@DanKornas: Security testing agents often lack security-specific workflows, reliable evidence collection, and auditability. Pentest…

Security testing agents often lack security-specific workflows, reliable evidence collection, and auditability. PentesterFlow is an open-source terminal assistant for authorized offensive-security work that keeps the analyst in control. It plans against a scoped target, uses pentesting tools, requests approval for sensitive actions, retains useful lessons across sessions, and writes evidence-backed findings. Key features: • Built-in skills cover recon, web vulnerabilities, SSRF, SSTI, JWT, GraphQL, race conditions, takeover, Supabase, and deserialization. • Confirmed findings are saved as Markdown with evidence, impact, proof of concept, and remediation. • Session continuity includes saved history, persistent compacted memory, target state, resume recaps, context snapshots, and automatic five-minute snapshots. • The local continuous learning system stores successful workflows, failed assumptions, coverage gaps, and evidence requirements while redacting secrets before storage. • Burp integration can send selected requests into the CLI, queue them as scan tasks, import confirmed findings back into Burp, and preserve raw requests for replay. PentesterFlow is licensed under Apache-2.0. Link in the reply