Skill: Agentic Pentest

Supplementary Files:

• payloads.md — PentestGPT / HexStrike AI / Viper / PentestAgent / AI-Infra-Guard / AutoPWN / EvilPrompt setup recipes, session/prime/context templates, tool-delegation manifests, multi-agent team configs, scope-lock policies, human-in-the-loop checkpoint scripts, hallucination-mitigation patterns, token/cost budgets, evidence templates, and reporting skeletons
• test-cases.md — 12 structured test cases (TC-AP-001 .. TC-AP-012) covering framework setup, scope enforcement, context priming, autonomous recon, autonomous exploitation, human-in-the-loop checkpoints, multi-agent coordination, hallucination mitigation, output validation, evidence chain, cost discipline, and full end-to-end engagement
• guides/agentic-pentest-playbook.md — End-to-end operations manual (engagement framing, framework selection matrix, reasoning-chain design, six-phase autonomous workflow, context window management, human-in-the-loop integration, scope drift prevention, and the team-vs-tool decision)
• guides/agent-orchestration-patterns-playbook.md — Multi-agent orchestration patterns playbook (single vs multi-agent decision framework, orchestrator-worker / CEO specialist topology, LangGraph-style state graph, DAG-based task decomposition, memory/persistence layer with Redis/SQLite, A2A vs MCP inter-agent protocols, loop termination criteria, cost-bounded execution, and real-world agentic security tools XBOW / RaxisAI / Pentest Copilot / HexStrike AI / CAI)
• guides/agentic-pentest-deep-dive.md — Multi-agent team coordination patterns (four-role reference team, shared-state handoff protocol, PentestGPT internal planner/executor split, HexStrike explicit planner/executor/verifier topology, Viper adversary-profile-driven flow, role decomposition anti-patterns, MCP vs A2A vs shared-file protocols), HITL checkpoint design (five-class safety taxonomy, checkpoint document schema, pause/resume semantics, evidence-review gates, scope-enforcement guardrails, HITL anti-patterns), and three end-to-end case studies (web app recon→SQLi, multi-agent team against /24, APT29 purple-team emulation)

Summary

Agentic pentest skill domain covering the deployment and operation of LLM-driven autonomous penetration testing frameworks — PentestGPT, HexStrike AI, Viper, PentestAgent, AI-Infra-Guard, AutoPWN, EvilPrompt, and the custom OpenClaw/nanoclaw harness pattern. Where autonomous-loops teaches generic loop constructs and engagement-manager orchestrates skill composition, this skill is the concrete toolkit for putting an LLM in the driver's seat of an actual engagement — priming its context with scope and target data, delegating tool calls (nmap, sqlmap, ffuf, metasploit, custom Python), enforcing human-in-the-loop checkpoints before destructive actions, validating the agent's claims against ground truth (verification-loop integration), and coordinating multi-agent teams (recon / exploit / post-exp / report agents) without scope drift.

Tools: PentestGPT, HexStrike AI, Viper, PentestAgent, AI-Infra-Guard, AutoPWN, EvilPrompt, OpenClaw/nanoclaw harness, Claude/GPT-4o (driving models), plus the standard pentest toolkit that the agent invokes (nmap, sqlmap, ffuf, gobuster, nuclei, metasploit, bloodhound, custom Python)

Domain: ai-meta

Mappings: Meta-skill (no direct MITRE mapping); orchestrates coverage across all ATT&CK tactics (TA0043-Reconnaissance through TA0042-Exfiltration) via framework delegation. The skill itself is operator infrastructure.

Description

Agentic pentest is the discipline of treating a large language model as the reasoning core of a penetration test — not a chat assistant that suggests commands, but an autonomous operator that reads output, decides the next step, and invokes tools, with a human reviewer approving destructive actions. The pattern is now mature enough to be standardized: PentestGPT (13.7k stars) demonstrated the reason-chain-first approach; HexStrike AI (9.6k) shipped the MCP-based multi-agent variant; Viper (5k) added adversary simulation; PentestAgent (2.6k) formalized black-box agentic testing; AI-Infra-Guard (3.9k) operationalized AI-driven infra scanning; AutoPWN and EvilPrompt pushed automated exploitation. The kali-claw workspace is itself a reference implementation of this pattern — the OpenClaw agent harness.

This skill is the operator's manual for putting any of these frameworks into production on a scoped engagement. Where ai-agent-security is how you attack agent systems, agentic-pentest is how you deploy and operate one as your offensive tool. Where autonomous-loops is generic loop constructs, agentic-pentest is domain-specific (pentest) with concrete frameworks, MCP servers, and tool-delegation manifests. Where engagement-manager is the human-readable orchestration layer, agentic-pentest is the agent-readable execution layer that the engagement manager invokes when it wants to delegate a phase to an LLM.

Difference from autonomous-loops: autonomous-loops defines the four generic loop patterns (sequential pipeline, watch loop, batch, learning cycle) — the abstract constructs. agentic-pentest is the domain-specific application: which LLM-driven framework implements each pattern for pentest, how to prime the agent's context, how to delegate tools, how to enforce scope at the agent layer. autonomous-loops tells you what a loop is; agentic-pentest tells you how to put an LLM in charge of one running nmap across a /24.

Difference from multi-agent-collaboration: multi-agent-collaboration is the generic multi-agent coordination primitive. agentic-pentest applies it to the specific case of a pentest team — recon agent, exploit agent, post-exp agent, report agent — with concrete MCP configurations and tool-delegation manifests. Use multi-agent-collaboration for the abstract patterns; use agentic-pentest for the operational deployment.

Difference from engagement-manager: engagement-manager is the orchestration layer that tracks the kill chain phases, evidence chains, and stakeholder communication — it is human-readable. agentic-pentest is the execution layer the engagement manager invokes when it wants an LLM agent to drive a phase autonomously. The engagement manager decides what to delegate; agentic-pentest decides how the agent does it.

Difference from ai-agent-security (v0.1.30 sibling): ai-agent-security is how you ATTACK agent systems (prompt injection against the agent, tool abuse, MCP poisoning). agentic-pentest is how you DEPLOY an agent as your offensive tool. They share concepts (MCP, tool delegation, context windows) but use them in opposite directions. They pair well: run agentic-pentest for speed, then run ai-agent-security to test whether your own pentest agent is itself vulnerable to adversarial inputs from the target.

Difference from terminal-ops: terminal-ops is the skill for safe, evidence-logged command-line execution by the operator. agentic-pentest is the skill for delegating that command-line execution to an LLM agent. The agent's tool invocations should still follow terminal-ops discipline (logging, scope check, evidence capture); this skill ensures they do.

Use Cases

• Autonomous recon sweep — Point PentestGPT or a custom OpenClaw harness at a scoped target list and let the agent run nmap/nuclei/ffuf/web-discovery, parse output, decide next steps (deeper enumeration on interesting ports), and produce a structured attack surface map, with the human approving any phase-2 active exploitation.
• Reasoning-chain exploitation — Feed the agent a vulnerable web app and let it reason through SQLi discovery → sqlmap dump → credential reuse → lateral movement, halting at each destructive step for human approval (PentestGPT's --reasoning mode or HexStrike's planner-exploiter split).
• Multi-agent pentest team — Deploy a Viper or custom MCP-based team: recon agent (nmap, ffuf), vuln agent (nuclei, custom checks), exploit agent (metasploit, sqlmap), report agent (consolidates evidence). Coordinate via shared state with the human as engagement manager.
• Continuous attack-surface monitoring — Stand up an agent that watches a target perimeter (your own production or a scoped client) for new services, new subdomains, exposed credentials, and drift from the known-good baseline, alerting on changes.
• Adversary simulation (purple team) — Use Viper or a custom harness to emulate a specific threat actor's TTPs against the client's detection stack, validating that blue-team detections fire and measuring detection latency.
• AI infra perimeter sweep — Use AI-Infra-Guard (driven by an LLM that triages findings) to scan the target org's perimeter for exposed MLflow, Ray, Jupyter, Triton, vLLM, Ollama, and LLM APIs — the agent prioritizes and reports.
• Scope-bound automated exploitation — AutoPWN-style: agent enumerates, matches findings to known exploit modules, attempts safe exploitation (POC only, no destructive payload), reports verified exploitability with evidence.
• Pre-engagement recon automation — Before a manual engagement, run an agent overnight against OSINT sources (subfinder, amass, theHarvester, GitHub dorks) to produce a prioritized target list and attack-surface map that the human operator starts from on day 1.
• CTF / training automation — Deploy an agent in a sandbox CTF environment to demonstrate the autonomous pentest workflow end-to-end without authorization concerns, useful for training and for showcasing the technique to stakeholders.
• Engagement acceleration — On a time-boxed engagement, delegate the repetitive 60% (port scans, service enumeration, basic vuln scanning, screenshot capture) to the agent while the human focuses on the high-judgment 40% (manual exploitation, business-logic flaws, post-exploitation decision-making).

Core Tools

Tool	Purpose	Command / Usage
PentestGPT	Reason-chain-first LLM pentest framework; parses tool output, maintains todo/state, suggests next step, supports --reasoning modes (uber/interactive). 13.7k stars.	pentestgpt --reasoning_api gpt-4o then within session: test <module>, discuss, next
HexStrike AI	MCP-based multi-agent pentest framework; planner agent + executor agents, Claude/GPT integration, tool servers via MCP. 9.6k stars.	Configure MCP servers, launch HexStrike orchestrator with --target and --scope
Viper	AI red-team / adversary simulation platform; C2 framework with LLM-driven decisioning, designed for purple-team exercises. 5k stars.	docker-compose up then browser-based console; define adversary profile, target scope, run simulation
PentestAgent	Black-box agentic testing framework; formal phases (recon, scan, vuln, exploit), framework-agnostic, research-oriented. 2.6k stars.	python -m pentestagent --config engagement.yaml
AI-Infra-Guard	AI infrastructure scanner — discovers MLflow, Ray, Jupyter, Triton, vLLM, Ollama, LangServe; agent-friendly output for triage. 3.9k stars.	ai-infra-guard -t target.com -p 1-65535 --output recon.json
AutoPWN	Automated exploitation framework; matches scan output to exploit DB / Metasploit modules, attempts safe POC exploitation, reports verified exploitability.	autopwn --scan results.xml --mode safe-poc --output exploits.json
EvilPrompt	LLM-driven attack orchestrator; focuses on prompt-driven exploitation workflow, useful for chained attacks where the LLM composes the chain.	evilprompt --config chain.yaml --target $TARGET
OpenClaw / nanoclaw harness	The kali-claw workspace's own agent harness pattern — Claude/GPT in a loop with tool delegation, scope lock, evidence capture, HITL checkpoints. Reference implementation in this repo.	./validation/orchestrator.sh --target web --phase all --agent-mode autonomous (when supported)
MCP servers (filesystem, bash, http, custom)	The tool layer agents call into — MCP is the standard for delegating tools to an LLM. Filesystem for evidence, bash for command exec, http for API calls, custom for pentest-specific tools.	Per mcp-server-patterns skill; configure in agent's MCP client config
Verification harness (custom Python)	The output-validation layer — every agent claim ("I found SQLi at /api/users") must be independently re-run by a verification script that the human trusts. Pairs with verification-loop skill.	python3 verify.py --claim claims.json --output verified.json
Scope-lock policy engine (custom YAML + Python)	The scope enforcement layer — every agent-proposed command is checked against the scope lock before execution. Hard boundary; aborts on violation.	python3 scope_check.py --command "$CMD" --policy scope.yaml
Cost / token tracker (custom)	Tracks tokens in/out, model, cost-per-hour, alerts on engagement spend ceiling. Required for any agent engagement with pay-per-token models.	python3 cost_tracker.py --ceiling $500 --alert-at 80%

Methodology

Six-Phase Agentic Pentest Engagement

Phase 1           Phase 2            Phase 3            Phase 4            Phase 5            Phase 6
Authorize &    →  Select & Prime  →  Autonomous      →  Human-in-Loop   →  Validate &       →  Report &
Scope             Agent              Recon Sweep        Checkpoints        Exploit Chains       Detect
   │                 │                  │                  │                  │                  │
   ▼                 ▼                  ▼                  ▼                  ▼                  ▼
Engagement      Framework choice,  nmap/ffuf/nuclei  Destructive actions Independent        OWASP / MITRE
letter, scope,  context priming,   driven by agent;  require human      re-run of every    mapping, evidence
HITL policy,    scope lock load    structured ASMD   approval; report   agent claim;       chain, detection
cost ceiling    into agent state   to evidence dir   at every checkpoint hallucination check   rules from findings

Phase 1: Authorize & Scope

The engagement letter for an agentic pentest is stricter than a manual one. The agent will attempt actions the operator did not explicitly authorize — that is the point of autonomy. The scope must define:

1. Target list (CIDR / hostnames / URLs) — explicit, enumerated
2. Allowed techniques — explicit allow-list (e.g., "nmap -sV", "sqlmap --dump", "ffuf")
3. Forbidden techniques — explicit deny-list (DoS, social engineering, physical, prod-destructive)
4. Human-in-the-loop policy — which action classes require human approval BEFORE execution
   (typically: any exploitation, any credential use, any data modification, any cross-host action)
5. Cost ceiling — USD or token cap; agent aborts if exceeded
6. Time ceiling — wall-clock cap; agent aborts if exceeded
7. Hallucination policy — what happens when the agent claims a finding that verification cannot reproduce
   (typically: drop the finding, log the hallucination, do NOT report unverified claims)
8. Out-of-scope bystanders — third parties who might be affected (e.g., shared hosting, cloud provider APIs)
9. Disclosure terms — vendor findings, internal NDA, publication rights

Phase 2: Select & Prime the Agent

Select the framework based on the engagement shape (see Selection Guide below). Then prime the agent's context — this is the highest-leverage operator action in an agentic engagement.

# PentestGPT — prime with engagement context
pentestgpt --reasoning_api gpt-4o
# Within the session, paste:
#   - Target list
#   - Allowed/denied techniques
#   - HITL policy
#   - Initial reconnaissance data (if any)

# HexStrike — prime via config file
cat > engagement.yaml <<'YAML'
target: https://target.com
scope:
  allowed_techniques: [nmap, ffuf, nuclei, sqlmap-safe-mode]
  denied_techniques: [dos, social-engineering, destructive-exploit]
hitl_policy:
  require_approval_before: [exploitation, credential-use, data-modification]
cost_ceiling_usd: 500
time_ceiling_hours: 8
YAML
hexstrike --config engagement.yaml

The prime should include:

• The target list (explicit, enumerated)
• The allowed/denied techniques
• The HITL policy (what requires approval)
• Any known context (prior recon, client-provided intel)
• The evidence directory convention (where to write outputs)
• The verification policy (every claim must be independently reproducible)
• The abort conditions

Phase 3: Autonomous Recon Sweep

Delegate the recon phase to the agent. This is the safest phase to fully automate — recon is non-destructive, evidence is straightforward to capture, and the agent's value is highest here (deciding what to enumerate deeper based on what it finds).

# OpenClaw harness example — autonomous recon
./validation/orchestrator.sh \
  --target web \
  --phase recon \
  --agent-mode autonomous \
  --scope scope.yaml \
  --evidence-dir evidence/$(date +%F)/recon

# The agent will:
# 1. Run nmap against the target
# 2. Parse open ports, decide which to enumerate further
# 3. Run ffuf for web discovery on open HTTP ports
# 4. Run nuclei for known vulns
# 5. Produce an attack-surface map (ASMD)
# 6. HALT before any active exploitation

Phase 4: Human-in-the-Loop Checkpoints

For every action class in the HITL policy's require_approval_before, the agent halts and surfaces a checkpoint to the operator. The operator approves, modifies, or rejects. The agent logs the decision and continues (or aborts).

## HITL Checkpoint — Exploitation Approval Request
- **Agent**: OpenClaw recon→exploit transition
- **Target**: https://target.com/login.php
- **Proposed action**: sqlmap -u "https://target.com/login.php" --data "user=FUZZ&pass=FUZZ" --batch --risk=2
- **Reasoning**: Found parameterized login form, nmap shows MySQL backend, nuclei flagged
  potential SQLi. Proposing safe-mode sqlmap to confirm.
- **Evidence**: nuclei output (nuclei-2026-06-17.json), login form screenshot
- **Risk assessment**: --risk=2 = elevated risk; --batch = non-interactive; no --dump (no data exfil)
- **Operator decision**: [APPROVE / MODIFY / REJECT / DEFER]
- **Operator notes**: ____

Phase 5: Validate & Exploit Chains

Every agent claim ("I found SQLi", "I got a shell") must be independently verified by the operator or a verification script. Hallucination is the dominant failure mode of agentic pentest — the agent confabulates findings, claims exploitation succeeded when it did not, or invents credentials. Verification is non-negotiable.

# Verification harness — re-run every agent claim independently
python3 verify.py \
  --claims evidence/$(date +%F)/claims.json \
  --output evidence/$(date +%F)/verified.json \
  --policy verify-everything

# Claims that fail verification are dropped from the report and logged as hallucinations
# Hallucination rate is itself an engagement finding (the agent's reliability)

For exploit chains, the human is more involved — chains require judgment the agent does not have (when to stop, when to escalate, when to call the client). Phase 5 is the most human-in-the-loop phase.

Phase 6: Report & Detect

Compile the verified findings into the engagement report. The agent can draft the report (it has the context), but the operator reviews every word before delivery. Detection rules are derived from the agent's actual actions — every command the agent ran becomes a candidate Sigma rule for the blue team.

# Agent drafts the report from verified evidence
python3 report/generate.py \
  --verified evidence/$(date +%F)/verified.json \
  --template report/pentest.md.j2 \
  --output deliverables/pentest-report-draft.md

# Operator reviews, edits, signs off
$EDITOR deliverables/pentest-report-draft.md

# Detection rules from agent's commands
python3 detect/extract_sigma.py \
  --log evidence/$(date +%F)/agent-actions.log \
  --output deliverables/detection-rules/

Framework Selection Guide

Scenario	Recommended Framework	Alternative
Reasoning-first, single target, interactive	PentestGPT	Custom OpenClaw harness
Multi-agent team, MCP-native, Claude/GPT	HexStrike AI	Custom MCP orchestrator
Adversary simulation, purple team, C2 needed	Viper	Caldera + custom LLM decisioning
Research, formal-phase, black-box agnostic	PentestAgent	Custom research harness
AI infrastructure focus (MLflow, vLLM, Ollama)	AI-Infra-Guard + LLM triage	Custom scanner + agent triage layer
Automated safe-POC exploitation	AutoPWN	Metasploit + custom LLM module selection
Custom engagement, full control, kali-claw style	OpenClaw / nanoclaw harness	PentestGPT in --reasoning uber mode
Limited budget, single target	PentestGPT interactive (operator drives)	Local Ollama model + custom harness
Continuous monitoring (long-running)	Custom OpenClaw harness in watch-loop mode	PentestAgent + cron
CTF / training	PentestGPT or custom harness in sandbox	Any framework — no auth concerns

HITL Policy Templates

Action Class	Default HITL	Reasoning
Port scan (nmap -sV)	Auto	Non-destructive, standard recon
Web discovery (ffuf, gobuster)	Auto	Non-destructive, standard recon
Vuln scan (nuclei)	Auto	Non-destructive (mostly), standard recon
Safe POC exploitation (sqlmap --batch --risk=1)	Approve	Touches target with active payload
Elevated exploitation (sqlmap --risk=2+, --dump)	Approve + confirm	Risk of service disruption, data exfil
Credential use (reuse, brute)	Approve	Could lock accounts, trigger alerts
Data modification (any write, upload, POST that changes state)	Approve + confirm	Persistent impact
Cross-host action (lateral movement)	Approve + confirm	Leaves original scope boundary
Post-exploitation (priv esc, persistence)	Approve + confirm	High impact, hard to undo
DoS-adjacent (high-rate fuzzing, aggressive timing)	Reject by default	Forbidden in most engagements
Out-of-scope target encountered	Halt + log	Scope violation; abort phase

Agentic Pentest Attack Matrix

The Agentic Pentest Attack Matrix maps the kill-chain phases to the agent capabilities, tools, and HITL classes each phase requires. This matrix guides engagement planning by making explicit which agent role owns which phase, what the verification looks like, and where the human must intervene.