---
name: security-tester
description: Performs penetration testing and security assessments following PTES methodology. Use when performing authorized security testing, vulnerability scanning, or CTF challenges.
argument-hint: "[target] [--scope=webapp] [--phase=recon]"
allowed-tools: [Read, Write, Edit, Bash, Task, WebSearch, WebFetch]
disable-model-invocation: true
---

# Security Tester Skill

Perform authorized penetration testing and security assessments following the Penetration Testing Execution Standard (PTES) methodology.

## Important Notice

This skill is for **authorized security testing only**. Always ensure you have:
- Written authorization to test the target
- Clearly defined scope and rules of engagement
- Emergency contact information
- Legal agreements in place

## PTES Methodology

| Phase | Description |
|-------|-------------|
| 1. Pre-engagement | Scope, authorization, rules of engagement |
| 2. Intelligence Gathering | OSINT, reconnaissance, target profiling |
| 3. Threat Modeling | Identify attack vectors, prioritize targets |
| 4. Vulnerability Analysis | Identify weaknesses, validate findings |
| 5. Exploitation | Controlled exploitation, proof of concept |
| 6. Post-Exploitation | Assess impact, lateral movement |
| 7. Reporting | Document findings, recommendations |

## Capabilities

- Web application security testing
- API security assessment
- Infrastructure scanning
- OSINT and reconnaissance
- Vulnerability identification
- Security report generation

## Test Categories

| Category | Focus Areas |
|----------|-------------|
| **Web App** | OWASP Top 10, authentication, authorization |
| **API** | REST/GraphQL security, rate limiting, auth |
| **Network** | Port scanning, service enumeration |
| **Cloud** | Misconfiguration, IAM, exposed resources |
| **Mobile** | App security, API calls, data storage |

## Process

1. **Pre-engagement**
   - Define scope and boundaries
   - Obtain authorization
   - Set up testing environment

2. **Reconnaissance**
   - Passive information gathering
   - Active enumeration
   - Technology fingerprinting

3. **Vulnerability Assessment**
   - Automated scanning
   - Manual testing
   - False positive validation

4. **Controlled Exploitation**
   - Proof of concept development
   - Impact assessment
   - Documentation

5. **Reporting**
   - Finding documentation
   - Risk ratings
   - Remediation guidance

## Parameters

| Parameter | Description | Default |
|-----------|-------------|---------|
| `target` | Target URL or IP | Required |
| `--scope` | webapp, api, network, full | webapp |
| `--phase` | recon, vuln, exploit, report | recon |
| `--auth-file` | Authorization document | none |
| `--output` | Report output directory | ./security-reports |

## Example Usage

```bash
# Start reconnaissance phase
/myaidev-method:security-tester "https://app.example.com" --phase=recon

# Web application assessment
/myaidev-method:security-tester "https://app.example.com" --scope=webapp

# API security testing
/myaidev-method:security-tester "https://api.example.com" --scope=api

# Generate report
/myaidev-method:security-tester "https://app.example.com" --phase=report
```

## Report Format

```markdown
# Security Assessment Report

## Executive Summary
- **Target**: [Target]
- **Assessment Date**: [Date]
- **Scope**: [Scope]
- **Risk Rating**: [Critical/High/Medium/Low]

## Findings Summary
| ID | Title | Severity | Status |
|----|-------|----------|--------|
| V-001 | [Title] | Critical | Open |

## Detailed Findings

### V-001: [Vulnerability Title]
- **Severity**: Critical
- **CVSS**: 9.8
- **Location**: [Affected component]
- **Description**: [What's wrong]
- **Impact**: [Business impact]
- **Proof of Concept**: [Steps to reproduce]
- **Remediation**: [How to fix]
- **References**: [CVE, CWE, OWASP]

## Remediation Roadmap
1. [Priority 1 actions]
2. [Priority 2 actions]
```

## Integration

- Works with `/myaidev-method:security-auditor` for compliance
- Reports can be published via content workflow
- Part of comprehensive security workflow