メニュー
HackTheBox platform automation - login via Playwright, browse challenges/machines/labs, manage VPN connections, solve challenges using pentest skills, log all proceedings, and feed learnings back into skill improvement.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Systematic IDOR / BOLA hunting methodology. Use when testing any endpoint that accepts an ID, UUID, slug, filename, or reference to a user-owned object.
SQL injection hunting methodology across error-based, union, blind boolean, and time-based variants. Use when testing any input that might reach a database.
SSRF hunting methodology with OOB detection via interactsh, cloud metadata targets, and blind SSRF techniques. Use on any feature that accepts a URL, hostname, or external reference.
XSS hunting methodology — reflected, stored, and DOM — with context-aware payloads. Use when testing any input that could reach a browser.
OWASP Top 10 (2021) and API Top 10 (2023) quick reference with attack patterns, test ideas, and CWE mappings. Load when hunting, code-reviewing for security, or writing bug bounty reports.
Bug bounty report generation — structure, triager-friendly writing, CVSS scoring, and chain reporting. Use when finalizing a finding for submission.
| name | hackthebox |
| description | HackTheBox platform automation - login via Playwright, browse challenges/machines/labs, manage VPN connections, solve challenges using pentest skills, log all proceedings, and feed learnings back into skill improvement. |
Execute this workflow directly — do NOT spawn a subagent. Playwright MCP tools (browser navigation, clicking, screenshots) are only available in the current session, not in subagents.
Read the agent definition and follow it step by step:
Read .claude/agents/hackthebox.md
Then execute the workflow from that file directly in this session — Phase 0 through Phase 6. You have access to all required tools: Playwright MCP (browser), Bash (including .claude/tools/env-reader.py and .claude/tools/slack-send.py), Agent (for spawning orchestrator), AskUserQuestion, Read, Write.
Key points:
python3 .claude/tools/slack-send.py for Slack notifications — no agent spawn neededpython3 .claude/tools/env-reader.py for credentials — no agent spawn neededPentester Orchestrator as subagent via Agent tool/hackthebox command — pass it through