skills.rest
yogiex
yogiexCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

ptes-standard

Guides penetration tests through the seven PTES phases from scoping to reporting.

Updated Jun 5, 2026
Search Tags:#threat modeling#penetration testing#compliance#vulnerability analysis#security assessment#osint#ptes
One-click install
npx skills add https://github.com/yogiex/opencode-cyber-security-skills --skill ptes-standard-yogiex
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ptes-standard
Source: https://github.com/yogiex/opencode-cyber-security-skills/tree/main/skills/ptes-standard
Command: npx skills add https://github.com/yogiex/opencode-cyber-security-skills --skill ptes-standard-yogiex

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Penetration testers and security assessors often lack a consistent, end-to-end methodology for planning and executing engagements, leading to missed phases, weak authorization practices, and poor-quality reports. ## Core Features & Use Cases - Seven-Phase Methodology: Covers pre-engagement, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting with per-phase reference documents. - Modern Infrastructure Adaptations: Provides phase-by-phase adjustments for cloud (AWS/Azure/GCP), Kubernetes, and API/microservices environments. - Compliance Mapping: Maps testing activities to PCI DSS, HIPAA, GDPR, SOC 2/ISO 27001, and FedRAMP requirements, including cloud provider authorization policies. - Use Case: When scoping a web application pentest, load the pre-engagement reference to build the ROE document, then follow the intelligence gathering and vulnerability analysis phases with concrete tool commands like Nmap, Amass, and Nuclei. ## Quick Start Ask the agent to plan a penetration test for a target scope using the PTES methodology and load the relevant phase reference for detailed guidance.

Frequently Asked Questions about ptes-standard

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I structure a penetration test using PTES?▼

PTES divides a penetration test into seven phases: pre-engagement, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, and reporting. Each phase has dedicated reference documentation with objectives, tools, and checklists.

What is the difference between PTES and OWASP WSTG?▼

PTES covers the full engagement lifecycle including scoping, threat modeling, and post-exploitation, while OWASP WSTG provides deep technical test cases for web applications. They are complementary: use PTES for lifecycle management and WSTG for web testing depth.

Does PTES apply to cloud and Kubernetes penetration testing?▼

Yes, the methodology adapts each phase for cloud environments like AWS, Azure, and GCP, plus Kubernetes and API/microservices targets. Cloud testing shifts focus to IAM trust relationships, SSRF to metadata services, and container escape paths.

What legal authorization is needed before penetration testing?▼

A signed Rules of Engagement document defining scope, allowed techniques, and emergency contacts is required before any testing. Testing without written authorization can violate laws like the CFAA, and cloud providers have their own acceptable use policies.

How are penetration testing findings scored and reported?▼

Findings are scored using CVSS v3.1 for technical severity, with DREAD, FAIR, or OWASP Risk Rating as alternatives for business context. Reports include an executive summary, technical findings with reproduction steps, and a risk assessment table.

Related Skills

Explore More Software Engineering Skills→
Kalp1774Kalp1774
18

plan-engagement

Generate a structured pentest engagement plan and initialize plan.md and session.json.

Community
Intermediate
wgpsecwgpsec
1.6k

report-generate

Generate structured penetration testing reports with CVSS risk ratings and remediation guidance.

Official
Intermediate
blamejsblamejs

attack-surface-pentest

Map classical MITRE ATT&CK v19.1 and AI-class MITRE ATLAS TTPs across AI-era attack surfaces.

Official
Advanced
aivos-xieaivos-xie
1

bug-bounty

Enumerate subdomains, probe HTTP services, and scan web applications for vulnerabilities.

Community
Advanced