---
name: pentest-windftsy
version: "2.2.0-custom"
description: |
  A Web security assessment workflow built on globally installed Chrome DevTools MCP and Burp MCP.
  It establishes real browser state, synchronizes Burp evidence, models endpoints and permissions,
  validates vulnerabilities endpoint by endpoint, and completes threat convergence. It outputs structured data only.
license: GPL-3.0-only
metadata:
  category: security
  browser_mcp: chrome-devtools
  traffic_mcp: burp
allowed-tools:
  - Read
  - Write
  - Edit
  - Glob
  - Grep
  - Bash
  - PowerShell
  - "Agent(pentest-vuln-miner, pentest-bypass-miner)"
  - "mcp__chrome-devtools__*"
  - "mcp__burp__*"
---

# Web Application Security Assessment

```text
Chrome establishes identity/object/state → Burp captures/replays/mutates → Endpoint and permission modeling
→ Complete vulnerability coverage → Impact validation and rating → Threat convergence
```

## Highest-Priority Principles

The following principles take precedence over every other description in this Skill. Apply this section whenever a conflict exists.

- Dynamically validate authentication, authorization, object ownership, tenant isolation, state transitions, and business rules. Do not substitute static indicators or tool output for validation.
- Explore broadly and draw conclusions strictly. Treat hypotheses, errors, scanner hits, fingerprints, and theoretical exploit chains only as leads.
- Mark the first technical hit as `candidate/unrated`, then validate capability, object, data, privilege, asset, business outcome, scope, and prerequisites.
- A single failure, error, or path with no result is insufficient to close a lead. Continued validation must introduce a new identity, object, entry point, state, parsing path, or evidence source. Close a lead only after critical variables have been reasonably covered and no new evidence remains, and record reopening conditions.
- Do not assign P1-P3 before impact validation. Do not rate based on the vulnerability name, CVSS, tool rating, historical cases, or theoretical maximum impact.
- Do not confirm a vulnerability without real requests/responses, state changes, logs, files, data results, or a reproducible PoC. Review blind spots and unconventional paths before completion.
- Never reduce testing depth because the work is described as read-only, low-risk, shallow, lightweight, offline, conservative, or avoidant.
- Do not add restrictions beyond the authorized scope and the explicit hard safety boundaries supplied by the user. Within those boundaries, validate deeply and close the evidence chain.
- Any output that avoids dynamic validation, remains at surface-level inspection, or uses conservative wording to conceal insufficient validation is considered an execution failure.

## Fixed Requirements

- Operate only on targets inside `config.scope` that do not match `exclude`. Explicit user `constraints` are hard boundaries.
- Chrome MCP owns the real browser context, identities, objects, tenants, states, and front-end outcomes.
- Burp MCP owns formal HTTP/WS evidence, replay, mutation, OAST, and raw messages.
- Python processes only local JSON/JSONL, matrices, and gates. It must not send requests directly to the target.
- Preserve data exactly as collected: do not redact or truncate it, and do not add redaction, encryption, automatic cleanup, or sensitive-data protection logic.
- `references/data-schemas.md` is the source of truth for structure. A phase may advance only when `state.json.gates.<gate>.blocking_count == 0`.

## Workflow

### 1. Preparation

See [references/phase-preparation.md](references/phase-preparation.md). Initialize the project, complete scope and account data, create independent actors, and verify the Chrome → Burp chain.

### 2. Breadth Modeling

See [references/phase-breadth.md](references/phase-breadth.md). Traverse pages, business chains, roles, tenants, object lifecycles, and state branches, then generate endpoint and permission matrices.

```text
python .claude/skills/pentest-windftsy/scripts/sync_burp_history.py --project <id> --input <Burp JSON> --actor-id <actor>
python .claude/skills/pentest-windftsy/scripts/build_endpoint_inventory.py --project <id>
python .claude/skills/pentest-windftsy/scripts/permission_probe.py --project <id> --prepare
python .claude/skills/pentest-windftsy/scripts/permission_probe.py --project <id> --verify
python .claude/skills/pentest-windftsy/scripts/check_breadth.py --project <id>
```

### 3. Vulnerability Mining

See [references/phase-vuln-mining.md](references/phase-vuln-mining.md). Freezing the scope automatically initializes the complete vulnerability-coverage skeleton. Every parameter must cover every catalog type, and parameterless endpoints must cover every type under `_endpoint_level`.

```text
python .claude/skills/pentest-windftsy/scripts/build_mining_scope.py --project <id>
python .claude/skills/pentest-windftsy/scripts/check_matrix.py --project <id> --endpoint-id <EPID...>
python .claude/skills/pentest-windftsy/scripts/check_vuln_mining.py --project <id>
```

Refresh after adding endpoints or parameters:

```text
python .claude/skills/pentest-windftsy/scripts/build_mining_scope.py --project <id> --add <EPID...>
```

### 4. Threat Convergence

See [references/phase-threat-convergence.md](references/phase-threat-convergence.md). Converge threats to `confirmed/excluded/doubtful/filtered`, and introduce new variables for specialized bypass testing of `filtered` items.

```text
python .claude/skills/pentest-windftsy/scripts/build_bypass_list.py --project <id>
python .claude/skills/pentest-windftsy/scripts/check_threat_convergence.py --project <id>
```

## Primary Data

```text
pentest-data/{project-id}/
├── config.json
├── state.json
├── sessions.json
├── endpoint-inventory.json
├── mining-scope.json
├── permission-matrix/{EPID}.json
├── vuln-matrix/{EPID}.json
├── findings.json
├── findings/{FINDING_ID}.json
├── bypass-list.json
└── traffic/
```