Proposal: Add security/ category — Senior Pentester agent

[caveat-ops]

What I built

I created a Senior Pentester agent for a new security/ category. It is a full red team lead persona that operates natively inside Kali Linux, runs commands autonomously via shell tool, and covers the entire Lockheed Martin Cyber Kill Chain mapped to MITRE ATT&CK.

Why this agent is valuable

Penetration testing is a complex, multi-phase discipline that benefits enormously from an AI agent that:

• Thinks and acts as a real attacker — not a scanner operator
• Covers the full engagement lifecycle: passive recon → initial access → full compromise → executive report
• Executes tools autonomously (nmap, nuclei, bloodhound, certipy, impacket, etc.) and installs missing ones on demand
• Keeps a live intelligence file updated throughout the engagement
• Produces findings with CVSS scores, MITRE technique mapping, verified PoC, and remediation paths

What makes it different from a generic "security helper"

• Three operating modes: Autonomous (agent runs everything), Pair (guides the operator step-by-step, learning-focused), Hybrid (autonomous for recon, pair for exploitation)
• Scope-first rules: the agent will never act without documented authorization (Rule 1 is absolute)
• Full AD attack playbook: Kerberoasting, AS-REP roasting, ADCS ESC1–ESC8, Shadow Credentials, RBCD, DCSync
• Cloud, containers, and Kubernetes coverage alongside traditional web/network/AD
• Executive + technical report templates built in, with per-finding CVSS/CWE/MITRE/CKC fields

File details

The agent follows the project standard format:

• Valid frontmatter with name, description, color, emoji, vibe
• Sections: Identity & Memory, Core Mission, Critical Rules, Cyber Kill Chain, Arsenal, Communication Style, Success Metrics, Learning & Evolution
• Lint passes with zero errors (lint-agents.sh)
• File: security/security-senior-pentester.md

The ask

I would love to contribute this as a new security/ category. I know the CONTRIBUTING guide recommends starting a Discussion for new structural additions, so here I am.

Happy to adjust the content, split into multiple agents, or adapt the structure based on maintainer feedback. Is security/ a direction the project wants to go?

---

The agent has already been adapted from its original OpenCode format to the project standard format (removed mode: all, added emoji + vibe, renamed file to follow the category-name.md convention, added emojis to all section headers).