# Pentest Status

> Show active engagement details including scope, contacts, RoE, and recent activity. Invoke via /pentest-status.

- **Type:** Skill
- **Install:** `agentstack add skill-thapr0digy-skills-pentest-status`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [thapr0digy](https://agentstack.voostack.com/s/thapr0digy)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [thapr0digy](https://github.com/thapr0digy)
- **Source:** https://github.com/thapr0digy/skills/tree/main/plugins/pentest-core/skills/pentest-status

## Install

```sh
agentstack add skill-thapr0digy-skills-pentest-status
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# /pentest-status — Engagement Status

You are displaying the status of the active penetration testing engagement. Follow the steps below.

---

## Step 1: Resolve Active Engagement

Use the Bash tool to read the active engagement pointer:

```bash
cat ~/.pentest/active-engagement 2>/dev/null
```

- **If the file does not exist or is empty** — tell the user:

  > No active engagement found. Run `/pentest-init` to create a new engagement, or `/pentest-switch` to activate an existing one.

  Stop here.

- **If a path is returned** — store the path as `ENGAGEMENT_JSON` and read it:

```bash
cat "$ENGAGEMENT_JSON"
```

Parse the JSON. If the file cannot be read or is malformed, tell the user and stop.

---

## Step 2: Display Summary

Present the engagement details in the following sections using markdown.

---

### Engagement Info

Display these fields in a definition list or key-value block:

- **Engagement ID**: `engagement_id`
- **Client**: `client_name`
- **Type**: `type`
- **Dates**: `dates.start` → `dates.end`
- **Output directory**: `output_dir`

---

### Scope

**In-scope** (`scope.in_scope | length` targets):

List each entry as `:` (e.g. `cidr:10.0.0.0/24`, `domain:*.acme.com`). Group by type if helpful.

**Out-of-scope** (`scope.out_of_scope | length` entries):

List each entry as `:` — ``. If `out_of_scope` is empty, show "None."

---

### Rules of Engagement

- **Testing windows**: If `roe.testing_windows` is empty, show "24/7 — no restrictions." Otherwise, for each window show the days, time range, and timezone (e.g. `Mon–Fri 09:00–17:00 America/New_York`).
- **Restricted techniques**: If `roe.restricted_techniques` is empty, show "None." Otherwise list each technique.
- **Social engineering permitted**: `roe.social_engineering_permitted` (Yes / No)
- **Defense evasion permitted**: `roe.defense_evasion_permitted` (Yes / No)
- **Breach DB lookups permitted**: `breach_db_permitted` (Yes / No)

---

### Team

List each tester as ` — `.

---

### Emergency Contacts

Render a markdown table with columns: **Role | Name | Phone | Email**. Omit Phone or Email cells if not present for a contact (leave them blank). If the list is empty, show "No emergency contacts configured."

---

### Remote Hosts

For each key in `remote_hosts`:

- **Name**: the key
- **Method**: `method`
- **Host / Instance**: `host` (for ssh) or `instance_id` (for ssm)
- **Work directory**: `work_dir`

If `remote_hosts` is empty or `{}`, show "No remote hosts configured."

---

### Recent Activity

Use the Bash tool to read the last 10 lines of the activity log:

```bash
ENGAGEMENT_DIR=$(dirname "$ENGAGEMENT_JSON")
tail -10 "$ENGAGEMENT_DIR/activity.log" 2>/dev/null
```

If the log is empty or missing, show:

> No testing activity yet.

Otherwise, parse each line as JSON with `jq` and render a markdown table with columns: **Time | Tester | Action | Target | Status**.

- **Time**: `.ts`
- **Tester**: `.tester`
- **Action**: `.action`
- **Target**: `.target // "—"`
- **Status**: `.status // "—"`

---

### Findings Summary

Use the Bash tool to count findings by severity:

```bash
ENGAGEMENT_DIR=$(dirname "$ENGAGEMENT_JSON")
find "$ENGAGEMENT_DIR/findings" -name "*.json" -exec jq -r '.severity' {} \; 2>/dev/null \
  | sort | uniq -c | sort -rn
```

- If the `findings/` directory is empty or no `.json` files exist, show:

  > No findings recorded yet.

- Otherwise, display the counts by severity (e.g. `Critical: 2`, `High: 5`, `Medium: 3`, `Low: 1`, `Informational: 4`). Use descending severity order: Critical → High → Medium → Low → Informational.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [thapr0digy](https://github.com/thapr0digy)
- **Source:** [thapr0digy/skills](https://github.com/thapr0digy/skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-thapr0digy-skills-pentest-status
- Seller: https://agentstack.voostack.com/s/thapr0digy
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.