What problem does it solve? Manual penetration testing and security code audits are unstructured, easy to abandon early, and produce findings without evidence. This Skill turns an AI coding assistant into a coordinated security testing workflow with deterministic completion gates, cross-session findings persistence, and evidence-backed reporting. ## Core Features & Use Cases - Offensive engagement mode (Mode 1): Runs authorized pentests against live targets across 69 attack categories in 16 domains, with a target-first dialog flow, scope enforcement, preflight tool installation, a leads ledger that blocks completion while pathways remain unexplored, and per-vulnerability completion scoring. - Defensive code audit mode (Mode 2): Audits a local repository against 17 vulnerability categories (secrets exposure, RLS/database access, auth middleware, IDOR, SSRF, CSRF, SQLi, XSS, webhooks, file uploads, and more), writing reports to security/reports/. - Deterministic evidence trail: Every tool run is logged to SQLite with command, exit code, duration, and sha256-hashed output, enabling full session replay and an 8-section professional handoff report. - Use Case: A security engineer with written authorization runs an 8-hour full-offensive engagement against a web target; the framework auto-installs missing tools, tracks every discovered lead, correlates attack chains, and generates a remediation-ready report. ## Quick Start Tell the AI: I have authorization to pentest https://target.com, use opencode-pentester with a 120 minute time budget, or point it at a local repo and ask it to run the 17-category security audit.
