Pentest Status

/pentest-status — Engagement Status

You are displaying the status of the active penetration testing engagement. Follow the steps below.

---

Step 1: Resolve Active Engagement

Use the Bash tool to read the active engagement pointer:

cat ~/.pentest/active-engagement 2>/dev/null

• If the file does not exist or is empty — tell the user:

> No active engagement found. Run /pentest-init to create a new engagement, or /pentest-switch to activate an existing one.

Stop here.

• If a path is returned — store the path as ENGAGEMENT_JSON and read it:

cat "$ENGAGEMENT_JSON"

Parse the JSON. If the file cannot be read or is malformed, tell the user and stop.

---

Step 2: Display Summary

Present the engagement details in the following sections using markdown.

---

Engagement Info

Display these fields in a definition list or key-value block:

• Engagement ID: engagement_id
• Client: client_name
• Type: type
• Dates: dates.start → dates.end
• Output directory: output_dir

---

Scope

In-scope (scope.in_scope | length targets):

List each entry as : (e.g. cidr:10.0.0.0/24, domain:*.acme.com). Group by type if helpful.

Out-of-scope (scope.out_of_scope | length entries):

List each entry as : — `. If outofscope` is empty, show "None."

---

Rules of Engagement

• Testing windows: If roe.testing_windows is empty, show "24/7 — no restrictions." Otherwise, for each window show the days, time range, and timezone (e.g. Mon–Fri 09:00–17:00 America/New_York).
• Restricted techniques: If roe.restricted_techniques is empty, show "None." Otherwise list each technique.
• Social engineering permitted: roe.social_engineering_permitted (Yes / No)
• Defense evasion permitted: roe.defense_evasion_permitted (Yes / No)
• Breach DB lookups permitted: breach_db_permitted (Yes / No)

---

Team

List each tester as — .

---

Emergency Contacts

Render a markdown table with columns: Role | Name | Phone | Email. Omit Phone or Email cells if not present for a contact (leave them blank). If the list is empty, show "No emergency contacts configured."

---

Remote Hosts

For each key in remote_hosts:

• Name: the key
• Method: method
• Host / Instance: host (for ssh) or instance_id (for ssm)
• Work directory: work_dir

If remote_hosts is empty or {}, show "No remote hosts configured."

---

Recent Activity

Use the Bash tool to read the last 10 lines of the activity log:

ENGAGEMENT_DIR=$(dirname "$ENGAGEMENT_JSON")
tail -10 "$ENGAGEMENT_DIR/activity.log" 2>/dev/null

If the log is empty or missing, show:

> No testing activity yet.

Otherwise, parse each line as JSON with jq and render a markdown table with columns: Time | Tester | Action | Target | Status.

• Time: .ts
• Tester: .tester
• Action: .action
• Target: .target // "—"
• Status: .status // "—"

---

Findings Summary

Use the Bash tool to count findings by severity:

ENGAGEMENT_DIR=$(dirname "$ENGAGEMENT_JSON")
find "$ENGAGEMENT_DIR/findings" -name "*.json" -exec jq -r '.severity' {} \; 2>/dev/null \
  | sort | uniq -c | sort -rn

• If the findings/ directory is empty or no .json files exist, show:

> No findings recorded yet.

• Otherwise, display the counts by severity (e.g. Critical: 2, High: 5, Medium: 3, Low: 1, Informational: 4). Use descending severity order: Critical → High → Medium → Low → Informational.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: thapr0digy
• Source: thapr0digy/skills
• License: MIT

Install and usage instructions live in the source repository linked above.