feat: scan-ingest + gates + guard + cloud + dotslash toolkit + pentester-playwright + skill rename

.agents/ROLE.md

@@ -31,7 +31,9 @@ Still run Phase 0 bootstrap (`target_id`, dirs, scope/auth, manifest). RoE Q&A m
 ### Step 6 — Danger operations
 
 Changes on target / destructive exploits / unbounded scans → pause for approval unless user declared **bypass**.  
-MCP destructive tools → confirm first.
+MCP destructive tools → confirm first.  
+Pre-flight offensive commands through the runtime guard (enforces scope / window / banned + writes `activity-log.md`):  
+`node .agents/schema/guard.js ${ID} --cmd "<command>"` — exit 1 means out of scope/window; do not run it.
 
 ## 3. Environment
 
@@ -52,7 +54,7 @@ Follow `.agents/schema/env.md` exclusively:
 ## 5. Knowledge & MCP (pointers only)
 
 - Knowledge: `.agents/knowledge/LOOKUP.md` (tier-1 then tier-2)  
-- Bulk import: `knowledge-import` skill (not during phases)  
+- Bulk import: `pentester-knowledge-import` skill (not during phases)  
 - MCP: only if `.agents/mcp/INDEX.md` has tools  
 
 ## 6. Orchestration (pointers only)

.agents/bin/lookup.js

@@ -270,6 +270,12 @@ function runSelftest() {
     r3.results.some((x) => /sql-injection/i.test(x.path)),
     `expected sql-injection in top paths, got ${r3.results.map((x) => x.path).join(', ')}`
   );
+  // phase 3 + cloud keyword → cloud posture topic (s3 alias-expands to cloud)
+  const rc = lookup('3', ['s3'], 8);
+  assert.ok(
+    rc.results.some((x) => /cloud/i.test(x.path)),
+    `expected cloud topic for s3, got ${rc.results.map((x) => x.path).join(', ')}`
+  );
   // phase 1 + nmap
   const r1 = lookup('1', ['nmap'], 5);
   assert.ok(

.agents/knowledge/LOOKUP.md

@@ -9,9 +9,9 @@ node .agents/bin/lookup.js --check-index
 Executable interface: `.agents/bin/lookup.js`.
 **Hard bags**: `--phase N` only ranks links in the matching `PTES-INDEX.md` `##` section.
 Shared signal aliases (with playbook): `signal-aliases.json`.
-Phase **1b** bag may be empty — use `src-hunter/playbook.js`.  
+Phase **1b** bag may be empty — use `pentester-src-hunter/playbook.js`.  
 This file is the **policy**; the CLI is the **implementation**.  
-Skill `knowledge-base` is a thin **adapter** (when to call / how to write tier-1) — not a second procedure.
+Skill `pentester-knowledge-base` is a thin **adapter** (when to call / how to write tier-1) — not a second procedure.
 
 **Do not** browse `INDEX.md` or `DIRECTORY.md` as the phase knowledge interface.  
 Tier-2 roots live in `TIER2-CATALOG.md` (miss only).
@@ -31,7 +31,7 @@ lookup(phase, keywords) → ordered tier-1 paths
 | `PTES-INDEX.md` | Phase → curated paths only |
 | `recon/` `vuln-analysis/` `exploitation/` `post-exploitation/` `tooling/` `reporting/` `defensive/` | Structured entries |
 | `vuln-analysis/topics/` | Vuln-type topics |
-| `.agents/skills/src-hunter/references/playbooks/` | Web attack playbooks (via phase bag / skill, not PTES-INDEX bulk) |
+| `.agents/skills/pentester-src-hunter/references/playbooks/` | Web attack playbooks (via phase bag / skill, not PTES-INDEX bulk) |
 | Essence files linked from INDEX top | Prefer first |
 
 **Never** put `github-references/`, `refined-corpus/`, `deep-refined-corpus/` in phase knowledge bags or PTES-INDEX.
@@ -50,11 +50,11 @@ lookup(phase, keywords) → ordered tier-1 paths
 2. Open 3–10 returned tier-1 files  
 3. Extract commands/judgment  
 4. Miss → tier-2 search or `web_search`  
-5. New reusable method → `knowledge-base` skill → tier-1 + PTES-INDEX  
+5. New reusable method → `pentester-knowledge-base` skill → tier-1 + PTES-INDEX  
 
 ## Skills
 
 | Skill | Role |
 |-------|------|
-| `knowledge-base` | Runtime: call LOOKUP, write tier-1, index hygiene |
-| `knowledge-import` | Offline GitHub / bulk import only |
+| `pentester-knowledge-base` | Runtime: call LOOKUP, write tier-1, index hygiene |
+| `pentester-knowledge-import` | Offline GitHub / bulk import only |

.agents/knowledge/PTES-INDEX.md

@@ -2,7 +2,7 @@
 
 > 仅列 **策展路径**。归档（`deep-refined-corpus/`、`github-references/`、`refined-corpus/`）**不得**出现在本文件。  
 > miss → `.agents/knowledge/LOOKUP.md` tier-2。  
-> 维护：`knowledge-base` skill 追加时只写 tier-1 类别。
+> 维护：`pentester-knowledge-base` skill 追加时只写 tier-1 类别。
 
 ## Pre-engagement
 
@@ -32,6 +32,7 @@
 - `vuln-analysis/topics/file-inclusion-topic.md` — 包含
 - `vuln-analysis/topics/command-execution-topic.md` — 命令执行
 - `vuln-analysis/mssql-attack.md` — MSSQL
+- `vuln-analysis/cloud/cloud-posture-essence.md` — 云安全 posture (AWS/Azure/GCP/S3/IAM/K8s)
 - `exploitation/cve-poc-verification-essence.md` — CVE/PoC 验证流程
 
 ## Exploitation
@@ -48,6 +49,7 @@
 - `post-exploitation/credential-access/credential-dumping.md` — 凭据
 - `post-exploitation/lateral-movement/lateral-movement-cheatsheet.md` — 横向
 - `post-exploitation/privilege-escalation/windows-privesc-compendium.md` — Windows 提权
+- `post-exploitation/cloud/cloud-privesc-lateral.md` — 云上提权/横向 (IAM/STS/K8s RBAC)
 - `post-exploitation/c2/c2-frameworks.md` — C2
 
 ## Reporting

.agents/knowledge/README.md

@@ -8,7 +8,7 @@
 | `target/${ID}/solutions.md` | 单次 engagement 笔记（可选） |
 | `(removed) .agents/solutions.md` | **已废弃**，禁止 phase 预加载 |
 
-Tier-2 大归档（`github-references/` 等）宜外置；见 `knowledge-import` + `TIER2-CATALOG.md`。
+Tier-2 大归档（`github-references/` 等）宜外置；见 `pentester-knowledge-import` + `TIER2-CATALOG.md`。
 
 ## 目录结构
 
@@ -88,4 +88,4 @@ reporting/sql-injection-remediation.md
 
 ## 使用方式
 
-当需要查询、补充、整理或复用知识时，调用 `/pentester:knowledge-base` skill。
+当需要查询、补充、整理或复用知识时，调用 `pentester-knowledge-base` skill。

.agents/knowledge/README_EN.md

@@ -83,4 +83,4 @@ Use `.agents/knowledge/TEMPLATE.md` as a base when creating new entries.
 
 ## Usage
 
-When you need to query, supplement, organize, or reuse knowledge, invoke the `/pentester:knowledge-base` skill.
+When you need to query, supplement, organize, or reuse knowledge, invoke the `pentester-knowledge-base` skill.

.agents/knowledge/_import-checkpoint.md

@@ -1,9 +1,9 @@
 # Import checkpoint
 
-- updated: 2026-07-23T08:56:18.018Z
+- updated: 2026-07-23T12:36:57.494Z
 - archive_root: /Users/fb0sh/Projects/pentester/.agents/knowledge/github-references
 - external: false
 - stage: status
 - note: Archive is in-repo — prefer KNOWLEDGE_ARCHIVE_ROOT external volume (locality)
 
-Next: follow knowledge-import/SKILL.md stages; never preload archives into phase bags.
+Next: follow pentester-knowledge-import/SKILL.md stages; never preload archives into phase bags.

.agents/knowledge/post-exploitation/cloud/cloud-privesc-lateral.md

@@ -0,0 +1,36 @@
+# 云上提权 / 横向精华 — IAM / STS / Managed Identity / K8s RBAC
+
+> Tier-1 方法论精华。手把手命令见 pentester-src-hunter `playbooks/cloud/`。**横向到其它账号/订阅前先过 Scope（`scope-check.js` / `guard.js`）。**
+
+## 提权原语速查（有其一常能到 admin）
+
+**AWS**
+- `iam:CreateAccessKey`（对高权用户）· `iam:AttachUserPolicy`/`PutUserPolicy`（自附 `AdministratorAccess`）
+- `iam:PassRole` + `lambda:CreateFunction` / `ec2:RunInstances` / `glue`/`cloudformation`（用高权角色执行）
+- `sts:AssumeRole` 到 trust policy 过宽的角色
+
+**Azure**
+- `Owner`/`Contributor` → VM `run-command`、部署模板执行
+- Key Vault 访问策略过宽 → 取密钥/证书横向
+- App client secret / Managed Identity 权限过大 → ARM/Graph
+
+**GCP**
+- `iam.serviceAccountKeys.create` · `iam.serviceAccounts.actAs` + 计算/函数创建
+- `iam.roles.update` / `setIamPolicy`（自赋 `roles/owner`）· `getAccessToken`（模拟高权 SA）
+
+**Kubernetes**
+- `pods/exec` / `create pods`（特权 Pod）· `secrets get`（读全量密钥）
+- 绑定到 `cluster-admin` 的 SA · 可创建 `privileged`/`hostPath:/` Pod → 逃逸到 node
+
+## 横向路径
+
+- 云凭据 → 云 API → 其它服务（数据库、队列、存储）。
+- Managed Identity / SA token → 元数据服务 → 更多资源。
+- K8s SA token → API server → 其它命名空间 / node → 底层云凭据（node role）。
+- 混合云：云凭据 → 读到 AD/域凭据 → 内网横向（转 `../ad-redteam-essence.md`）。
+
+## OPSEC 与合规
+
+- 优先只读枚举；改配置/建资源属危险操作，需用户确认（ROLE danger-ops）。
+- 记录所有临时凭据来源与到期；报告脱敏（不落客户密钥）。
+- 云操作常留 CloudTrail/Activity Log 痕迹——按约定说明测试活动，用本框架 `activity-log.md` 自证范围。

.agents/knowledge/signal-aliases.json

@@ -63,6 +63,17 @@
       "id": "nmap",
       "lookup": ["nmap", "recon", "scan"],
       "playbook": []
-    }
+    },
+    "cloud": {
+      "id": "cloud",
+      "lookup": ["cloud", "aws", "azure", "gcp", "iam", "s3", "k8s", "kubernetes", "metadata"],
+      "playbook": ["cloud"]
+    },
+    "aws": { "id": "cloud", "lookup": ["aws", "s3", "iam", "sts", "cloud"], "playbook": ["cloud"] },
+    "azure": { "id": "cloud", "lookup": ["azure", "entra", "blob", "cloud"], "playbook": ["cloud"] },
+    "gcp": { "id": "cloud", "lookup": ["gcp", "gcs", "cloud"], "playbook": ["cloud"] },
+    "s3": { "id": "cloud", "lookup": ["s3", "bucket", "aws", "cloud"], "playbook": ["cloud"] },
+    "iam": { "id": "cloud", "lookup": ["iam", "cloud", "privilege"], "playbook": ["cloud"] },
+    "k8s": { "id": "cloud", "lookup": ["k8s", "kubernetes", "rbac", "cloud"], "playbook": ["cloud"] }
   }
 }

.agents/knowledge/tooling/knowledge-base-maintenance-standard.md

@@ -197,5 +197,5 @@ PY
 
 - 本次实践：`.agents/knowledge/github-references/` 从 1.9GB 优化至 101MB
 - Git 清理：`git gc --aggressive --prune=now` 将 .git 从 566MB 压缩至 936KB
-- 知识库 skill：`.agents/skills/knowledge-base/SKILL.md`
-- 报告生成 skill：`.agents/skills/gen-report/SKILL.md`
+- 知识库 skill：`.agents/skills/pentester-knowledge-base/SKILL.md`
+- 报告生成 skill：`.agents/skills/pentester-gen-report/SKILL.md`

.agents/knowledge/vuln-analysis/cloud/cloud-posture-essence.md

@@ -0,0 +1,41 @@
+# 云安全 posture 精华 — AWS / Azure / GCP / S3 / IAM / K8s
+
+> Tier-1 方法论精华。手把手 payload 见 pentester-src-hunter `playbooks/cloud/`。元数据 SSRF 见 `playbooks/ssrf-cache-host/11-cloud.md`。
+
+## 识别与分层
+
+1. **厂商识别**：DNS 后缀（`amazonaws.com` / `blob.core.windows.net` / `googleapis.com`）、header、错误页、证书 SAN。
+2. **面分层**：匿名面（公开存储桶、暴露 API、metadata）→ 单凭据面（枚举权限）→ 提权/横向面（IAM/RBAC misconfig）。
+
+## 未授权面（不需要凭据）
+
+- **对象存储公开**：S3 `--no-sign-request` 可列/可读/可写；GCS `allUsers`；Azure Blob `?comp=list` 匿名。可写 = 高危（供应链/篡改）。
+- **公开快照/镜像**：EBS 快照、AMI、GCP 镜像、容器镜像仓库公开。
+- **暴露元数据/管理端点**：IMDSv1、K8s 匿名 kubelet `:10250`、etcd `:2379`、Dashboard skip-login。
+- **密钥泄露**：前端 JS / Git 历史 / CI 变量 / 镜像层里的 access key、SAS、SA json、connection string。
+
+## 单凭据面（拿到任意 key/token 后先做的事）
+
+| 云 | 我是谁 | 枚举权限 |
+|----|--------|----------|
+| AWS | `aws sts get-caller-identity` | `iam get-account-authorization-details` / `enumerate-iam` |
+| Azure | `az account show` | `az role assignment list --all` |
+| GCP | `gcloud auth list` | `gcloud projects get-iam-policy` |
+| K8s | SA token | `kubectl auth can-i --list` |
+
+## 高危配置错误（判定为 Verified Vulnerability 的核心类）
+
+- 过宽 IAM：`*:*`、`iam:PassRole` + 服务角色、可自附管理策略、可建 access key。
+- 元数据可达且角色权限过大（SSRF → 临时凭据 → 云 API）。
+- 存储桶/密钥保管库访问控制缺失。
+- K8s：默认 SA 自动挂载 + 过宽 ClusterRoleBinding；可创建特权 Pod。
+
+## 取证要点（Evidence）
+
+- 记录 `get-caller-identity` 等身份输出、可执行动作证明（只读枚举，不改动配置除非授权）。
+- 公开桶：截图/列举响应 + 一个非敏感对象读取证明；**不下载客户敏感数据**。
+- 提权链：写清 "起始权限 → 使用的原语 → 目标权限" 的可复现步骤。
+
+## 审计/枚举工具（只读优先）
+
+`ScoutSuite` · `prowler` · `pacu`(AWS) · `ROADtools`/`AzureHound`(Azure) · `gcp_scanner`(GCP) · `kube-hunter`/`kubeaudit`(K8s)。

.agents/mcp/INDEX.md

@@ -29,4 +29,4 @@
 
 ## 相关 Skill
 
-- [mcp-manager](../skills/mcp-manager/SKILL.md) — MCP 工具发现与调用 skill，通过 `/mcp` 触发
+- [pentester-mcp-manager](../skills/pentester-mcp-manager/SKILL.md) — MCP 工具发现与调用 skill，通过 `/mcp` 触发

.agents/phases/00-pre-engagement.md

@@ -3,7 +3,7 @@
 | | |
 |--|--|
 | **Manifest** | `manifest-phase-0.md` (`summary_fields` in `schema.json`) |
-| **Skill** | `init-target` |
+| **Skill** | `pentester-init-target` |
 | **Env** | `.agents/schema/env.md` · `env-render.js` · `materialize.js` |
 
 ## Session packet

.agents/phases/01-intelligence.md

@@ -3,7 +3,7 @@
 | | |
 |--|--|
 | **Manifest** | `manifest-phase-1.md` (keys: see `schema.json`) |
-| **Skill** | `enum-services` |
+| **Skill** | `pentester-enum-services` |
 | **Contract** | `.agents/schema/schema.json` · `env.md` |
 
 ## Session packet
@@ -39,6 +39,7 @@ node .agents/schema/scope-check.js ${ID} --host ${SCAN_HOST}   # refuses deny_ho
 - Full TCP + version/OS → `ports/nmap_full_tcp.*`  
 - UDP top 20 → `ports/nmap_udp.*`  
 - Use **env-render** skeletons; parallel OK  
+- Also keep machine-readable output (`nmap -oX`) — Phase 3 `pentester-scan-ingest` reuses it to seed the Triage ledger.
 
 **Forbidden paths**: see `schema.json` `forbidden_paths` (`tcp_full.txt`, `scans/`, …).
 
@@ -52,13 +53,15 @@ node .agents/schema/scope-check.js ${ID} --host ${SCAN_HOST}   # refuses deny_ho
 
 Paths under `path_root` from env-render.
 
+**Accelerators** via `pentester-toolkit` (`.agents/tools/TOOLS.md` — all active, `scope-check.js` first): `subfinder` (passive subdomains) · `naabu` (fast port sweep → hand open ports to nmap) · `httpx -json` (live-web probe → `vulns/scanner_raw/` → `pentester-scan-ingest`) · `EHole` / `dismap` (product fingerprint) · `dddd` (noisy all-in-one — needs `authorization: confirmed`).
+
 ### 4. Passive OSINT (≥3 sources)
 
 → `services/osint-results.md`
 
 ### 5. Fingerprint → dictionary (optional)
 
-OA / CN products → `skills/src-hunter/references/dictionaries/` → `services/product-attack-surface.md`
+OA / CN products → `skills/pentester-src-hunter/references/dictionaries/` → `services/product-attack-surface.md`
 
 ### 6. recon-summary.md
 

.agents/phases/01b-web-pretest.md

@@ -3,7 +3,7 @@
 | | |
 |--|--|
 | **Manifest** | `manifest-phase-1-web.md` |
-| **Skills** | `playwright-skill` + `src-hunter` (playbook only) |
+| **Skills** | `pentester-playwright` + `pentester-src-hunter` (playbook only) |
 | **Evidence** | `.agents/schema/evidence-land.md` |
 
 ## Session packet
@@ -26,15 +26,23 @@ Phase 1 `web_ports` empty → **do not** create 1b manifest; stop.
 # Host Evidence roots ONLY via env-render (Schema artifact_patterns; dual-track)
 eval "$(node .agents/schema/env-render.js --scan-env ${scan_env:-docker} --id ${ID} --host ${SCAN_HOST} --export)"
 mkdir -p "$EVIDENCE_DIR" "$SCREENSHOT_DIR"
-cd .agents/skills/playwright-skill && node run.js /tmp/playwright-web-explore.js
+cd .agents/skills/pentester-playwright && node scripts/poc.js /tmp/playwright-web-explore.js
 ```
 
 Landing rules: `evidence-land.md`. Function map → Schema path under services (function-map).
 
+For a **structured endpoint/route/API catalog** (feeds `pages`/`forms`/`apis`), drive `pentester-playwright` in recon mode:
+
+```bash
+cd .agents/skills/pentester-playwright && node scripts/recon.js --config config/scope.<id>.yaml --url "$URL" --roles admin,user,anon
+```
+
+Web fingerprint accelerators via **`pentester-toolkit`** (`.agents/tools/TOOLS.md`, scope-gate first): `httpx -json` (→ `pentester-scan-ingest`) · `EHole` / `dismap` (product/CMS fingerprint).
+
 ### 2. Pretest (playbooks)
 
 ```bash
-node .agents/skills/src-hunter/playbook.js --signal "unauth,info,idor"
+node .agents/skills/pentester-src-hunter/playbook.js --signal "unauth,info,idor"
 # Read top playbook path; do not invent payloads; do not browse h1-reports/raw
 ```
 

.agents/phases/02-threat-modeling.md

@@ -3,6 +3,7 @@
 | | |
 |--|--|
 | **Manifest** | `manifest-phase-2.md` |
+| **Skill** | `pentester-threat-model` |
 | **Contract** | `schema.json` phase `2` |
 
 ## Session packet
@@ -19,7 +20,16 @@ Do not re-list allowed_reads / forbidden / writes / knowledge_bag here.
 2. Classify assets: network gear / servers / apps / services  
 3. STRIDE per asset class  
 4. Rank attack surface Critical → Low  
-5. Write **Threat model** (`threat-model.md`) with priority table + assumptions  
+5. Write **Threat model** (`threat-model.md`) with a priority table + assumptions.  
+   Each row maps a threat to a **Signal** keyword (from `knowledge/signal-aliases.json`) so Phase 3 can LOOKUP it:
+
+```
+| Surface | Threat (STRIDE) | Signal | Phase-3 test |
+|---------|-----------------|--------|--------------|
+| http    | Reflected XSS on `q` (Tampering) | xss | src-hunter --signal xss |
+```
+
+**Gate**: every `critical_surfaces` and `priority_threats` value in the handoff summary **must appear** in `threat-model.md` (validator fails strict otherwise) — don't declare a surface/threat you didn't model.
 
 ## Heuristics
 

.agents/phases/03-vulnerability-analysis.md

@@ -3,7 +3,7 @@
 | | |
 |--|--|
 | **Manifest** | `manifest-phase-3.md` |
-| **Skills** | `src-hunter` playbooks · `playwright-skill` |
+| **Skills** | `pentester-src-hunter` playbooks · `pentester-playwright` · `pentester-scan-ingest` |
 | **Contract** | `schema.json` artifact_patterns · `evidence-land.md` |
 
 ## Session packet
@@ -21,24 +21,33 @@ Do not re-list allowed_reads / forbidden / writes / knowledge_bag here.
 ```bash
 node .agents/schema/scope-check.js ${ID} --host ${SCAN_HOST}   # scope gate before active scanning
 node .agents/schema/env-render.js --scan-env ${scan_env} --id ${ID} --host ${SCAN_HOST}
-# intent: nikto / nuclei / nmap --script=vuln → vulns/scanner_raw/ under path_root
+# intent: nikto / nuclei -jsonl / nmap -oX / httpx -json / ffuf -o → vulns/scanner_raw/ under path_root
 ```
 
-### 2. Triage every Raw scan result → `vulns/triage.md`
+**Scanners** via `pentester-toolkit` (`.agents/tools/TOOLS.md` — active + noisy, require `authorization: confirmed` + scope-gate): `nuclei -jsonl` (→ `pentester-scan-ingest`) · `afrog -json` · `xray webscan --json-output` · `DefaultHound` (default creds) · `dddd` (poc). Write raw output to `vulns/scanner_raw/`, then ingest.
 
-Record each scanner hit's disposition so coverage is auditable — nothing is dropped silently:
+### 2. Ingest → triage every Raw scan result → `vulns/triage.md`
+
+Normalize the raw output into the ledger (seeds `verifying` rows; never overwrites a human disposition):
+
+```bash
+node .agents/schema/scan-ingest.js ${ID}   # parse vulns/scanner_raw/ → merge rows into vulns/triage.md
+```
+
+Then set each row's disposition so coverage is auditable — nothing is dropped silently:
 
 ```
 | Raw scan result | Source | Disposition | Note |
 | ...             | nuclei | dismissed / verifying / VULN-NNN | reason |
 ```
 
 Disposition ∈ `dismissed(reason)` | `verifying` | `VULN-NNN`. Handoff `triaged_count` = rows recorded.
+Findings scan-ingest can't parse (manual/other tools) are still added by hand.
 
 ### 3. Manual verify Critical/High (Threat model first)
 
 ```bash
-node .agents/skills/src-hunter/playbook.js --signal "<from threat-model keywords>"
+node .agents/skills/pentester-src-hunter/playbook.js --signal "<from threat-model keywords>"
 # Read top playbook path; no memorized payloads
 ```
 
@@ -48,7 +57,7 @@ Web PoC:
 eval "$(node .agents/schema/env-render.js --scan-env ${scan_env:-docker} --id ${ID} --host ${SCAN_HOST} --export)"
 # For a Verified Vulnerability, bind Evidence to it: EVIDENCE_DIR="${EVIDENCE_VULN_DIR/NNN/$vuln_num}" (vuln_num = this VULN's number — not a fixed sample id)
 mkdir -p "$EVIDENCE_DIR"
-cd .agents/skills/playwright-skill && node run.js /tmp/playwright-vuln-proof.js
+cd .agents/skills/pentester-playwright && node scripts/poc.js /tmp/playwright-vuln-proof.js
 ```
 
 **Verified Vulnerability** id `VULN-NNN` → dir + Evidence per `schema.json` `artifact_patterns` only.