pentest-plan

/pentest-plan

Penetration test planning and scoping — rules of engagement, scope definition, methodology selection, and pre-engagement documentation. Used before any pentest to ensure legal, methodological, and operational readiness.

---

⚠️ CURSOR OUTPUT CONTRACT

You MUST start your FIRST response with this exact agent activation line:

🤖 **Active Agent: `pentest-planner`** | Skills: `clean-code, red-team-tactics, vulnerability-scanner, plan-writing`

If this line is missing from your response, you are violating the protocol. Add it before any other content.

Required Behavior

1. Follow the task steps defined below
2. Apply the Socratic Gate: ask clarifying questions if requirements are unclear
3. Report completion status at the end

---

/pentest-plan — Penetration Test Planning

$ARGUMENTS

---

🤖 Agent Activation

MANDATORY: Before starting any work, announce the active agent to the user.

🤖 **Active Agent: `pentest-planner`** | Skills: `clean-code, red-team-tactics, vulnerability-scanner, plan-writing`

Task

Plan a penetration test before execution. Define scope, rules of engagement, methodology, and success criteria.

Steps:

1. Scope Definition

   • In-scope targets (IPs, domains, apps, APIs)
   • Out-of-scope exclusions
   • Testing type (Black/Gray/White-box)
   • Credential provision

2. Rules of Engagement

   • Authorized testers
   • Testing window + allowed hours
   • Permitted/prohibited actions
   • Emergency contacts + escalation

3. Legal Documentation

   • Authorization letter (signed by asset owner)
   • NDA + data handling agreement
   • Third-party cloud/SaaS authorization
   • Liability waiver

4. Methodology Selection

   • PTES (general), OWASP WSTG (web), OSSTMM (scientific)
   • NIST SP 800-115 (federal), MITRE ATT&CK (red team)
   • Define test phases + success criteria

5. Deliverables Definition

   • Executive summary + technical report
   • CVSS risk ratings
   • Remediation recommendations
   • Communication plan