feat: scan-ingest + gates + guard + cloud + dotslash toolkit + pentester-playwright + skill rename - #1
Merged
Conversation
…lash toolkit + pentester-playwright; namespace all skills pentester-*
Capability layers (all follow the lib/ + resolveWorkspace CLI + selftest fixture pattern; zero runtime deps):
- scan-ingest: normalize nmap XML / nuclei JSONL / httpx JSON / ffuf / gobuster / nikto
output into the Triage ledger, idempotently, preserving human dispositions
(lib/scan-ingest.js + CLI + skill + fixtures + test:ingest).
- Phase 2/5 rigor: pentester-threat-model + pentester-post-exploit skills; validator gates —
every declared critical_surface/priority_threat must be modeled; Phase 4→5 consistency
(access!=none ⇒ substantive situational-awareness); lateral_hosts must pass scope deny.
- Runtime guard: pre-flight offensive commands against scope.md (deny_hosts / window / banned)
+ append to activity-log.md (lib/guard.js + CLI + schema artifact_patterns.activity_log + gate).
- Cloud coverage: src-hunter playbooks/cloud/{aws,azure,gcp,k8s} + tier-1 knowledge; signal `cloud`
registered; lookup/playbook selftests assert it surfaces.
Tools (task 1): dotslash provisioning layer under .agents/tools/ (11 tools pinned to GitHub
releases + gen-dotslash.js hash generator + TOOLS.md phase map + provision.sh), pentester-toolkit
adapter, wired into phases 1/1b/3/5 (scope-gated; httpx/nuclei feed scan-ingest).
pentester-playwright (task 2): replaces playwright-skill with an authorized SPA-recon skill
(proxy chain, hard-welded scope, XHR/fetch/WS catalog, multi-role auth, HAR/screenshots,
JSON contract) + scripts/poc.js evidence executor preserving the phase 1b/3/4 PoC contract.
Rename (task 3): all skills namespaced pentester-*; every reference updated (schema.json skill
fields, env-render playwright_cwd, lint-hotpaths, package.json scripts, phases, AGENTS/README,
.gitignore, .codex mirror). test:all green.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
本次会话的框架增强，一次交付。
npm run test:all全绿（8 个 job：新增test:ingest/test:guard）。能力层（沿用
lib/+resolveWorkspaceCLI + selftest 夹具，零运行时依赖）pentester-threat-model/pentester-post-exploitskill + 校验门禁（critical_surface/priority_threat 必须建模；Phase 4→5 一致性；lateral 过 scope deny）。activity-log.md审计。playbooks/cloud/{aws,azure,gcp,k8s}+ tier-1 知识 +cloudsignal。任务 1 — dotslash 工具层
.agents/tools/11 个 dotslash 清单（pin GitHub release）+gen-dotslash.js生成器 +TOOLS.mdphase 映射 +provision.sh；pentester-toolkit适配器；接进 phase 1/1b/3/5（scope-gate；httpx/nuclei 喂 scan-ingest）。任务 2 — pentester-playwright
替换旧 playwright-skill：授权 SPA recon（代理链、硬焊 scope、XHR/fetch/WS 目录、多角色认证、HAR/截图、JSON 契约）+
scripts/poc.js证据 executor（保留 phase 1b/3/4 PoC 契约）。任务 3 — 全量改名
所有 skill 命名为
pentester-*，更新全部引用（schema.json、env-render、lint-hotpaths、package.json、phases、AGENTS/README、.gitignore、.codex 镜像）。诚实说明
node .agents/tools/gen-dotslash.js all（需网络）；其余 7 个已带真实 sha256。🤖 Generated with Claude Code