Pentest Agent Orchestrator

Use when orchestrate 35 specialized Claude Code subagents for offensive security. Use when planning a pentest, routing tasks to specialist agents, or conducting multi-phase security assessments.

oyi77 024c368 9.3 KB Updated Sep 8, 2026 10 repo stars

Install

Press C to copy

$ npx skillmds add oyi77/pentest-agent-orchestrator

Installs into ~/.claude/skills (or .claude/skills inside a project). Restart Claude Code to pick it up.

Download SKILL.md

＋ Add to collection

README badge

[![SkillMD](https://skillmd.com/badge/oyi77/pentest-agent-orchestrator.svg)](https://skillmd.com/skills/oyi77/pentest-agent-orchestrator)

Trust & safety

Audits pending

Not yet audited · commit 024c368

Permissions this skill uses

Makes network calls
The instructions fetch remote URLs or call external services.
Reads secrets
The instructions read tokens, keys, or other credentials.

License: Apache-2
Works with: Claude Code Claude.ai OpenAI Codex +

File contents

Pentest Agent Orchestrator

Overview

35 specialized Claude Code subagents for offensive security, adapted from 0xSteph/pentest-ai-agents. No servers or dependencies required — copy agents to ~/.claude/agents/ and they are immediately available. Each agent is a standalone prompt file that Claude Code can spawn as a subagent.

Source: https://github.com/0xSteph/pentest-ai-agents Agent count: 35 specialized subagents Deployment: Copy ~/.claude/agents/ — zero dependencies License: Open source

When to Use

Trigger phrases:

"pentest agent orchestrator"
"Planning and executing a penetration test"
"Need specialist agent routing for specific attack surfaces"
"Offensive security research across multiple domains"
Planning and executing a penetration test
Need specialist agent routing for specific attack surfaces
Offensive security research across multiple domains
Orchestrating multi-phase engagements (recon through post-exploitation)
CTF challenges requiring diverse tooling and approaches

Agent Categories

This section covers agent categories for pentest agent orchestrator.

Ensure all prerequisites are met before proceeding
Follow the documented workflow steps in sequence
Record results and any anomalies encountered during this phase

Reconnaissance / OSINT (3 agents)

Agent	Purpose
`recon-advisor`	Strategic recon planning — what to gather, where to look, prioritization
`osint-collector`	Passive OSINT — WHOIS, DNS, Shodan, social media, breach databases
`attack-surface-mapper`	Active enumeration — subdomains, ports, services, technology fingerprinting

Web Application Testing (4 agents)

Agent	Purpose
`web-hunter`	OWASP Top 10 discovery — XSS, SQLi, SSRF, IDOR, auth bypass
`api-breaker`	API security testing — REST/GraphQL fuzzing, auth flaws, mass assignment
`auth-tester`	Authentication/authorization testing — session management, JWT, OAuth
`web-fuzzer`	Directory brute-force, parameter fuzzing, input validation testing

Active Directory / Credentials (2 agents)

Agent	Purpose
`ad-attacker`	AD attack paths — Kerberoasting, AS-REP, DCSync, delegation abuse
`credential-hunter`	Credential harvesting — password spraying, hash cracking, vault enumeration

Cloud / CI/CD (2 agents)

Agent	Purpose
`cloud-security`	AWS/GCP/Azure misconfiguration — IAM, S3, metadata, privilege escalation
`cicd-attacker`	CI/CD pipeline exploitation — secret leakage, supply chain, runner escape

Containers / C2 (2 agents)

Agent	Purpose
`container-escaper`	Container escape and Kubernetes exploitation — RBAC, host mounts, runtime
`c2-operator`	Command and control setup — payload delivery, callback management, channels

AI / LLM Red Teaming (1 agent)

Agent	Purpose
`llm-redteam`	AI/LLM security testing — prompt injection, model manipulation, data exfiltration

Operational Security (1 agent)

Agent	Purpose
`opsec-guardian`	OPSEC review — traffic analysis resistance, fingerprinting, attribution prevention

Mobile / Wireless (2 agents)

Agent	Purpose
`mobile-hacker`	iOS/Android testing — app analysis, certificate pinning bypass, API interception
`wireless-hunter`	Wi-Fi and RF testing — deauth, Evil Twin, WPA cracking, BLE reconnaissance

Social Engineering (2 agents)

Agent	Purpose
`phish-crafter`	Phishing campaign design — pretexting, payload delivery, landing pages
`social-engineer`	Human-layer attack planning — vishing, physical, OSINT-backed pretexts

Payload / Reverse Engineering (2 agents)

Agent	Purpose
`payload-smith`	Payload generation — shellcode, obfuscation, AV evasion, staged delivery
`reverse-engineer`	Binary analysis — disassembly, decompilation, vulnerability identification

Exploit Chaining (3 agents)

Agent	Purpose
`exploit-chainer`	Chain multiple low-severity findings into critical impact paths
`privilege-escalator`	Local privilege escalation — Linux/Windows kernel, SUID, services, tokens
`lateral-mover`	Network lateral movement — pivoting, pass-the-hash, relay attacks

Post-Exploitation (2 agents)

Agent	Purpose
`privesc-advisor`	Post-exploitation strategy — persistence, loot, cleanup, evidence handling
`data-exfiltrator`	Data staging and exfiltration — tunneling, encoding, covert channels

Swarm Orchestration (1 agent)

Agent	Purpose
`swarm-orchestrator`	Multi-agent coordination — task delegation, parallel execution, result aggregation

Reporting (2 agents)

Agent	Purpose
`report-generator`	Pentest report generation — findings, CVSS, remediation, executive summary
`evidence-manager`	Evidence chain — screenshots, logs, PoCs, timestamps, chain of custody

Defense / Analysis (5 agents)

Agent	Purpose
`defense-analyst`	Blue team perspective — validate findings, assess detection coverage
`threat-modeler`	Threat modeling — STRIDE, attack trees, risk prioritization
`compliance-checker`	Compliance mapping — NIST, OWASP, PCI-DSS against findings
`risk-assessor`	Risk scoring and prioritization — business impact, exploitability
`remediation-advisor`	Fix recommendations — specific, actionable, prioritized by impact

CTF (1 agent)

Agent	Purpose
`ctf-solver`	CTF challenge solver — crypto, web, pwn, forensics, reversing, misc

Tier System

This section covers tier system for pentest agent orchestrator.

Ensure all prerequisites are met before proceeding
Follow the documented workflow steps in sequence
Record results and any anomalies encountered during this phase

Tier 1 — Advisory

Provides analysis, recommendations, and attack path planning
Does not execute commands or modify systems
Safe to run without explicit approval gates
Agents: recon-advisor, osint-collector, opsec-guardian, report-generator, evidence-manager, threat-modeler, compliance-checker, risk-assessor, remediation-advisor, defense-analyst

Tier 2 — Execution-Capable

Can execute commands, run tools, and interact with targets
Requires explicit approval before execution
Output includes commands-to-run with justification
Agents: All remaining agents (web-hunter, ad-attacker, cloud-security, exploit-chainer, c2-operator, etc.)

Usage Patterns

# Basic usage example
# Replace with domain-specific commands from the workflow above

Single-Agent Invocation

# Ask a specific specialist
Spawn recon-advisor to plan reconnaissance for target.example.com

Multi-Agent Orchestration

# Use swarm-orchestrator for coordinated assessment
Spawn swarm-orchestrator to run a full pentest against 10.0.0.0/24

Chained Workflow

# Sequential: recon -> hunting -> exploitation -> reporting
1. recon-advisor: map the target
2. web-hunter: identify vulnerabilities
3. exploit-chainer: chain findings into attack path
4. report-generator: produce final deliverable

Installation

# Clone the repository
git clone https://github.com/0xSteph/pentest-ai-agents.git

# Copy all agents to Claude Code agents directory
cp pentest-ai-agents/agents/*.md ~/.claude/agents/

# Verify installation
ls ~/.claude/agents/

When NOT to Use

Task is outside your authorization scope
You need to implement controls (use implementing-* skills)
Task is about analysis, not action (use analyzing-* skills)
You don't have access to target systems
Task requires compliance expertise (consult professionals)
Task is about defense, not offense (use defensive skills)

Red Flags

Never run Tier 2 agents against targets without written authorization
Verify scope boundaries before executing any exploitation
Do not exfiltrate real data during testing without explicit permission
Always follow responsible disclosure for any findings

Verification

All steps executed successfully against a test environment before production use
Output documented with screenshots or logs demonstrating expected behavior
All exploited vulnerabilities documented with reproduction steps
Scope boundaries confirmed — only authorized targets were tested
Remediation recommendations included for every finding

Process

Analyze the task requirements
Apply domain expertise
Verify output quality

Anti-Rationalization Table

Rationalization	Reality
"We are too small to be targeted"	Automated attacks target everyone. Size does not matter.
"Security slows us down"	A breach slows you down 100x more. Build security in from the start.
"We will fix it after launch"	Vulnerabilities in production are exploited within hours. Fix before deploy.

---name: pentest-agent-orchestratordescription: Use when orchestrate 35 specialized Claude Code subagents for offensive security. Use when planning a pentest, routing tasks to specialist agents, or conducting multi-phase security assessments.license: Apache-2.0---# Pentest Agent Orchestrator## Overview35 specialized Claude Code subagents for offensive security, adapted from [0xSteph/pentest-ai-agents](https://github.com/0xSteph/pentest-ai-agents). No servers or dependencies required — copy agents to `~/.claude/agents/` and they are immediately available. Each agent is a standalone prompt file that Claude Code can spawn as a subagent.**Source:** https://github.com/0xSteph/pentest-ai-agents**Agent count:** 35 specialized subagents**Deployment:** Copy `~/.claude/agents/` — zero dependencies**License:** Open source## When to Use**Trigger phrases:**- "pentest agent orchestrator"- "Planning and executing a penetration test"- "Need specialist agent routing for specific attack surfaces"- "Offensive security research across multiple domains"- Planning and executing a penetration test- Need specialist agent routing for specific attack surfaces- Offensive security research across multiple domains- Orchestrating multi-phase engagements (recon through post-exploitation)- CTF challenges requiring diverse tooling and approaches## Agent CategoriesThis section covers agent categories for pentest agent orchestrator.- Ensure all prerequisites are met before proceeding- Follow the documented workflow steps in sequence- Record results and any anomalies encountered during this phase### Reconnaissance / OSINT (3 agents)| Agent | Purpose ||-------|---------|| `recon-advisor` | Strategic recon planning — what to gather, where to look, prioritization || `osint-collector` | Passive OSINT — WHOIS, DNS, Shodan, social media, breach databases || `attack-surface-mapper` | Active enumeration — subdomains, ports, services, technology fingerprinting |### Web Application Testing (4 agents)| Agent | Purpose ||-------|---------|| `web-hunter` | OWASP Top 10 discovery — XSS, SQLi, SSRF, IDOR, auth bypass || `api-breaker` | API security testing — REST/GraphQL fuzzing, auth flaws, mass assignment || `auth-tester` | Authentication/authorization testing — session management, JWT, OAuth || `web-fuzzer` | Directory brute-force, parameter fuzzing, input validation testing |### Active Directory / Credentials (2 agents)| Agent | Purpose ||-------|---------|| `ad-attacker` | AD attack paths — Kerberoasting, AS-REP, DCSync, delegation abuse || `credential-hunter` | Credential harvesting — password spraying, hash cracking, vault enumeration |### Cloud / CI/CD (2 agents)| Agent | Purpose ||-------|---------|| `cloud-security` | AWS/GCP/Azure misconfiguration — IAM, S3, metadata, privilege escalation || `cicd-attacker` | CI/CD pipeline exploitation — secret leakage, supply chain, runner escape |### Containers / C2 (2 agents)| Agent | Purpose ||-------|---------|| `container-escaper` | Container escape and Kubernetes exploitation — RBAC, host mounts, runtime || `c2-operator` | Command and control setup — payload delivery, callback management, channels |### AI / LLM Red Teaming (1 agent)| Agent | Purpose ||-------|---------|| `llm-redteam` | AI/LLM security testing — prompt injection, model manipulation, data exfiltration |### Operational Security (1 agent)| Agent | Purpose ||-------|---------|| `opsec-guardian` | OPSEC review — traffic analysis resistance, fingerprinting, attribution prevention |### Mobile / Wireless (2 agents)| Agent | Purpose ||-------|---------|| `mobile-hacker` | iOS/Android testing — app analysis, certificate pinning bypass, API interception || `wireless-hunter` | Wi-Fi and RF testing — deauth, Evil Twin, WPA cracking, BLE reconnaissance |### Social Engineering (2 agents)| Agent | Purpose ||-------|---------|| `phish-crafter` | Phishing campaign design — pretexting, payload delivery, landing pages || `social-engineer` | Human-layer attack planning — vishing, physical, OSINT-backed pretexts |### Payload / Reverse Engineering (2 agents)| Agent | Purpose ||-------|---------|| `payload-smith` | Payload generation — shellcode, obfuscation, AV evasion, staged delivery || `reverse-engineer` | Binary analysis — disassembly, decompilation, vulnerability identification |### Exploit Chaining (3 agents)| Agent | Purpose ||-------|---------|| `exploit-chainer` | Chain multiple low-severity findings into critical impact paths || `privilege-escalator` | Local privilege escalation — Linux/Windows kernel, SUID, services, tokens || `lateral-mover` | Network lateral movement — pivoting, pass-the-hash, relay attacks |### Post-Exploitation (2 agents)| Agent | Purpose ||-------|---------|| `privesc-advisor` | Post-exploitation strategy — persistence, loot, cleanup, evidence handling || `data-exfiltrator` | Data staging and exfiltration — tunneling, encoding, covert channels |### Swarm Orchestration (1 agent)| Agent | Purpose ||-------|---------|| `swarm-orchestrator` | Multi-agent coordination — task delegation, parallel execution, result aggregation |### Reporting (2 agents)| Agent | Purpose ||-------|---------|| `report-generator` | Pentest report generation — findings, CVSS, remediation, executive summary || `evidence-manager` | Evidence chain — screenshots, logs, PoCs, timestamps, chain of custody |### Defense / Analysis (5 agents)| Agent | Purpose ||-------|---------|| `defense-analyst` | Blue team perspective — validate findings, assess detection coverage || `threat-modeler` | Threat modeling — STRIDE, attack trees, risk prioritization || `compliance-checker` | Compliance mapping — NIST, OWASP, PCI-DSS against findings || `risk-assessor` | Risk scoring and prioritization — business impact, exploitability || `remediation-advisor` | Fix recommendations — specific, actionable, prioritized by impact |### CTF (1 agent)| Agent | Purpose ||-------|---------|| `ctf-solver` | CTF challenge solver — crypto, web, pwn, forensics, reversing, misc |## Tier SystemThis section covers tier system for pentest agent orchestrator.- Ensure all prerequisites are met before proceeding- Follow the documented workflow steps in sequence- Record results and any anomalies encountered during this phase### Tier 1 — Advisory- Provides analysis, recommendations, and attack path planning- Does not execute commands or modify systems- Safe to run without explicit approval gates- Agents: `recon-advisor`, `osint-collector`, `opsec-guardian`, `report-generator`, `evidence-manager`, `threat-modeler`, `compliance-checker`, `risk-assessor`, `remediation-advisor`, `defense-analyst`### Tier 2 — Execution-Capable- Can execute commands, run tools, and interact with targets- Requires explicit approval before execution- Output includes commands-to-run with justification- Agents: All remaining agents (web-hunter, ad-attacker, cloud-security, exploit-chainer, c2-operator, etc.)## Usage Patterns```bash# Basic usage example# Replace with domain-specific commands from the workflow above```### Single-Agent Invocation```# Ask a specific specialistSpawn recon-advisor to plan reconnaissance for target.example.com```### Multi-Agent Orchestration```# Use swarm-orchestrator for coordinated assessmentSpawn swarm-orchestrator to run a full pentest against 10.0.0.0/24```### Chained Workflow```# Sequential: recon -> hunting -> exploitation -> reporting1. recon-advisor: map the target2. web-hunter: identify vulnerabilities3. exploit-chainer: chain findings into attack path4. report-generator: produce final deliverable```## Installation```bash# Clone the repositorygit clone https://github.com/0xSteph/pentest-ai-agents.git# Copy all agents to Claude Code agents directorycp pentest-ai-agents/agents/*.md ~/.claude/agents/# Verify installationls ~/.claude/agents/```## When NOT to Use- Task is outside your authorization scope- You need to implement controls (use implementing-* skills)- Task is about analysis, not action (use analyzing-* skills)- You don't have access to target systems- Task requires compliance expertise (consult professionals)- Task is about defense, not offense (use defensive skills)## Red Flags- Never run Tier 2 agents against targets without written authorization- Verify scope boundaries before executing any exploitation- Do not exfiltrate real data during testing without explicit permission- Always follow responsible disclosure for any findings## Verification- All steps executed successfully against a test environment before production use- Output documented with screenshots or logs demonstrating expected behavior- All exploited vulnerabilities documented with reproduction steps- Scope boundaries confirmed — only authorized targets were tested- Remediation recommendations included for every finding## Process1. Analyze the task requirements2. Apply domain expertise3. Verify output quality## Anti-Rationalization Table| Rationalization | Reality ||---|---|| "We are too small to be targeted" | Automated attacks target everyone. Size does not matter. || "Security slows us down" | A breach slows you down 100x more. Build security in from the start. || "We will fix it after launch" | Vulnerabilities in production are exploited within hours. Fix before deploy. |

oyi77/1ai-skills/tree/main/cybersecurity/pentest-agent-orchestrator commit 024c3684fb

Frequently asked questions

npx skillmds add oyi77/pentest-agent-orchestrator