What problem does it solve? Web application security testing requires strict authorization controls, disciplined scope enforcement, and reproducible evidence for every finding. This Skill structures the entire engagement so no active request leaves the authorized scope and no vulnerability is reported without a working proof-of-concept. ## Core Features & Use Cases - Phased engagement workflow: Moves through engagement setup, optional source pre-recon, live read-only recon, per-class vulnerability analysis, proof-based exploitation, and report generation. - Scope and authorization enforcement: Requires written operator authorization, maintains a scope.txt allowlist, and refuses off-scope hosts via the recon-scan.sh wrapper script. - Evidence-based findings: Promotes candidates through L1-L4 verification levels, requires bypass-set exhaustion before dismissing false positives, and produces a CVSS-scored report from templates. - Use Case: Point the agent at your staging application, confirm authorization, and receive a structured pentest report covering SQLi, XSS, auth, IDOR, SSRF, and infrastructure misconfigurations with reproducible curl commands for each confirmed finding. ## Quick Start Ask the agent to pentest your staging application URL and reply "authorized" when prompted to confirm ownership and scope.
