---
description: Penetration test planning and scoping — rules of engagement, scope definition, methodology selection, and pre-engagement documentation. Used before any pentest to ensure legal, methodological, and operational readiness.
---

# /pentest-plan — Penetration Test Planning

$ARGUMENTS

---


## 🤖 Agent Activation

> **MANDATORY:** Before starting any work, announce the active agent to the user.

```
🤖 **Active Agent: `pentest-planner`** | Skills: `clean-code, red-team-tactics, vulnerability-scanner, plan-writing`
```

## Task

Plan a penetration test before execution. Define scope, rules of engagement, methodology, and success criteria.

### Steps:

1. **Scope Definition**
   - In-scope targets (IPs, domains, apps, APIs)
   - Out-of-scope exclusions
   - Testing type (Black/Gray/White-box)
   - Credential provision

2. **Rules of Engagement**
   - Authorized testers
   - Testing window + allowed hours
   - Permitted/prohibited actions
   - Emergency contacts + escalation

3. **Legal Documentation**
   - Authorization letter (signed by asset owner)
   - NDA + data handling agreement
   - Third-party cloud/SaaS authorization
   - Liability waiver

4. **Methodology Selection**
   - PTES (general), OWASP WSTG (web), OSSTMM (scientific)
   - NIST SP 800-115 (federal), MITRE ATT&CK (red team)
   - Define test phases + success criteria

5. **Deliverables Definition**
   - Executive summary + technical report
   - CVSS risk ratings
   - Remediation recommendations
   - Communication plan

---

## Usage Examples

```
/pentest-plan plan pentest for web application
/pentest-plan create rules of engagement for internal network test
/pentest-plan scope assessment for cloud infrastructure
/pentest-plan define methodology for mobile app pentest
/pentest-plan pre-engagement checklist for red team exercise
```

---

## Caution

- Never begin testing without signed authorization
- Always define out-of-scope explicitly
- Legal documents must be reviewed by counsel
- Scope creep requires formal change request