Pentest Validation

<default_to_action> When validating security findings:

1. REQUIRE explicit authorization for target URL
2. SCAN with qe-security-scanner (SAST + dependency + secrets)
3. ANALYZE with qe-security-reviewer + qe-security-auditor (parallel)
4. VALIDATE with qe-pentest-validator (graduated exploitation, parallel per vuln type)
5. REPORT only confirmed findings with PoC evidence ("No Exploit, No Report")
6. UPDATE exploit playbook with new patterns

Quality Gates:

• Authorization confirmed before ANY exploitation
• Target URL is staging/dev (NOT production)
• Budget cap enforced ($15 default)
• Time cap enforced (30 min default)
• All exploitation attempts logged </default_to_action>

Quick Reference Card

The 4-Phase Pipeline

Graduated Exploitation Tiers

When to Use This Skill

Configuration

pentest:
  target_url: https://staging.app.com    # REQUIRED for Tier 2-3
  source_repo: ./src                      # REQUIRED for Tier 1+
  exploitation_tier: 2                    # 1=pattern-only, 2=payload-test, 3=full-exploit
  vuln_types:                             # Which pipelines to run
    - injection                           # SQL, NoSQL, command injection
    - xss                                 # Reflected, stored, DOM XSS
    - auth                                # Auth bypass, session, JWT
    - ssrf                                # URL scheme abuse, metadata
  max_cost_usd: 15                        # Budget cap per run
  timeout_minutes: 30                     # Time cap per run
  require_authorization: true             # MUST confirm target ownership
  no_production: true                     # Block production URLs
  production_patterns:                    # URL patterns to block
    - "*.prod.*"
    - "api.*"
    - "www.*"

Safeguards (Mandatory)

Authorization Gate

Every pentest validation run MUST:

1. Display target URL and exploitation tier to user
2. Require explicit confirmation: "I own/authorized testing of this target"
3. Log authorization with timestamp
4. Block if target URL matches production patterns

What This Skill Does NOT Do

• Full autonomous reconnaissance (Nmap, Subfinder)
• Zero-day exploit development
• Attack targets without explicit authorization
• Test production systems
• Store actual exfiltrated data (only proof of access)
• Social engineering or phishing simulation
• Port scanning or service discovery

Validation Pipelines

Injection Pipeline

' OR '1'='1

$where

$gt

exec()

system()

XSS Pipeline

<img onerror>

innerHTML

document.write(location)

Auth Pipeline

SSRF Pipeline

http://169.254.169.254

file:///etc/passwd

Agent Coordination

Orchestration Pattern

// Phase 1: Recon (parallel scans)
await Task("Security Scan", {
  target: "./src",
  layers: { sast: true, dast: true, dependencies: true, secrets: true }
}, "qe-security-scanner");

// Phase 2: Analysis (parallel review)
await Promise.all([
  Task("Code Security Review", {
    findings: phase1Results,
    depth: "comprehensive"
  }, "qe-security-reviewer"),

  Task("Compliance Audit", {
    findings: phase1Results,
    frameworks: ["owasp-top-10"]
  }, "qe-security-auditor")
]);

// Phase 3: Validation (graduated exploitation)
await Task("Exploit Validation", {
  findings: [...phase1Results, ...phase2Results],
  target_url: "https://staging.app.com",
  exploitation_tier: 2,
  vuln_types: ["injection", "xss", "auth", "ssrf"],
  max_cost_usd: 15,
  timeout_minutes: 30
}, "qe-pentest-validator");

// Phase 4: Report ("No Exploit, No Report" gate)
await Task("Security Quality Gate", {
  findings: phase3Results.confirmedFindings,
  gate: "no-exploit-no-report",
  require_poc: true
}, "qe-quality-gate");

Finding Classification

confirmed-exploitable

likely-exploitable

not-exploitable

inconclusive

Exploit Playbook Memory

Namespace Structure

aqe/pentest/
 playbook/
  exploit/{vuln_type}/{tech_stack}/{technique}
  bypass/{defense_type}/{technique}
  payload/{vuln_type}/{variant}
 results/
  validation-{timestamp}
 poc/
  {finding_id}-poc

Learning Loop

1. Before validation: Query playbook for known patterns matching findings
2. During validation: Try known payloads first (higher success rate)
3. After validation: Store new successful patterns with confidence scores
4. Over time: Agent converges on most effective payloads per tech stack

Cost Optimization

Estimated Cost by Scenario

Cost vs Shannon Comparison

Success Metrics

Related Skills

• security-testing - OWASP vulnerability scanning, SAST/DAST automation
• compliance-testing - Regulatory compliance
• api-testing-patterns - API security testing
• chaos-engineering-resilience - Security under chaos

Remember

"No Exploit, No Report." A vulnerability scanner that can't prove exploitation delivers uncertain value. This skill transforms security findings from theoretical risks into proven vulnerabilities with evidence. Every confirmed finding comes with a reproducible proof-of-concept. Every false positive is eliminated before it reaches the report.

Think proof, not prediction. Don't report what MIGHT be vulnerable. Prove what IS vulnerable.