Agent skill · security · jeremylongshore
confirming-pentest-authorization
Verify that a penetration test has explicit, written, signed authorization before any scanning begins. Reads a Rules-of- Engagement (ROE) attestation file, validates required fields (authorizer, in-scope targets, time window, emergency contact, signature), checks the signer against an allowlist, and emits a CRITICAL finding if anything is missing. Designed as the first skill the orchestrator routes to. Use when: starting a new engagement, after a scope change, or before any cluster 1-4 scan skill runs. Threshold: any missing or unsigned ROE field; any time-window expiry; any in-scope target outside the authorized list. Trigger with: "confirm authorization", "verify ROE", "check pentest authz", "pre-flight authorization".
Why this skill is useful
Adds a validation script for ROE attestation that ensures compliance with legal requirements before any penetration testing begins.
What it needs
Requires python3 installed locally. About 5k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Confirming Pentest Authorization Overview Penetration testing is computer access. Without explicit authorization from the owner of the system under test, that access is a crime — Computer Fraud and Abuse Act in the US, Computer Misuse Act in the UK, equivalent laws everywhere else. The line between an authorized pentester and an unauthorized attacker is one signature on one document. The penetration-tester pack's other skills (TLS analysis, CORS audit, dependency CVE scan, etc.) all assume that line has been crossed correctly. This skill is the first gate the orchestrator routes to. It refuses to declare an engagement authorized until a Rules of Engagement (ROE) attestation file exists, is signed, and contains the fields any real-world legal review will look for. This is not paranoia or paperwork theater. Engagements DO go sideways: scope creeps mid-test, a tester probes an out-of-scope adjacent system, an SOC team escalates a "real" attack to legal, and the question "show us the ROE" comes up. If the ROE is in order, the answer is "here it is." If not, the conversation gets expensive fast. When the skill produces findings Finding Severity Threshold Affected control --- --- --- --- ROE file missing CRITICAL No attestation file at the expected path (legal) Required field missing CRITICAL authorizer, inscopetargets, timewindow, emergencycontact, or signature absent (legal) Signature missing CRITICAL No signatureblock in ROE (legal) Signer not in allowlist CRITICAL signer email/key id not in .allowed-authorizers (legal) Time window expired HIGH current time outside timewindow.start / timewindow.end (legal) Time window not yet active HIGH current time before timewindow.start (legal) In-scope target list empty HIGH inscopetargets field present but empty (legal) Out-of-scope override (manual flag) MEDIUM tester requests a target not in the in-scope list (legal) Stale ROE (>30 days from sign date) MEDIUM lastsignedat older than 30 days; suggests refresh (operational) ROE p …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/confirming-pentest-authorization--a0cd3b