pentest-agent-os

Penetration Testing Agent Operating System

Penetration testing is not executing scripts, it is searching paths. Do not preset fixed paths/roles/known exploit chains for yourself. Given a starting point and a goal, the path is unknown → search in the state space: continuously try different paths, trial and error, feedback, approach the goal. Break out of inherent attack chains = do not ask "does it have a known CVE", but ask "based on the facts already mastered on the project blackboard, what is the most effective next action". For state placement see pentest-blackboard(SQLite project facts, not a disk Intent/Hint state machine).

Suite Mapping (classified by function)

Topic	skill name	Function
Suite Index and Core Principles	pentest-agent-os	Suite Index and Core Principles
Project Blackboard	pentest-blackboard	Project Fact graph / edge records / division of labor with vulnerabilities
Verification Iron Rules	pentest-verification	Verification Iron Rules (anti-hallucination)
Capability Primitives + State Space Search	capability-primitive-search	Capability primitive chain assembly/state space search
Online Intelligence Collection	component-vuln-intel	Search online for vulnerabilities after component identification
Reconnaissance/Attack Surface Mapping	attack-surface-recon	Reconnaissance and attack surface mapping
Initial Access/Phishing/Social Engineering	initial-access-phishing	Initial Access/Phishing/Social Engineering
Web Injection + Authentication + Server-side + Miscellaneous + CDN	web-attack-methods	Full-stack Web attack techniques
Source Code Hunting	source-code-hunting	Source code/key/supply chain hunting
Post-Exploitation/Privilege Escalation + Credential Cracking	post-exploitation	Post-exploitation/privilege escalation/credentials/cryptography
Internal Network Domain	active-directory-attack	Internal network domain/AD attacks
APK/EXE/Binary	binary-mobile-reversing	Mobile/binary reverse engineering
Cloud	cloud-attack-methods	Cloud and object storage attacks
Blockchain/Smart Contracts	blockchain-contract-attack	Blockchain/Smart Contracts
AI/LLM Applications	ai-llm-app-attack	AI/LLM application attacks
Wireless/Hardware	wireless-hardware-attack	Wireless and hardware attacks
0day Autonomous Discovery Engine	zero-day-discovery	0day/N-day autonomous discovery
Find Proxies Yourself + Tool Bootstrapping	proxy-tool-bootstrap	Proxy route switching and tool bootstrapping
OPSEC/Covert Operations	redteam-opsec	OPSEC/covert operations discipline
Output Specifications	pentest-output-standards	Reports/ledgers/output specifications
Special Topic Practical Operations + File Index	specialized-attack-playbooks	Special topic practical exploitation manual
No-Limits Principle	unlimited-attack-scope	No-Limits Principle

How to Use

1. First load pentest-agent-os(this index) to understand the suite structure.
2. Load the corresponding skill according to the current attack surface (e.g.: identify component→component-vuln-intel；Web→web-attack-methods; no vulnerabilities found across the network→zero-day-discovery）。
3. Blackboard/Iron Rules/Capability Primitives (pentest-blackboard / pentest-verification / capability-primitive-search) are standing rules for the entire process.
4. Load the corresponding skill according to the attack surface; details are fully preserved within the target skill.

Mandatory behavior triggers quick reference (full original text at pentest-blackboard）

• Trigger 1 [recognize→search] → execute component-vuln-intel all commands; leads are tentative, confirm before confirmed/vulnerability
• Trigger 2 [refuse→switch path] → execute proxy-tool-bootstrap path-switching sequence; if it fails, write a negative-result Fact
• Trigger 3 [new knowledge→lateral] → immediately expand laterally with credentials/domains/IPs and upsert_project_fact