pentest-mcp: Skill for Claude Code

Propose a new change - create the change and generate all artifacts in one step.

Planning boundary: This workflow creates planning artifacts only. The user request that selected or triggered this workflow authorizes planning only, even if it asks to build or fix something. Do not edit project code. After the planning artifacts are complete, stop. Do not start implementation in the same response, even if the initial request asks for it. Wait for a new user request after the artifacts are presented; then start the apply workflow.

I'll create a change with the artifacts your schema defines. With the default spec-driven schema that is:

• proposal.md (what & why)
• specs/<capability-path>/spec.md (what the system must do - a delta, not the main spec)
• design.md (how)
• tasks.md (implementation steps)

<capability-path> is the spec directory relative to specs/ (for example, user-auth or identity/user-auth). Preserve an existing capability's full path and follow the project's established organization for new capabilities.

When the user is ready to implement, they must start the apply workflow explicitly.

---

Store selection: If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run openspec store list --json to discover registered store ids, then pass --store <id> on the commands that read or write specs and changes (new change, status, instructions, list, show, validate, archive, doctor, context, schemas, view). Once selected, treat --store <id> as sticky for the rest of the workflow. Every unscoped example of those commands below is shorthand: before running it, append the flag. For example, run openspec status --change "<name>" --json --store "<id>", not the unscoped form shown below. Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local openspec/ root.

Input: The user's request should include a change name (kebab-case) OR a description of what they want to build.

Steps

1. Understand the request and clarify material ambiguity

   If no clear input is provided, ask the user (open-ended, no preset options):

   "What change do you want to work on? Describe what you want to build or fix."

   From their description, derive a kebab-case name (e.g., "add user authentication" → add-user-auth).

   IMPORTANT: Do NOT proceed without understanding what the user wants to build.

   If the request contains ambiguity that would materially affect scope, externally observable behavior, compatibility, or acceptance criteria, ask the user before creating the change. For minor details, make a reasonable assumption and record it in the planning artifacts.

2. Determine the workflow schema

   Use the configured default schema unless the user explicitly requests a different workflow.

   Use a different schema only if the user:

   • Explicitly requests a specific schema by name → use --schema <schema-name>
   • Asks to "show workflows" or asks "what workflows" exist → resolve the authoritative root by running openspec context --json from the current working directory. If the user explicitly selected a registered store, use openspec context --json --store "<store-id>". Then run openspec schemas --json with its working directory set to the returned root.path and let them choose. This preserves roots selected by a local store: pointer or the global defaultStore; when a registered store was explicitly selected, append --store "<store-id>" to openspec schemas --json as well. If context reports only no_openspec_root, run openspec schemas --json from the current working directory instead. Do not use this fallback for invalid or unavailable stores.

   Otherwise, omit --schema to preserve the configured default.

3. Create the change directory

   Choose one schema form below. If a registered store is selected, append --store "<store-id>" to that command and each later OpenSpec command shown below that accepts --store.