Menu
Analyze recon output with AI to suggest high-value targets and attack strategies. Usage: /analyze <target>
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/H-mmer/pentest-agents --skill analyzeThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Showing SKILL.md
Autonomous hunt orchestrator. INSATIABLE in --autonomous mode: enforces an EXHAUSTION CONTRACT (26 canonical hunter classes, surface probe A-I, depth-engine ≥25 attempts/class, wall-clock floor 90 min/target, PRE-COMPLETION GATE before any summary). No early stops, no clarifying questions, no auxiliary-agent substitution. Usage: /autopilot target.com [--interactive|--autonomous] [--20m-off] [--resume]
Autonomous hunt orchestrator. INSATIABLE in --autonomous mode: enforces an EXHAUSTION CONTRACT (26 canonical hunter classes, surface probe A-I, depth-engine ≥25 attempts/class, wall-clock floor 90 min/target, PRE-COMPLETION GATE before any summary). No early stops, no clarifying questions, no auxiliary-agent substitution. Usage: /autopilot target.com [--interactive|--autonomous] [--20m-off] [--resume]
Adversarial validator for DAST findings. Attempts to DISPROVE each finding and DOWNGRADE severity. Catches inflated reports, unverified assumptions, and theoretical-only bugs. Dispatch after /validate PASS and before /report.
Based on SOC occupation classification
| name | analyze |
| description | Analyze recon output with AI to suggest high-value targets and attack strategies. Usage: /analyze <target> |
AI-powered analysis of recon data for: $ARGUMENTS
ls recon/ and read key filesuv run python3 ../../tools/brain.py brief $ARGUMENTSuv run python3 ../../tools/intel_engine.py suggest <detected-stack>uv run python3 ../../tools/intel_engine.py analyzeWhat's the most valuable thing an attacker could access on this target?
Given the tech stack and recon output, rank the top 5 attack paths by:
What has NOT been tested? What endpoints have no brain data? Cross-reference recon output against brain tested endpoints. Flag untested high-value endpoints.
ANALYSIS: target.com
═════════════════════
Crown Jewels: [what's most valuable]
Top 5 Attack Paths:
1. [endpoint] × [vuln class] — likelihood: HIGH, impact: CRITICAL
2. ...
Blind Spots (untested P1 surface):
- /api/v2/payments/* — NO DATA in brain
- /api/v2/admin/* — NO DATA in brain
Recommendation: /hunt target.com --vuln-class [best bet]
Treat /analyze as a thesis generator, not a summary command. The output must make the next hour of hunting obvious.
asset_value: revenue, PII, admin, secrets, infrastructure, tenant boundaryexploit_likelihood: stack age, exposed methods, auth complexity, parser surface, prior bug class fitnovelty: low hacktivity overlap, new endpoint, changed JS, unusual integration, weak vendor patternproof_path: exact request needed to prove impact, required accounts, required evidence artifactpolicy_friction: rate limits, forbidden data access, third-party scope, credential validation rules/api/admin/* looks valuable but all routes are 403 with no differential, say that and explain what would change the ranking.P1 now, P2 if time, and Kill for this session. Top-tier analysis saves time by deleting tempting dead ends./hunt target --vuln-class idor plus the endpoint pair, account pair, and field to compare.