/engagement
Run an authorized penetration test end-to-end, chaining recon, testing, and reporting skills into one flow.
$ npx -y skills add jassics/awesome-claude-security --agent claude-codeHow it fires
How this command gets triggered: by you, by Claude, or both.
- Fires itselfClaude auto-loads it when your prompt matches the work.
- You can call itInvoke it directly when you want it.
- Slash command
/engagement
Context preview
What this command does when you run it.
Run an authorized penetration test end-to-end, chaining recon, testing, and reporting skills into one flow.
Command definition
engagement.mddescription: Run an authorized penetration test end-to-end, chaining recon, testing, and reporting skills into one flow.
argument-hint: [scope / target + rules of engagement]
Run an **authorized** penetration test for: **$ARGUMENTS**
First confirm authorization and scope (targets, exclusions, rules of engagement, timing). If scope is unclear, ask before touching anything.
Then walk the engagement, using the installed skills at each phase (skip any whose plugin isn't installed, and say so):
1. **Scope & plan** — `/pentester:recon` to frame the engagement and methodology (PTES / OWASP WSTG / NIST 800-115). 2. **Recon** — `/osint:osint-footprinting` and `/osint:exposure-discovery` to map the external attack surface. 3. **Model** — quick `/threat-modeling:stride` pass to prioritize where to test. 4. **Test** — by asset type: `/web-app-security:owasp-web-top10`, `/web-app-security:access-control-test`, `/web-app-security:injection-test`, `/network-security:network-pentest`, `/api-security:owasp-api-top10` as applicable. 5. **Prioritize** — `/vulnerability-management:vulnerability-prioritization` (CVSS/EPSS/KEV + asset context) to rank what you found. 6. **Report** — `/security-reporting:pentest-report` for the writeup; `/security-diagramming:attack-tree` for the kill-chain visual; optionally `/security-integrations:publish-finding-to-jira`.
For deep, multi-step execution of any phase, hand off to the `pentester` agent. Keep evidence for every finding and stay strictly within scope.
Read more
description: Run an authorized penetration test end-to-end, chaining recon, testing, and reporting skills into one flow. argument-hint: [scope / target + rules of engagement]
Run an **authorized** penetration test for: **$ARGUMENTS**
First confirm authorization and scope (targets, exclusions, rules of engagement, timing). If scope is unclear, ask before touching anything.
Then walk the engagement, using the installed skills at each phase (skip any whose plugin isn't installed, and say so):
1. **Scope & plan** — `/pentester:recon` to frame the engagement and methodology (PTES / OWASP WSTG / NIST 800-115). 2. **Recon** — `/osint:osint-footprinting` and `/osint:exposure-discovery` to map the external attack surface. 3. **Model** — quick `/threat-modeling:stride` pass to prioritize where to test. 4. **Test** — by asset type: `/web-app-security:owasp-web-top10`, `/web-app-security:access-control-test`, `/web-app-security:injection-test`, `/network-security:network-pentest`, `/api-security:owasp-api-top10` as applicable. 5. **Prioritize** — `/vulnerability-management:vulnerability-prioritization` (CVSS/EPSS/KEV + asset context) to rank what you found. 6. **Report** — `/security-reporting:pentest-report` for the writeup; `/security-diagramming:attack-tree` for the kill-chain visual; optionally `/security-integrations:publish-finding-to-jira`.
For deep, multi-step execution of any phase, hand off to the `pentester` agent. Keep evidence for every finding and stay strictly within scope.
A Claude Code plugin marketplace for the full cybersecurity & GenAI-security lifecycle — from recon and threat modeling to detection engineering, GRC, and CISO-level strategy. A pentester knows which OWASP test bends a broken-access-control endpoint.
Repo: jassics/awesome-claude-security
Other commands on awesome-claude-security.
- /safety-review
Run an AI safety review for a feature/model — harms, evaluations, guardrails, and a documented safety case.
Open command - /defend
Run a threat-informed defense cycle for a technique or threat — coverage check, hunt, detection, and purple-team validation.
Open command - /board-brief
Build a board/executive security brief — strategy, quantified risk, and a board-ready deck.
Open command - /tech-review
Assess technology/security risk for a strategic decision and frame the secure-by-design path.
Open command - /precommit
Run the pre-commit security gate on the current changeset and report a single pass/fail verdict.
Open command - /assessment
Run a compliance gap-assessment for a framework, tie gaps to risk, and produce findings + remediation.
Open command