Penetration Testing Setup

Deploy 4 agents that perform recon, scan vulnerabilities, validate exploits, and generate reports.

Roles

Setup Procedure

Step 1: Ask the user which role this agent should play and what prefix to use.

Step 2: Install the skills for the chosen role:

# For recon:
clawhub install pilot-discover pilot-stream-data pilot-archive
# For scanner:
clawhub install pilot-task-parallel pilot-metrics pilot-dataset
# For exploiter:
clawhub install pilot-task-chain pilot-audit-log pilot-receipt
# For reporter:
clawhub install pilot-webhook-bridge pilot-share pilot-slack-bridge

Step 3: Set the hostname:

pilotctl --json set-hostname \x3Cprefix>-\x3Crole>

Step 4: Write the setup manifest:

mkdir -p ~/.pilot/setups
cat > ~/.pilot/setups/penetration-testing.json \x3C\x3C 'MANIFEST'
\x3CINSERT ROLE MANIFEST FROM BELOW>
MANIFEST

Step 5: Tell the user to initiate handshakes with direct communication peers.

Manifest Templates Per Role

recon

{
  "setup": "penetration-testing", "setup_name": "Penetration Testing",
  "role": "recon", "role_name": "Reconnaissance Agent",
  "hostname": "\x3Cprefix>-recon",
  "description": "Performs passive and active reconnaissance — DNS enumeration, port scanning, service fingerprinting.",
  "skills": {
    "pilot-discover": "Enumerate DNS records, subdomains, and service endpoints.",
    "pilot-stream-data": "Stream port scan results and fingerprints in real time.",
    "pilot-archive": "Archive recon snapshots for baseline comparison."
  },
  "peers": [{"role": "scanner", "hostname": "\x3Cprefix>-scanner", "description": "Receives recon results for vulnerability scanning"}],
  "data_flows": [{"direction": "send", "peer": "\x3Cprefix>-scanner", "port": 1002, "topic": "recon-result", "description": "Recon results with target profile and services"}],
  "handshakes_needed": ["\x3Cprefix>-scanner"]
}

scanner

{
  "setup": "penetration-testing", "setup_name": "Penetration Testing",
  "role": "scanner", "role_name": "Vulnerability Scanner",
  "hostname": "\x3Cprefix>-scanner",
  "description": "Runs automated vulnerability scans, checks CVE databases, identifies misconfigurations.",
  "skills": {
    "pilot-task-parallel": "Run multiple scan tools in parallel across target services.",
    "pilot-metrics": "Track scan coverage, finding counts, and severity distribution.",
    "pilot-dataset": "Store CVE matches and vulnerability metadata."
  },
  "peers": [{"role": "recon", "hostname": "\x3Cprefix>-recon", "description": "Sends recon results"}, {"role": "exploiter", "hostname": "\x3Cprefix>-exploiter", "description": "Receives vulnerability findings"}],
  "data_flows": [
    {"direction": "receive", "peer": "\x3Cprefix>-recon", "port": 1002, "topic": "recon-result", "description": "Recon results with target profile and services"},
    {"direction": "send", "peer": "\x3Cprefix>-exploiter", "port": 1002, "topic": "vulnerability", "description": "Vulnerability findings with CVE and severity"}
  ],
  "handshakes_needed": ["\x3Cprefix>-recon", "\x3Cprefix>-exploiter"]
}

exploiter

{
  "setup": "penetration-testing", "setup_name": "Penetration Testing",
  "role": "exploiter", "role_name": "Exploit Validator",
  "hostname": "\x3Cprefix>-exploiter",
  "description": "Validates discovered vulnerabilities with safe proof-of-concept tests, confirms exploitability.",
  "skills": {
    "pilot-task-chain": "Chain validation steps: verify, exploit, document evidence.",
    "pilot-audit-log": "Log all validation attempts with timestamps and results.",
    "pilot-receipt": "Confirm receipt of vulnerability findings from scanner."
  },
  "peers": [{"role": "scanner", "hostname": "\x3Cprefix>-scanner", "description": "Sends vulnerability findings"}, {"role": "reporter", "hostname": "\x3Cprefix>-reporter", "description": "Receives validated findings"}],
  "data_flows": [
    {"direction": "receive", "peer": "\x3Cprefix>-scanner", "port": 1002, "topic": "vulnerability", "description": "Vulnerability findings with CVE and severity"},
    {"direction": "send", "peer": "\x3Cprefix>-reporter", "port": 1002, "topic": "validated-finding", "description": "Validated findings with proof-of-concept evidence"}
  ],
  "handshakes_needed": ["\x3Cprefix>-scanner", "\x3Cprefix>-reporter"]
}

reporter

{
  "setup": "penetration-testing", "setup_name": "Penetration Testing",
  "role": "reporter", "role_name": "Pentest Reporter",
  "hostname": "\x3Cprefix>-reporter",
  "description": "Generates pentest reports with findings, risk ratings, remediation steps, and executive summary.",
  "skills": {
    "pilot-webhook-bridge": "Deliver reports to client portals and ticketing systems.",
    "pilot-share": "Share report drafts with stakeholders for review.",
    "pilot-slack-bridge": "Notify security team of completed assessments."
  },
  "peers": [{"role": "exploiter", "hostname": "\x3Cprefix>-exploiter", "description": "Sends validated findings with evidence"}],
  "data_flows": [
    {"direction": "receive", "peer": "\x3Cprefix>-exploiter", "port": 1002, "topic": "validated-finding", "description": "Validated findings with proof-of-concept evidence"},
    {"direction": "send", "peer": "external", "port": 443, "topic": "pentest-report", "description": "Pentest report via webhook and Slack"}
  ],
  "handshakes_needed": ["\x3Cprefix>-exploiter"]
}

Data Flows

• recon -> scanner : recon-result events (port 1002)
• scanner -> exploiter : vulnerability events (port 1002)
• exploiter -> reporter : validated-finding events (port 1002)
• reporter -> external : pentest-report via webhook (port 443)

Handshakes

# recon \x3C-> scanner:
pilotctl --json handshake \x3Cprefix>-scanner "setup: penetration-testing"
pilotctl --json handshake \x3Cprefix>-recon "setup: penetration-testing"
# scanner \x3C-> exploiter:
pilotctl --json handshake \x3Cprefix>-exploiter "setup: penetration-testing"
pilotctl --json handshake \x3Cprefix>-scanner "setup: penetration-testing"
# exploiter \x3C-> reporter:
pilotctl --json handshake \x3Cprefix>-reporter "setup: penetration-testing"
pilotctl --json handshake \x3Cprefix>-exploiter "setup: penetration-testing"

Workflow Example

# On scanner — subscribe to recon results:
pilotctl --json subscribe \x3Cprefix>-recon recon-result
# On exploiter — subscribe to vulnerabilities:
pilotctl --json subscribe \x3Cprefix>-scanner vulnerability
# On reporter — subscribe to validated findings:
pilotctl --json subscribe \x3Cprefix>-exploiter validated-finding
# On recon — publish a recon result:
pilotctl --json publish \x3Cprefix>-scanner recon-result '{"target":"app.example.com","open_ports":[22,80,443,8080]}'
# On exploiter — publish a validated finding:
pilotctl --json publish \x3Cprefix>-reporter validated-finding '{"cve":"CVE-2023-46589","validated":true,"impact":"RCE"}'

Dependencies

Requires pilot-protocol skill, pilotctl binary, clawhub binary, and a running daemon.