{ "schema": "aiblocks-page/1", "id": "agency-security-penetration-tester", "type": "agent", "name": "Penetration test planner", "summary": "Name your scope and confirm you have permission. Get a plan for the test in order, rules to follow, and the report template you'll need.", "headline": "Penetration test planner", "subhead": "Confirm you have written authorization and name exactly what's in scope. It plans the test in order, recon first, then attacks. You get the ground rules and a findings template for your report.", "job": { "id": "secure-code", "name": "Keep your code secure" }, "level": "intermediate", "thinking": "high", "tested": true, "updated": "2026-11-03", "first_published": "2026-10-26", "inputs": [ { "type": "question", "required": true, "label": "Question", "what": "the problem, decision or piece of work you want help with, and what a good outcome looks like" }, { "type": "document", "required": false, "label": "Document", "what": "a finished document, such as a Word file, a PDF or a page of notes" } ], "outputs": [ { "type": "plan", "required": true, "label": "Plan", "what": "a dated plan: what to do, in what order, with a decision rule for each step" } ], "you_give": [ "Confirmation that you have written authorization for this engagement, from the system's actual owner.", "The exact scope: named IP ranges, domains, applications or cloud accounts, and anything explicitly off-limits.", "The rules of engagement: testing window, escalation contacts, and what to do if you find evidence of a real, separate breach.", "The test type: external, internal, web application, cloud, or a mix (optional, helps it plan phases)." ], "you_get": [ "A confirmed scope and rules-of-engagement summary, so everyone involved can check it matches what was agreed.", "A phased test plan: reconnaissance, enumeration, exploitation, lateral movement, reporting, in that order.", "A findings report template with severity, business impact and a copy-pasteable remediation section per finding.", "A retest plan so the client can verify fixes actually worked." ], "use_when": [ "You have written authorization to test your own systems, or systems you're contracted to test, and want a structured plan.", "You're scoping an engagement and need rules of engagement and a phase plan before testing starts.", "You finished a test and want a findings report template that reads as a full attack chain, not a list of CVEs.", "You want a retest plan so the client can confirm each fix actually worked." ], "skip_when": [ "You don't have written authorization and a named scope yet. Get that first. This agent will ask for it before planning anything.", "You want an automated scan of a live app you already have permission to test. Use the Live app security tester.", "You want the system's design reviewed instead of attacked. Use the Security Architect agent.", "You want to fix the findings. Use the Application security reviewer or the Cloud security designer." ], "output_sample": { "input": [ "Confirmation of written authorization, from the system's actual owner", "The exact scope: domains, IP ranges, apps or accounts, and what's off-limits", "The rules of engagement: testing window, escalation contact", "The test type (optional)" ], "prerequisites": [ "Written authorization for the named scope, obtained before you start" ], "output": [ { "name": "Scope and authorization", "contains": "Who authorized it, what's in and out of scope, and the testing window." }, { "name": "Rules of engagement", "contains": "The escalation contact and what to do if a real, unrelated breach turns up mid-test." }, { "name": "Test phases", "contains": "Reconnaissance through reporting, in order, with the evidence to capture at each phase." }, { "name": "Findings template", "contains": "A place for each finding's severity, full attack chain, evidence, fix and retest step." }, { "name": "Assumptions and checks", "contains": "What the agent assumed and which facts you still need to confirm." } ] }, "output_shape": "SCOPE AND AUTHORIZATION\n Authorized by: | In scope: | Out of scope: | Window: \n\nRULES OF ENGAGEMENT\n Escalation contact: | If a real unrelated breach is found: \n\nTEST PHASES (in order)\n | | \n\nFINDINGS TEMPLATE (per finding)\n Title | Severity | Attack chain (start to impact) | Evidence | Fix | Retest step\n\nASSUMPTIONS AND CHECKS STILL NEEDED\n | ", "how_to_use": [ "Download the pack from this page and add it to your AI as a skill, or paste SKILL.md then references/source-agent.md into a new chat.", "State plainly that you have written authorization, name the exact scope, and name anything off-limits.", "Give the testing window and who to contact if something urgent comes up.", "Say \"Build the test plan and the rules of engagement.\" It will stop and ask again if scope or authorization is unclear.", "Use the phase plan to run the engagement yourself, with your own tools, inside the agreed scope.", "Write each finding into the report template as you find it, then use the retest plan once fixes are in." ], "checks": [ "The result addresses your actual task and cites the evidence used.", "Examples, role-play experience and targets are kept separate from verified results.", "Claims of tests, memory, tool access or completed actions match what actually happened." ], "next": [ { "name": "Application security reviewer", "url": "https://useaiblocks.com/skills/agency-security-appsec-engineer", "why": "Application security reviewer" }, { "name": "Live app security tester", "url": "https://useaiblocks.com/skills/live-app-security-tester", "why": "Live app security tester" } ], "source": { "by": "Michael Sitarzewski and Agency Agents contributors", "repo": "msitarzewski/agency-agents", "url": "https://github.com/msitarzewski/agency-agents/blob/b37b5bb33b78f2c1d6567d98e25ca818e3259219/security/security-penetration-tester.md", "licence": "MIT", "original_name": "Penetration Tester", "commit": "b37b5bb33b78f2c1d6567d98e25ca818e3259219" }, "credits": [ { "title": "Penetration Tester", "by": "Michael Sitarzewski and Agency Agents contributors", "url": "https://github.com/msitarzewski/agency-agents/blob/b37b5bb33b78f2c1d6567d98e25ca818e3259219/security/security-penetration-tester.md", "used": "Original agent profile, preserved in references/source-agent.md; AI Blocks adds setup and review instructions." } ], "files": [ "LICENSE", "references/source-agent.md", "SETUP.md", "source.json" ], "links": { "page": "https://useaiblocks.com/agents/agency-security-penetration-tester", "markdown": "https://useaiblocks.com/agents/agency-security-penetration-tester.md", "json": "https://useaiblocks.com/agents/agency-security-penetration-tester.json", "instructions": "https://useaiblocks.com/skills/agency-security-penetration-tester/SKILL.md", "download": "https://useaiblocks.com/skills/agency-security-penetration-tester.zip", "api_item": "https://useaiblocks.com/api/v1/items/agency-security-penetration-tester", "api_document": "https://useaiblocks.com/api/v1/documents/agent/agency-security-penetration-tester", "mcp": "https://useaiblocks.com/mcp" } }