---

code: wize-sec-pentest
description: "Use quando o scope de segurança estiver definido e precisar executar o pipeline completo de pentest (recon → enumerate → exploit → report)."
name: wize-sec-pentest
overlay: security
module: security-overlay
owner: wize-sec-red-teamer  # Natasha Romanoff
status: ready
---

# wize-sec-pentest — Orchestrator (Security Overlay)

End-to-end security pipeline. Chains **recon → enumerate → sast → dast → report** through the four phase skills (`wize-sec-recon`, `wize-sec-enumerate`, `wize-sec-exploit`, `wize-sec-report`). Loads `.wize/security/scope.md` first; aborts the whole pipeline if the scope is missing or invalid.

## Usage

```bash
# Default (passive — read-only checks only)
/wize-sec-pentest

# Active exploitation (sqlmap, ffuf active fuzzing) — requires scope acceptance
/wize-sec-pentest --active

# Custom scope path (default: .wize/security/scope.md)
/wize-sec-pentest --scope=/path/to/scope.md
```

## Phases (in order)

1. **recon** — nmap (passive) → `recon.md`
2. **enumerate** — nuclei passive, HTTP probing → `enumerate.md`
3. **sast** — gitleaks (secrets) + osv-scanner/grype (deps) → `sast.md` (run inside `wize-sec-recon` per the architecture decision)
4. **dast** — nuclei + nikto (passive) + sqlmap/ffuf (gated by `--active`) → `dast.md`
5. **report** — render `report.md` + `report.html` from all partials

Each phase produces a partial. The report phase consumes them. A phase that fails is marked `partial_status: skipped` and the pipeline continues with the next one.

## Gate

Before any phase, the orchestrator calls `loadScope()` (the shared gate). An invalid scope aborts the whole pipeline with the error code from `ScopeError`. The gate is the single source of truth — phases do not re-validate.

## Propagation

`--active` is read from argv and passed to every phase invocation. Each phase that supports active checks (currently `wize-sec-exploit`) decides what changes in active mode.

## Output

- `recon.md`, `enumerate.md`, `sast.md`, `dast.md` — partials (one per phase)
- `report.md`, `report.html` — final consolidated report
- `.refusals.log` — audit trail of out-of-scope refusals
- `.tools.json` — detection cache for the toolchain

Exits 0 if at least one phase ran; 1 if all phases failed; 2 if the scope gate aborted.