Pentest

Penetration Testing Router

Use this skill as the unified entry point for authorized penetration testing requests.

This skill does not run an internal scanning platform and does not depend on any remote proprietary service. Its role is to confirm authorization, identify the target type, and route the user to the correct public pentest skill.

Inputs

• authorization context
• target type
• target boundary

Missing-input collection rules

If the user asks for a generic pentest without enough context, ask only for the missing target type and authorization context. Prefer the smallest missing set that allows safe routing.

Safety Gate

Before proceeding, confirm:

1. The user is authorized to test the target.
2. The target environment is clear (staging, test, internal, or production).
3. The requested activity is within legitimate security testing scope.

Do not use this skill for unauthorized testing, destructive denial-of-service activity, or malicious operations.

Routing Rules

Route by target type:

• API, REST, GraphQL, gRPC, auth flows, IDOR, business-logic testing → api-pentest
• Internal network, external perimeter, infrastructure, ports, services, host exploitation → network-pentest
• AWS, Azure, GCP, IAM, metadata service abuse, cloud misconfiguration → cloud-pentest
• Mobile app, iOS, Android, MASTG-style testing → currently out of first-phase scope; explain that Orbit does not yet bundle mobile-pentest

Output Expectations

After routing, the selected pentest skill should provide:

• test scope and assumptions
• findings and severity
• proof-of-concept or reproduction steps
• remediation guidance

Notes

• For API and web targets, prefer api-pentest.
• For infrastructure-led assessments, prefer network-pentest.
• For cloud-specific environments, prefer cloud-pentest.
• If the user asks for a generic "pentest" without enough context, ask only for the missing target type and authorization context.