name: Caido Web & API Pentest
id: caido-pentest
source: custom
description: >
  Specialized Caido-native pentesting with dedicated web and API attackers
  working through Caido proxy. Security Architect coordinates and reviews.
  Designed for bug bounty and web application security assessments.
topology: hierarchical
communication: hub-and-spoke
when_to_use:
  - "Web application pentest using Caido proxy"
  - "API security testing with Caido"
  - "Bug bounty mission targeting web and API surfaces"
  - "Full-stack web application security assessment"
  - "HackerOne or bug bounty program engagement"
  - "OWASP Top 10 and API Security Top 10 testing"
when_not_to_use:
  - "Infrastructure or network pentesting (use generic pentester)"
  - "Code review or static analysis only"
  - "Compliance audit without active testing"
  - "Caido proxy is not available or configured"
pros:
  - "Caido-native — every step flows through proxy with full request capture"
  - "Specialized roles cover web and API attack surfaces independently"
  - "Findings auto-registered in Caido via create_finding with PoC requestId"
  - "Safety rails built into role prompts — rate limiting, scope enforcement"
cons:
  - "Requires Caido proxy running and caido-mcp-server configured"
  - "Not suitable for network/infra testing"
  - "Higher setup overhead than generic pentester"
estimated_token_cost: medium
estimated_agents: "3"
roles_suggested:
  oracle: security_architect
  workers: [web_pentester, api_pentester]
elo_lead_selection: true
