Imported from zaurqasimov1337/MilliSec-Pentest-AI (pentest-ai/AGENTS.md). Install upstream with npx skills add zaurqasimov1337/MilliSec-Pentest-AI --skill pentest-ai. Copyright stays with the author.

Agent guide for pentest-ai

Name: pentest-ai
Author: zaurqasimov1337

For AI coding agents (Claude Code, Cursor, Copilot, Codex CLI, Devin, Windsurf, Gemini CLI, Aider) and human contributors. Briefly: build, test, style, layout. Defer to README.md for product info.

Build

pip install -e .[dev]

Optional surfaces (install only what you'll touch):

pip install -e .[litellm,api,menu,browser,tracing,stealth,cloud]

Browser tests need: playwright install chromium. Stealth crawler needs: scrapling install --force.

Test

pytest                         # full suite
pytest tests/test_cli.py       # one file
pytest -k "name_substring"     # by keyword

asyncio_mode = "auto" is set in pyproject.toml. Use pytest-asyncio patterns; do not call asyncio.run inside tests.

Lint, types, format

ruff check .          # lint
ruff format .         # format
mypy .                # types (non-strict; see [tool.mypy] in pyproject.toml)

Pre-commit hooks: pre-commit install once, then they run on every commit.

Layout

Path	Purpose
`cli/`	`ptai` CLI entrypoint, menu, install wizard, MCP setup
`mcp_server/`	FastMCP server, exposes tools to Claude Code, Cursor, etc.
`api/`	FastAPI HTTP surface (alternative to MCP for non-MCP clients)
`engine/`	Orchestrator, scope, auth, findings DB, telemetry, HITL, playbooks
`agents/`	`BaseAgent` orchestrator classes (recon, web, ad, cloud, exploit_chain, ...)
`tools/`	Wrappers for security tools across `binary/`, `cloud/`, `network/`, `osint/`, `password/`, `web/`
`playbooks/`	YAML multi-step engagement playbooks
`tests/`	pytest suite
`benchmarks/`	reproducible solve-rate measurements
`docs/`	user-facing documentation

Conventions

Python ≥ 3.10. Tested on 3.10 – 3.13.
Add tests for new code; mirror module structure in tests/.
New tool wrappers register in tools/registry.py; place wrapper in the right subcategory (binary/, cloud/, network/, osint/, password/, web/).
New agents subclass agents/base.py:BaseAgent.
160-char line length (ruff config).
No secrets in code or tests. .env* is gitignored.

Authorization & safety

This is offensive-security tooling. Never run it against systems you do not own or have written authorization to test. First run prompts for AUP acceptance and persists to ~/.pentest-ai/aup-consent.txt. Set PENTEST_AI_AUP_ACCEPTED=1 only in non-interactive CI you control.

Scope enforcement is non-negotiable: any change that allows scanning outside the declared target list is a security regression. See SECURITY.md.

Definition of done

New tests for new code; existing tests pass: pytest
ruff check . clean
mypy . clean (or new ignores justified in PR description)
No new secrets committed (.gitleaks.toml is enforced)
CHANGELOG.md updated for user-visible changes
If a new tool/agent: registered, documented, and integration-tested

{ "ocm": "1", "id": "zaurqasimov1337-millisec-pentest-ai-pentest-ai", "kind": "skill", "name": "pentest-ai", "description": "For AI coding agents (Claude Code, Cursor, Copilot, Codex CLI, Devin, Windsurf, Gemini CLI, Aider) and human contributors. Briefly: build, test, style, layout. Defer to `README.md` for product info.", "publisher": "zaurqasimov1337", "version": "1.0.0", "capabilities": { "domains": [ "coding" ], "tags": [ "skill-md", "github-agents" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "For AI coding agents (Claude Code, Cursor, Copilot, Codex CLI, Devin, Windsurf, Gemini CLI, Aider) and human contributors. Briefly: build, test, style, layout. Defer to `README.md` for product info." ], "primary": false, "metadata": { "source": { "provider": "github-agents", "repository": "https://github.com/zaurqasimov1337/MilliSec-Pentest-AI", "path": "pentest-ai/AGENTS.md", "ref": "42679ad1a7e37f987629977c96ab0f985491f31e", "url": "https://github.com/zaurqasimov1337/MilliSec-Pentest-AI/blob/42679ad1a7e37f987629977c96ab0f985491f31e/pentest-ai/AGENTS.md", "key": "zaurqasimov1337/MilliSec-Pentest-AI/pentest-ai/AGENTS.md" } }, "instructions": "# Agent guide for pentest-ai\n\nFor AI coding agents (Claude Code, Cursor, Copilot, Codex CLI, Devin, Windsurf, Gemini CLI, Aider) and human contributors. Briefly: build, test, style, layout. Defer to `README.md` for product info.\n\n## Build\n\n```bash\npip install -e .[dev]\n```\n\nOptional surfaces (install only what you'll touch):\n\n```bash\npip install -e .[litellm,api,menu,browser,tracing,stealth,cloud]\n```\n\nBrowser tests need: `playwright install chromium`.\nStealth crawler needs: `scrapling install --force`.\n\n## Test\n\n```bash\npytest # full suite\npytest tests/test_cli.py ", "cost": { "context_tokens": 753 } }

pentest-ai

About

Agent guide for pentest-ai

Build

Test

Lint, types, format

Layout

Conventions

Authorization & safety

Definition of done

Use it

Manifest

Reviews