# Scope Authorized Security Test

> Define authorization, targets, rules, safety controls, and stop conditions before active security testing. Use for penetration tests, scans, exploit validation, web or API tests, network probing, bug bounty, or agent-driven testing.

- Skill: `gaelic-ghost/scope-authorized-security-test` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add gaelic-ghost/scope-authorized-security-test`
- Raw SKILL.md: https://api.skillmd.com/api/skills/gaelic-ghost/scope-authorized-security-test/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: gaelic-ghost (https://skillmd.com/u/gaelic-ghost)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/gaelic-ghost/scope-authorized-security-test

---


# Scope Authorized Security Test

## Overview

Turn permission into an executable scope record before sending active traffic or running a proof of concept. Authorization must identify the owner and boundaries; access to a target or a public address is not permission.

Read [references/active-test-scope.md](references/active-test-scope.md) and complete every applicable field.

## Workflow

1. Identify authority.
   - Record target owner, authorizing person/record, tester, contacts, dates, jurisdiction or program policy, and evidence of permission.
2. Resolve targets precisely.
   - List domains, hosts, addresses/ranges, applications, APIs, repositories, accounts, environments, and third-party dependencies.
   - List exclusions explicitly and define how dynamic/cloud/CDN targets are resolved.
3. Define allowed techniques.
   - Separate passive review, discovery, authenticated testing, automated scanning, fuzzing, exploit validation, social/physical testing, persistence, credential access, data access, and denial-of-service.
   - Default unlisted techniques to disallowed.
4. Set operational controls.
   - Define source addresses, accounts, rate/concurrency, time windows, test data, logging, notification, emergency stop, cleanup, and restoration.
5. Define data handling.
   - Minimize accessed data; specify retention, encryption, screenshots/logs, secrets, evidence transfer, disclosure, and deletion.
6. Establish stop conditions.
   - Stop on target drift, third-party impact, instability, sensitive data beyond minimum proof, unexpected privileges, scope ambiguity, or an unapproved technique.
7. Approve the test plan.
   - Show exact targets and effects before tools run; update the scope record before expanding work.

## Output

Return authority, included/excluded targets, allowed/disallowed techniques, operational controls, data handling, stop/escalation contacts, and approval state.