القائمة
Generate a text-based attack surface mindmap. Shows tech stack → vuln class → endpoint relationships. Usage: /mindmap <target>
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
استنادا إلى تصنيف SOC المهني
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/H-mmer/pentest-agents --skill mindmapيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
عرض SKILL.md
Autonomous hunt orchestrator. INSATIABLE in --autonomous mode: enforces an EXHAUSTION CONTRACT (26 canonical hunter classes, surface probe A-I, depth-engine ≥25 attempts/class, wall-clock floor 90 min/target, PRE-COMPLETION GATE before any summary). No early stops, no clarifying questions, no auxiliary-agent substitution. Usage: /autopilot target.com [--interactive|--autonomous] [--20m-off] [--resume]
Autonomous hunt orchestrator. INSATIABLE in --autonomous mode: enforces an EXHAUSTION CONTRACT (26 canonical hunter classes, surface probe A-I, depth-engine ≥25 attempts/class, wall-clock floor 90 min/target, PRE-COMPLETION GATE before any summary). No early stops, no clarifying questions, no auxiliary-agent substitution. Usage: /autopilot target.com [--interactive|--autonomous] [--20m-off] [--resume]
Adversarial validator for DAST findings. Attempts to DISPROVE each finding and DOWNGRADE severity. Catches inflated reports, unverified assumptions, and theoretical-only bugs. Dispatch after /validate PASS and before /report.
| name | mindmap |
| description | Generate a text-based attack surface mindmap. Shows tech stack → vuln class → endpoint relationships. Usage: /mindmap <target> |
Generate attack surface mindmap for: $ARGUMENTS
uv run python3 ../../tools/brain.py brief $ARGUMENTSuv run python3 ../../tools/intel_engine.py suggest <tech-stack>target.com
├── Tech Stack
│ ├── Next.js 14 → SSRF (Server Actions), Open Redirect
│ ├── GraphQL → Introspection, IDOR via node(), Mutation Auth
│ └── PostgreSQL → SQL Injection
├── Auth
│ ├── Okta SSO → SAML bypass, OAuth redirect_uri
│ └── JWT → Secret brute-force, Algorithm confusion
├── API Surface
│ ├── /api/v2/users/{id}/* → IDOR (P1)
│ │ ├── /orders — TESTED: exhausted
│ │ ├── /export — UNTESTED
│ │ └── /settings — UNTESTED
│ ├── /api/v2/payments/* → Race conditions, price manipulation (P1)
│ └── /graphql → Auth bypass on mutations (P1)
├── File Handling
│ └── /upload → Extension bypass, SVG XSS (P2)
└── Findings
├── [CONFIRMED] IDOR on /api/v2/users/{id}/orders
└── [EXHAUSTED] XSS on /search — CloudFront blocks all payloads
The mindmap should expose attack decisions at a glance.
P1, P2, Kill, Confirmed, Partial, Exhausted, Chain.