# Ott Cybersecurity Llc Lyrie AI Skills AI Pentest

> AI Pentest — Lyrie Autonomous Penetration Testing Skill

- Skill: `aibot88/ott-cybersecurity-llc-lyrie-ai-skills-ai-pentest` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add aibot88/ott-cybersecurity-llc-lyrie-ai-skills-ai-pentest`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aibot88/ott-cybersecurity-llc-lyrie-ai-skills-ai-pentest/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: aibot88 (https://skillmd.com/u/aibot88)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/aibot88/ott-cybersecurity-llc-lyrie-ai-skills-ai-pentest

---

# AI Pentest — Lyrie Autonomous Penetration Testing Skill

> _Lyrie.ai by OTT Cybersecurity LLC._
>
> **The autonomous pentest engine for Lyrie Agent.** Unified AI-powered
> penetration testing with native Lyrie Shield integration: recon,
> vulnerability scanning, web-application testing, API security testing,
> AI analysis, and professional reporting — all under a single autonomous
> workflow that defends what it tests.

## Commands

| Command | Description | Scope |
|---------|-------------|-------|
| `/scan <target>` | Quick scan — recon + header check + top vulns | ~2 min |
| `/pentest <target>` | Full pentest — all modules, AI analysis, report | ~10 min |
| `/recon <target>` | Reconnaissance only — subdomains, ports, tech stack | ~3 min |
| `/vulnscan <target>` | Vulnerability scan only — injection, misconfig, CVEs | ~5 min |
| `/apiscan <target>` | API security testing — endpoints, auth, fuzzing | ~5 min |
| `/report <scan-id>` | Re-generate report from cached scan results | ~1 min |

## Architecture

```
┌─────────────────────────────────────────────┐
│              Unified Scanner                 │
│         (scanner.ts — orchestrator)          │
├──────┬──────┬──────┬──────┬────────┬────────┤
│Recon │Vuln  │WebApp│API   │AI      │Report  │
│      │Scan  │Test  │Test  │Analysis│Gen     │
├──────┴──────┴──────┴──────┴────────┴────────┤
│              Config (config.ts)              │
└─────────────────────────────────────────────┘
```

### Modules

1. **Recon** (`recon.ts`) — DNS enumeration, subdomain discovery, port scanning, technology fingerprinting, WHOIS, certificate transparency logs
2. **Vulnerability Scanner** (`vuln-scanner.ts`) — HTTP security headers, SSL/TLS analysis, known CVE matching, injection testing (SQLi, XSS, SSRF, RCE, command injection), authentication bypass
3. **Web Application Test** (`web-app-test.ts`) — OWASP Top 10 coverage: injection, broken auth, sensitive data exposure, XXE, broken access control, security misconfiguration, XSS, insecure deserialization, vulnerable components, insufficient logging
4. **API Security Test** (`api-test.ts`) — Endpoint discovery, authentication testing, parameter fuzzing, rate limit testing, BOLA/BFLA, mass assignment, excessive data exposure
5. **Report Generator** (`report-generator.ts`) — Professional pentest report with executive summary, methodology, findings with CVSS 3.1 scores, PoC evidence, remediation guidance, technical appendix

### AI Analysis Pipeline

All raw findings pass through Claude Opus for:
- **False positive elimination** — Correlates findings across scanners to validate
- **Severity calibration** — Adjusts CVSS based on actual exploitability context
- **Attack chain identification** — Links individual findings into exploit chains
- **Remediation prioritization** — Orders fixes by business impact

## Configuration

Set in `config.ts` or via environment variables:

| Variable | Purpose |
|----------|---------|
| `ANTHROPIC_API_KEY` | Claude Opus for AI analysis |
| `OPENAI_API_KEY` | Fallback LLM |
| `BRAVE_API_KEY` | OSINT and recon searches |
| `PENTEST_TIMEOUT` | Global timeout (default: 600s) |
| `PENTEST_THREADS` | Parallel scan threads (default: 10) |
| `PENTEST_SCOPE` | Restrict to target domain only (default: true) |

## Output

- **Markdown report** saved to `reports/pentest-<target>-<timestamp>.md`
- **JSON findings** saved to `reports/pentest-<target>-<timestamp>.json`
- **Summary** posted to requesting channel

## Safety

- **Scope enforcement** — Never scans outside the target domain unless explicitly authorized
- **Rate limiting** — Built-in request throttling to avoid DoS
- **Legal notice** — Requires explicit confirmation before full pentest
- **Passive-first** — Quick scans use only passive techniques; active testing requires `/pentest`

## About

Designed, built and maintained by **OTT Cybersecurity LLC** as part of
[Lyrie.ai](https://lyrie.ai). The skill is fully open-source under the MIT
License and integrates first-class with the Lyrie Shield, Lyrie Research
threat-intel feed (`research.lyrie.ai`), and the Lyrie Pentest GitHub
Action.

_© OTT Cybersecurity LLC — https://lyrie.ai_