How do I install the Pentest Engagement skill?

Run npx skillmds@latest add aibot88/pentest-engagement in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Pentest Engagement safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Pentest Engagement?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Pentest Engagement free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published Pentest Engagement?

aibot88 (@aibot88) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Pentest Engagement by aibot88 — Agent Skill

Name: Pentest Engagement
Rating: 4.2 (5 reviews)
Author: aibot88

Pentest Engagement

Penetration testing engagement planning — scoping, ROE drafting, phased timeline, MITRE ATT&CK mapping, kickoff/closeout dokumantasyonu. Triggers on engagement plan, ROE, rules of engagement, scoping, pentest plan, phased plan, MITRE mapping, attack matrix, kickoff, closeout.

aibot88 Updated Sep 9, 2026 3 repo stars

File contents

pentest-engagement

Yetkili penetration testing engagement'i icin planning + scoping + ROE dokumantasyonu uretir.

Triggers

"pentest plan hazirla"
"ROE taslagi cikar"
"scoping document"
"engagement timeline"
"MITRE ATT&CK matrix"
"kickoff meeting agenda"
"closeout rapor sablonu"

Deliverable'lar

Scope Document (in-scope, out-of-scope, kisitlar)
Rules of Engagement (ROE) (yasak teknikler, calisma saatleri, escalation path)
Phased Timeline (kickoff -> recon -> exploit -> post-ex -> reporting -> closeout)
MITRE ATT&CK Mapping (her faza karsilik gelen Tactic + Technique listesi)
Communication Plan (musteri contact, escalation contact, incident response)
Acceptance Criteria (kapsanan testler, raporlama, deliverable listesi)

Scope Document Sablonu

# Engagement Scope — <Musteri>

## In-Scope
- IP Ranges: 10.0.0.0/16, 192.168.50.0/24
- Domains: *.example.com, app.example.com
- Cloud Accounts: AWS 123456789012 (production us-east-1)
- Test Tipi: External / Internal / Web App / Cloud / Red Team

## Out-of-Scope
- Production DB direct query
- Email/Phishing musteri calisani
- DoS / stress testing
- 3. taraf SaaS (Stripe, SendGrid, vb.)

## Restrictions
- Calisma saatleri: Hafta ici 09:00-17:00 (TR)
- Aggressive scan: Sadece kullanici onayli pencerede
- Data exfil: Yok — sadece kanit dosyasi (max 1MB)

## Authorization
- Letter of authorization: <link>
- Musteri imza: <isim, tarih>
- Pentest firma imza: <isim, tarih>

Phased Plan Sablonu (5 Phase)

Faz	Sure	Aktivite	MITRE Tactic
1. Recon	1-2 gun	OSINT, subdomain enum, port scan	TA0043 Reconnaissance
2. Initial Access	2-3 gun	Web app exploit, phishing sim, AD attack	TA0001 Initial Access
3. Post-Exploit	3-4 gun	Privesc, lateral, persistence, exfil sim	TA0004/TA0008/TA0003/TA0010
4. Detection	1-2 gun	SIEM/EDR coverage gap	TA0042 Resource Development (defansif)
5. Report	2-3 gun	Bulgu yazimi, CVSS, remediation, debrief	—

MITRE ATT&CK Mapping

Her bulgu icin minimum 1 ATT&CK Technique ID belirt (T1059, T1078, vb.). Mapping:

finding: SQL Injection in /api/users
mitre:
  tactic: TA0001 (Initial Access)
  techniques:
    - T1190 (Exploit Public-Facing Application)
detection:
  - Sigma rule: web/sql_injection.yml
remediation:
  priority: P0
  effort: 8h

Kickoff Meeting Agenda (1 saat)

Scope review + signoff (10 dk)
ROE walkthrough + restrictions (15 dk)
Communication channel + escalation (10 dk)
Asset inventory hand-off (15 dk)
Q&A + ilk gun planning (10 dk)

Closeout Meeting Agenda (1.5 saat)

Executive summary (10 dk)
Top 3 critical finding walkthrough (30 dk)
Remediation roadmap (20 dk)
Detection rule hand-off (15 dk)
Lessons learned (15 dk)

Cikti Konumu

Engagement basinda olustur:

engagements/<musteri>-<yyyymmdd>/
  scope.md
  roe.md
  timeline.md
  mitre-mapping.yml
  contacts.md

Out-of-Scope (Bu Skill Yapmaz)

Live komut composer'lama (pentest-recon, pentest-web vb. yapar)
Exploit guide uretmek (pentest-exploit-chain yapar)
Rapor yazma (pentest-report yapar)

Bu skill sadece planning + scoping doc uretir.

---name: pentest-engagementdescription: Penetration testing engagement planning — scoping, ROE drafting, phased timeline, MITRE ATT&CK mapping, kickoff/closeout dokumantasyonu. Triggers on engagement plan, ROE, rules of engagement, scoping, pentest plan, phased plan, MITRE mapping, attack matrix, kickoff, closeout.license: MIT--- # pentest-engagement Yetkili penetration testing engagement'i icin **planning + scoping + ROE** dokumantasyonu uretir. ## Triggers - "pentest plan hazirla" - "ROE taslagi cikar" - "scoping document" - "engagement timeline" - "MITRE ATT&CK matrix" - "kickoff meeting agenda" - "closeout rapor sablonu" ## Deliverable'lar 1. **Scope Document** (in-scope, out-of-scope, kisitlar) 2. **Rules of Engagement (ROE)** (yasak teknikler, calisma saatleri, escalation path) 3. **Phased Timeline** (kickoff -> recon -> exploit -> post-ex -> reporting -> closeout) 4. **MITRE ATT&CK Mapping** (her faza karsilik gelen Tactic + Technique listesi) 5. **Communication Plan** (musteri contact, escalation contact, incident response) 6. **Acceptance Criteria** (kapsanan testler, raporlama, deliverable listesi) ## Scope Document Sablonu ```markdown # Engagement Scope — <Musteri> ## In-Scope - IP Ranges: 10.0.0.0/16, 192.168.50.0/24 - Domains: *.example.com, app.example.com - Cloud Accounts: AWS 123456789012 (production us-east-1) - Test Tipi: External / Internal / Web App / Cloud / Red Team ## Out-of-Scope - Production DB direct query - Email/Phishing musteri calisani - DoS / stress testing - 3. taraf SaaS (Stripe, SendGrid, vb.) ## Restrictions - Calisma saatleri: Hafta ici 09:00-17:00 (TR) - Aggressive scan: Sadece kullanici onayli pencerede - Data exfil: Yok — sadece kanit dosyasi (max 1MB) ## Authorization - Letter of authorization: <link> - Musteri imza: <isim, tarih> - Pentest firma imza: <isim, tarih> ``` ## Phased Plan Sablonu (5 Phase) | Faz | Sure | Aktivite | MITRE Tactic | |-----|------|----------|--------------| | 1. Recon | 1-2 gun | OSINT, subdomain enum, port scan | TA0043 Reconnaissance | | 2. Initial Access | 2-3 gun | Web app exploit, phishing sim, AD attack | TA0001 Initial Access | | 3. Post-Exploit | 3-4 gun | Privesc, lateral, persistence, exfil sim | TA0004/TA0008/TA0003/TA0010 | | 4. Detection | 1-2 gun | SIEM/EDR coverage gap | TA0042 Resource Development (defansif) | | 5. Report | 2-3 gun | Bulgu yazimi, CVSS, remediation, debrief | — | ## MITRE ATT&CK Mapping Her bulgu icin minimum 1 ATT&CK Technique ID belirt (T1059, T1078, vb.). Mapping: ```yaml finding: SQL Injection in /api/users mitre: tactic: TA0001 (Initial Access) techniques: - T1190 (Exploit Public-Facing Application) detection: - Sigma rule: web/sql_injection.yml remediation: priority: P0 effort: 8h ``` ## Kickoff Meeting Agenda (1 saat) 1. Scope review + signoff (10 dk) 2. ROE walkthrough + restrictions (15 dk) 3. Communication channel + escalation (10 dk) 4. Asset inventory hand-off (15 dk) 5. Q&A + ilk gun planning (10 dk) ## Closeout Meeting Agenda (1.5 saat) 1. Executive summary (10 dk) 2. Top 3 critical finding walkthrough (30 dk) 3. Remediation roadmap (20 dk) 4. Detection rule hand-off (15 dk) 5. Lessons learned (15 dk) ## Cikti Konumu Engagement basinda olustur: ``` engagements/<musteri>-<yyyymmdd>/ scope.md roe.md timeline.md mitre-mapping.yml contacts.md ``` ## Out-of-Scope (Bu Skill Yapmaz) - Live komut composer'lama (pentest-recon, pentest-web vb. yapar) - Exploit guide uretmek (pentest-exploit-chain yapar) - Rapor yazma (pentest-report yapar) Bu skill **sadece planning + scoping doc** uretir.

Frequently asked questions