10x-pentest: Skill for Claude Code

/pt-dynamic-run — Local Executor (Stage 4)

Execute the dynamic/test-plan.md runbook from this machine — the alternative to the human running the tools. For each eligible TC-NNN, resolve case.tool via environment/tool-registry.md to a concrete backend (local binary / Docker container / MCP call), enforce scope + the auto-exec ceiling at run time, run it, and write the identical dynamic/evidence/<TC>/ structure a human would (raw output + run.md). Then hand to /pt-dynamic-analyze — which is unchanged, because it reads evidence and does not care who produced it. This skill fills exactly the seam the human fills.

When to use, when to skip

• Use after /pt-dynamic-plan has written the runbook AND /pt-tools has configured a registry, when you want the agent (not the human) to run the cases.
• Skip — and let the human run the cases — when there is no registry, when the operator prefers manual execution, or for cases the registry can't reach. Manual and local execution are interchangeable at the evidence seam; you may even split a runbook between them.

Initial Response

• With <engagement-id>: proceed to Step 0.
• Without: print Usage: /pt-dynamic-run <engagement-id> [--only TC-NNN,...] [--dry-run]. and STOP.

Inputs

• dynamic/test-plan.md — [blocking] (the planned cases to run).
• environment/tool-registry.md — [blocking] (tool → backend resolution + auto-exec policy). Absent ⇒ STOP: run /pt-tools first or execute manually.
• scope.md — [blocking] (RoE; destructive_policy and in-scope assets A-NNN / Exclusions — enforced per case).
• target-profile.md — [optional] (network reachability hints).
• environment/secrets.env (tool-registry secrets_ref) — [optional] — sourced into the run-time env; commands/args reference $U<n> (= scope account U-00<n>) / ${TOKEN}; only names go into run.md, never values (tool-registry-schema §4.1).