Engagement planning
PenKit51 — Open-source AI penetration testing platform with 63 deep exploitation skills, multi-agent orchestration, PoC-validated findings, and native assistant skills for Claude, ChatGPT, and Grok. Authorized testing only.
npx -y skills add xAmirHamza77/PenKit51 --skill engagement-planningAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
2 things to look at
- no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
- 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Rules of engagement, scope definition, and authorized penetration test planning
SKILL.md
1.4 KB, 327 tokens by cl100k_base, as published. Nobody here has run it
Engagement Planning
Pre-Engagement Checklist
- Written authorization — signed SOW/ROE with explicit in-scope assets
- Scope boundaries — domains, IPs, apps, excluded systems (production DBs, third parties)
- Testing window — dates, hours, blackout periods
- Contacts — technical POC, emergency stop contact
- Data handling — what can be exfiltrated, retention, destruction
Scope Template
IN-SCOPE:
- https://app.example.com (all subpaths)
- api.example.com
- 10.0.0.0/24 (staging only)
OUT-OF-SCOPE:
- Production payment gateway
- Third-party SaaS (Stripe, Auth0)
- Social engineering / phishing
- DoS / availability attacks
Testing Phases
| Phase | Goal | Skills to Load |
|---|---|---|
| Recon | Attack surface map | subfinder-tooling, httpx-tooling, nmap-tooling |
| Enum | Services, endpoints, tech stack | katana-tooling, ffuf-tooling, nuclei-tooling |
| Assess | Vuln discovery | vulnerability-specific skills |
| Exploit | PoC validation | deep-pentest-methodology |
| Report | Findings + remediation | engagement-planning |
Risk Controls
- Start with passive/low-impact techniques
- Escalate only with evidence of vulnerability
- HITL approval for destructive operations
- Document every action with timestamps
What ships with it
Read from the repository
Just SKILL.md. No reference files, no scripts.