---
description: Focused adversarial playbooks for AIOSON framework_target reviews
agents: [pentester]
task_types: [framework-security, agent-security]
triggers: [framework_target, runtime permissions, handoff security, installer integrity]
---

# Pentester Framework Playbooks

Use only for `framework_target`.

## Core surfaces

### memory_context

Probe context, handoff, research, and dossier inputs for direct/indirect prompt injection, fake control tags, Unicode/bidi tricks, stale authority, and multimodal instructions. Verify Dev/QA never treat agent prompts or untrusted content as governing context. Load `llm-supplychain.md` for deep LLM taxonomy.

### tool_invocation

Trace dynamic shell/process arguments, filesystem paths, write targets, and user-controlled values. Require argument separation, validated paths, bounded targets, and no prompt-only protection for executable commands.

### delegation_handoff

Check handoff schemas, agent identity, manifest trust, capability escalation, malformed types, and whether untrusted summaries can change authority.

### protocol_contract

Attempt missing/malformed required fields, stale state, forged approvals, duplicate events, and gate skipping. Confirm validators fail closed where integrity matters and advisory evidence cannot approve a gate.

### secret_handling

Inspect scoped context, logs, runtime artifacts, configs, and responses for credentials/tokens. Verify redaction and that diagnostics do not serialize environment secrets.

### runtime_permissions

Test autonomy policy, manifest/flag validation, disabled-agent enforcement, path authorization, cycle caps, and whether guarded behavior is executable rather than prompt-only.

## Conditional surfaces

### auth_identity

When approvals, ownership, or trust boundaries are touched, test forged agent/user identity and unauthorized role/capability transitions.

### installation_integrity

When install/update/template copy paths change, test:

- protection after a protected destination is deleted
- install/update mode-aware guards
- corrupt JSON recovery
- non-fatal backup failure
- symlink/path traversal and `..` rejection
- install detection after a fresh clone with ignored config
- preservation of richer project-local config against empty template defaults

### supply_chain_integrity

When manifests, lockfiles, CI, third-party fetches, or publishing change, load `llm-supplychain.md`. At minimum check committed lockfile, frozen/clean install, lifecycle scripts, Actions pinned to SHA, dangerous `pull_request_target`, least-privilege tokens, provenance, and artifact signing where release risk warrants it.

## Tool choice

Use existing tools proportionally: Semgrep/CodeQL for SAST, Trivy for dependency/container/IaC, Gitleaks plus verified-secret tooling, and actionlint/zizmor for Actions. A named tool is an option, not an installation mandate. Manual reasoning remains required for trust, identity, workflow, and race surfaces.