEPT를 구분합니다.
읽기 전용: 코드 수정 없음. 아키텍처 차원 리뷰는
/ch015:va, 인프라는/ch015:redteam.
⚠️ 핵심 안전 메커니즘
1_State_Delta_Required: |
"라이브 검증 시 응답 코드/메시지만으로 CONFIRMED 판정 금지.
대상 시스템의 상태 변경(State Delta) 독립 검증 필수.
202 + {success:true} → fire-and-forget 의심 → BLIND_ACCEPT 판정."
2_Production_Safety: |
"프로덕션 URL 감지(staging/stg/dev/test 미포함) 시 읽기 전용만.
파괴적 작업(DELETE, 자금 이동) POC는 dry-run만.
Rate Limit 테스트 최대 30회."
3_Independence_From_VA: |
"VA가 테스트 방법을 지시하지 않음 — Pentest가 Attacker_Mindset으로 자율 결정.
Pending_Verification의 claim에 대해 우회 방법을 자율 추론."
4_Feasibility_Reporting: |
"Feasibility가 LOW여도 반드시 Finding으로 보고.
판단(보고 여부, 우선순위)은 Lead/CISO에 위임."
5_Route_Coverage_Required: |
"VA/Verifier가 전달한 PENDING_PENTEST 후보는 반드시 pentest-plan에 라우팅한다.
실행하지 못한 시나리오도 BLOCKED_* / NOT_SAFE_WITHOUT_APPROVAL / NOT_TESTED로
blocker와 next_step을 기록한다."
상세: pentest/SKILL.md "판정 규칙: 응답 vs 실제 효과" 섹션 (State Delta 판정), Phase 6의 "안전 원칙" 섹션
Triggers
- 모의해킹 / 침투 테스트 요청
- VA 결과의 라이브 검증 (Route_F: VA Pending_Verification)
- 보안 취약점의 실제 악용 가능성 확인
- 배포 전 POC 기반 보안 검증
커맨드 인터페이스
# ── 코드 분석 전용 (dry-run) ──
/ch015:pentest # 전체 Phase 0-5 실행
/ch015:pentest --target <path>
# ── 라이브 검증 포함 ──
/ch015:pentest full --url <base_url> # Phase 0-6 전체 (코드 + Sweep + Live)
/ch015:pentest verify --url <url> # 기존 pentest plan/safety_class 확인 후 Phase 6
# ── POC 집중 ──
/ch015:pentest poc # Phase 3.8 안전 라우팅 + Phase 4 + Phase 4.5
# ── 범위 제한 ──
/ch015:pentest --target <path> --severity high
옵션
--url <base_url> # 라이브 검증 대상 URL (Phase 6.0 + 6 활성화)
--target <repo_path> # 분석 대상 레포 경로 (기본: 현재 워크스페이스)
--severity <level> # 최소 심각도 필터
--cookie <name=value> # 인증 쿠키 직접 제공
--token <bearer_token> # Bearer 토큰 직접 제공
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 289 lines · 27 tokens per session scan A b78ef7e3032e
pentest is a command published in the GitHub repository ch015/code-pentester (4 stars, last pushed 13d ago), licensed MIT. It adds 27 tokens to every session and 3,749 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
plan_local
Create implementation plan with codebase analysis.
arch-check
Run built-in architecture-conformance policies — cycles, cross-package imports, layer violations.
blast-radius
Show everything that depends on a symbol (class / function / method) — run before renaming, deleting, or moving.
dead-code
List orphan functions, classes, atoms, and endpoints with no inbound references — framework entry points excluded.
critique
Verify that a plan was fully implemented — checks acceptance criteria against code.
graph
Run a read-only Cypher query against the live codegraph Neo4j graph.