菜单
Run a quick security scan on a target. Consults the Brain first, validates scope, runs passive recon + vuln scan in parallel.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/H-mmer/pentest-agents --skill quickscan命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Autonomous hunt orchestrator. INSATIABLE in --autonomous mode: enforces an EXHAUSTION CONTRACT (26 canonical hunter classes, surface probe A-I, depth-engine ≥25 attempts/class, wall-clock floor 90 min/target, PRE-COMPLETION GATE before any summary). No early stops, no clarifying questions, no auxiliary-agent substitution. Usage: /autopilot target.com [--interactive|--autonomous] [--20m-off] [--resume]
Autonomous hunt orchestrator. INSATIABLE in --autonomous mode: enforces an EXHAUSTION CONTRACT (26 canonical hunter classes, surface probe A-I, depth-engine ≥25 attempts/class, wall-clock floor 90 min/target, PRE-COMPLETION GATE before any summary). No early stops, no clarifying questions, no auxiliary-agent substitution. Usage: /autopilot target.com [--interactive|--autonomous] [--20m-off] [--resume]
Adversarial validator for DAST findings. Attempts to DISPROVE each finding and DOWNGRADE severity. Catches inflated reports, unverified assumptions, and theoretical-only bugs. Dispatch after /validate PASS and before /report.
正在显示 SKILL.md
基于 SOC 职业分类
| name | quickscan |
| description | Run a quick security scan on a target. Consults the Brain first, validates scope, runs passive recon + vuln scan in parallel. |
| disable-model-invocation | false |
ALL agents dispatched by this command MUST use model: "inherit" in the Agent tool call.
Run a quick security assessment on: $ARGUMENTS
Workflow:
uv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py brief $ARGUMENTS — check what we already know. Note exhausted areas.uv run python3 $CLAUDE_PROJECT_DIR/tools/scope_check.py $ARGUMENTS — if out of scope, STOP.recon agent with passive-only depth, passing brain context about known subdomains/techconfig-auditor agent for headers, CSP, CORS, TLS, cookiesuv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py record <target> <status> <technique> <details>uv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py log "quickscan completed on $ARGUMENTS"Quickscan should answer "is there obvious money or obvious risk here in 30 minutes?"
Never report from quickscan alone unless the proof is already complete. Promote strong leads to /hunt, /validate, or /chain.