AI Pentest — Lyrie Autonomous Penetration Testing Skill
Lyrie.ai by OTT Cybersecurity LLC.
The autonomous pentest engine for Lyrie Agent. Unified AI-powered
penetration testing with native Lyrie Shield integration: recon,
vulnerability scanning, web-application testing, API security testing,
AI analysis, and professional reporting — all under a single autonomous
workflow that defends what it tests.
Commands
| Command |
Description |
Scope |
/scan <target> |
Quick scan — recon + header check + top vulns |
~2 min |
/pentest <target> |
Full pentest — all modules, AI analysis, report |
~10 min |
/recon <target> |
Reconnaissance only — subdomains, ports, tech stack |
~3 min |
/vulnscan <target> |
Vulnerability scan only — injection, misconfig, CVEs |
~5 min |
/apiscan <target> |
API security testing — endpoints, auth, fuzzing |
~5 min |
/report <scan-id> |
Re-generate report from cached scan results |
~1 min |
Architecture
┌─────────────────────────────────────────────┐
│ Unified Scanner │
│ (scanner.ts — orchestrator) │
├──────┬──────┬──────┬──────┬────────┬────────┤
│Recon │Vuln │WebApp│API │AI │Report │
│ │Scan │Test │Test │Analysis│Gen │
├──────┴──────┴──────┴──────┴────────┴────────┤
│ Config (config.ts) │
└─────────────────────────────────────────────┘
Modules
- Recon (
recon.ts) — DNS enumeration, subdomain discovery, port scanning, technology fingerprinting, WHOIS, certificate transparency logs
- Vulnerability Scanner (
vuln-scanner.ts) — HTTP security headers, SSL/TLS analysis, known CVE matching, injection testing (SQLi, XSS, SSRF, RCE, command injection), authentication bypass
- Web Application Test (
web-app-test.ts) — OWASP Top 10 coverage: injection, broken auth, sensitive data exposure, XXE, broken access control, security misconfiguration, XSS, insecure deserialization, vulnerable components, insufficient logging
- API Security Test (
api-test.ts) — Endpoint discovery, authentication testing, parameter fuzzing, rate limit testing, BOLA/BFLA, mass assignment, excessive data exposure
- Report Generator (
report-generator.ts) — Professional pentest report with executive summary, methodology, findings with CVSS 3.1 scores, PoC evidence, remediation guidance, technical appendix
AI Analysis Pipeline
All raw findings pass through Claude Opus for:
- False positive elimination — Correlates findings across scanners to validate
- Severity calibration — Adjusts CVSS based on actual exploitability context
- Attack chain identification — Links individual findings into exploit chains
- Remediation prioritization — Orders fixes by business impact
Configuration
Set in config.ts or via environment variables:
| Variable |
Purpose |
ANTHROPIC_API_KEY |
Claude Opus for AI analysis |
OPENAI_API_KEY |
Fallback LLM |
BRAVE_API_KEY |
OSINT and recon searches |
PENTEST_TIMEOUT |
Global timeout (default: 600s) |
PENTEST_THREADS |
Parallel scan threads (default: 10) |
PENTEST_SCOPE |
Restrict to target domain only (default: true) |
Output
- Markdown report saved to
reports/pentest-<target>-<timestamp>.md
- JSON findings saved to
reports/pentest-<target>-<timestamp>.json
- Summary posted to requesting channel
Safety
- Scope enforcement — Never scans outside the target domain unless explicitly authorized
- Rate limiting — Built-in request throttling to avoid DoS
- Legal notice — Requires explicit confirmation before full pentest
- Passive-first — Quick scans use only passive techniques; active testing requires
/pentest
About
Designed, built and maintained by OTT Cybersecurity LLC as part of
Lyrie.ai. The skill is fully open-source under the MIT
License and integrates first-class with the Lyrie Shield, Lyrie Research
threat-intel feed (research.lyrie.ai), and the Lyrie Pentest GitHub
Action.
© OTT Cybersecurity LLC — https://lyrie.ai
1---2name: ott-cybersecurity-llc-lyrie-ai-skills-ai-pentest3description: AI Pentest — Lyrie Autonomous Penetration Testing Skill4---5# AI Pentest — Lyrie Autonomous Penetration Testing Skill67> _Lyrie.ai by OTT Cybersecurity LLC._8>9> **The autonomous pentest engine for Lyrie Agent.** Unified AI-powered10> penetration testing with native Lyrie Shield integration: recon,11> vulnerability scanning, web-application testing, API security testing,12> AI analysis, and professional reporting — all under a single autonomous13> workflow that defends what it tests.1415## Commands1617| Command | Description | Scope |18|---------|-------------|-------|19| `/scan <target>` | Quick scan — recon + header check + top vulns | ~2 min |20| `/pentest <target>` | Full pentest — all modules, AI analysis, report | ~10 min |21| `/recon <target>` | Reconnaissance only — subdomains, ports, tech stack | ~3 min |22| `/vulnscan <target>` | Vulnerability scan only — injection, misconfig, CVEs | ~5 min |23| `/apiscan <target>` | API security testing — endpoints, auth, fuzzing | ~5 min |24| `/report <scan-id>` | Re-generate report from cached scan results | ~1 min |2526## Architecture2728```29┌─────────────────────────────────────────────┐30│ Unified Scanner │31│ (scanner.ts — orchestrator) │32├──────┬──────┬──────┬──────┬────────┬────────┤33│Recon │Vuln │WebApp│API │AI │Report │34│ │Scan │Test │Test │Analysis│Gen │35├──────┴──────┴──────┴──────┴────────┴────────┤36│ Config (config.ts) │37└─────────────────────────────────────────────┘38```3940### Modules41421. **Recon** (`recon.ts`) — DNS enumeration, subdomain discovery, port scanning, technology fingerprinting, WHOIS, certificate transparency logs432. **Vulnerability Scanner** (`vuln-scanner.ts`) — HTTP security headers, SSL/TLS analysis, known CVE matching, injection testing (SQLi, XSS, SSRF, RCE, command injection), authentication bypass443. **Web Application Test** (`web-app-test.ts`) — OWASP Top 10 coverage: injection, broken auth, sensitive data exposure, XXE, broken access control, security misconfiguration, XSS, insecure deserialization, vulnerable components, insufficient logging454. **API Security Test** (`api-test.ts`) — Endpoint discovery, authentication testing, parameter fuzzing, rate limit testing, BOLA/BFLA, mass assignment, excessive data exposure465. **Report Generator** (`report-generator.ts`) — Professional pentest report with executive summary, methodology, findings with CVSS 3.1 scores, PoC evidence, remediation guidance, technical appendix4748### AI Analysis Pipeline4950All raw findings pass through Claude Opus for:51- **False positive elimination** — Correlates findings across scanners to validate52- **Severity calibration** — Adjusts CVSS based on actual exploitability context53- **Attack chain identification** — Links individual findings into exploit chains54- **Remediation prioritization** — Orders fixes by business impact5556## Configuration5758Set in `config.ts` or via environment variables:5960| Variable | Purpose |61|----------|---------|62| `ANTHROPIC_API_KEY` | Claude Opus for AI analysis |63| `OPENAI_API_KEY` | Fallback LLM |64| `BRAVE_API_KEY` | OSINT and recon searches |65| `PENTEST_TIMEOUT` | Global timeout (default: 600s) |66| `PENTEST_THREADS` | Parallel scan threads (default: 10) |67| `PENTEST_SCOPE` | Restrict to target domain only (default: true) |6869## Output7071- **Markdown report** saved to `reports/pentest-<target>-<timestamp>.md`72- **JSON findings** saved to `reports/pentest-<target>-<timestamp>.json`73- **Summary** posted to requesting channel7475## Safety7677- **Scope enforcement** — Never scans outside the target domain unless explicitly authorized78- **Rate limiting** — Built-in request throttling to avoid DoS79- **Legal notice** — Requires explicit confirmation before full pentest80- **Passive-first** — Quick scans use only passive techniques; active testing requires `/pentest`8182## About8384Designed, built and maintained by **OTT Cybersecurity LLC** as part of85[Lyrie.ai](https://lyrie.ai). The skill is fully open-source under the MIT86License and integrates first-class with the Lyrie Shield, Lyrie Research87threat-intel feed (`research.lyrie.ai`), and the Lyrie Pentest GitHub88Action.8990_© OTT Cybersecurity LLC — https://lyrie.ai_
aibot88