10x-pentest: Skill for Claude Code

/pt-scope-review — Scope Quality Review

An independent critic for the scope. Where /pt-scope asks "are the required fields present?" (its mechanical readiness gate), this asks "is this scope actually sound, coherent, and sufficient to run a safe, useful test?" — with fresh eyes, so the producer isn't grading its own work.

Advisory, with triage. It does not hard-block /pt-recon; the producer's readiness gate is the hard floor. But errors here poison every downstream stage, so it's strongly recommended.

When to use, when to skip

• Use right after /pt-scope, before recon — a flawed scope costs the whole engagement.
• Skip only for a trivial re-scope you already trust. Advisory: you can proceed without it.

Initial Response

• <engagement-id> → review that engagement's scope (Step 0).
• A saved report path (contains <!-- PT-SCOPE-REVIEW -->) → resume triage (jump to Step 7).
• Without → print Usage: /pt-scope-review <engagement-id>. and STOP.

Inputs

• scope.md — [blocking] (the subject of review).
• engagement.md — [blocking] (retest lineage; authorization must be fresh on a retest).
• Source / environment — [optional] — to cross-check that stated assets/accounts are real.

Process

Step 1: Internal-consistency scan

Read scope.md fully against itself and scope-schema. Highest-value findings are contradictions the author half-noticed: e.g. environment: production + destructive_policy: full-exploit with no confirmation; dos_policy: forbidden but objectives imply stress; a validity window that ends before the stated testing window; box_type: white + repo_access: false.

Step 2: Grounding spot-checks

Verify a few claims are real, not asserted: in-scope assets resolve to actual targets; the provided U-NNN accounts exist / are obtainable; the authorization reference points to something.

Step 3: Deep independent verification

Re-derive rather than trust. Where the host supports parallel sub-agents, delegate; else inline: independently check the scope against a completeness rubric (are there in-scope-implied assets or account roles the operator forgot?) and, from code + already-gathered passive sources (never target-touching traffic), sample whether the stated scope matches the real system boundary (e.g. an in-code admin surface or subdomain the RoE should mention).