菜单
HackTheBox platform automation - login via Playwright, browse challenges/machines/labs, manage VPN connections, solve challenges using pentest skills, log all proceedings, and feed learnings back into skill improvement.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Systematic IDOR / BOLA hunting methodology. Use when testing any endpoint that accepts an ID, UUID, slug, filename, or reference to a user-owned object.
SQL injection hunting methodology across error-based, union, blind boolean, and time-based variants. Use when testing any input that might reach a database.
SSRF hunting methodology with OOB detection via interactsh, cloud metadata targets, and blind SSRF techniques. Use on any feature that accepts a URL, hostname, or external reference.
XSS hunting methodology — reflected, stored, and DOM — with context-aware payloads. Use when testing any input that could reach a browser.
OWASP Top 10 (2021) and API Top 10 (2023) quick reference with attack patterns, test ideas, and CWE mappings. Load when hunting, code-reviewing for security, or writing bug bounty reports.
Bug bounty report generation — structure, triager-friendly writing, CVSS scoring, and chain reporting. Use when finalizing a finding for submission.
| name | hackthebox |
| description | HackTheBox platform automation - login via Playwright, browse challenges/machines/labs, manage VPN connections, solve challenges using pentest skills, log all proceedings, and feed learnings back into skill improvement. |
Execute this workflow directly — do NOT spawn a subagent. Playwright MCP tools (browser navigation, clicking, screenshots) are only available in the current session, not in subagents.
Read the agent definition and follow it step by step:
Read .claude/agents/hackthebox.md
Then execute the workflow from that file directly in this session — Phase 0 through Phase 6. You have access to all required tools: Playwright MCP (browser), Bash (including .claude/tools/env-reader.py and .claude/tools/slack-send.py), Agent (for spawning orchestrator), AskUserQuestion, Read, Write.
Key points:
python3 .claude/tools/slack-send.py for Slack notifications — no agent spawn neededpython3 .claude/tools/env-reader.py for credentials — no agent spawn neededPentester Orchestrator as subagent via Agent tool/hackthebox command — pass it through