H-mmer
H-mmer/pentest-agents
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/H-mmer/pentest-agents --skill triage命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Autonomous hunt orchestrator. INSATIABLE in --autonomous mode: enforces an EXHAUSTION CONTRACT (26 canonical hunter classes, surface probe A-I, depth-engine ≥25 attempts/class, wall-clock floor 90 min/target, PRE-COMPLETION GATE before any summary). No early stops, no clarifying questions, no auxiliary-agent substitution. Usage: /autopilot target.com [--interactive|--autonomous] [--20m-off] [--resume]
Autonomous hunt orchestrator. INSATIABLE in --autonomous mode: enforces an EXHAUSTION CONTRACT (26 canonical hunter classes, surface probe A-I, depth-engine ≥25 attempts/class, wall-clock floor 90 min/target, PRE-COMPLETION GATE before any summary). No early stops, no clarifying questions, no auxiliary-agent substitution. Usage: /autopilot target.com [--interactive|--autonomous] [--20m-off] [--resume]
Adversarial validator for DAST findings. Attempts to DISPROVE each finding and DOWNGRADE severity. Catches inflated reports, unverified assumptions, and theoretical-only bugs. Dispatch after /validate PASS and before /report.
基于 SOC 职业分类
正在显示 SKILL.md
| name | triage |
| description | Batch-validate ALL findings through the 7-Question Gate. Kills weak findings in bulk. Usage: /triage |
Batch triage all findings.
ALL validator agents dispatched by this command MUST use .
validator agent with the finding detailsTRIAGE RESULTS
═══════════════
# Finding Decision Reason
1 GraphQL schema leakage KILL Q7 Never-submit: introspection alone
2 Config exposure SayTech KILL Q7 SPA client config is by design
3 Internal service URLs KILL Q6 Not exploitable externally
4 IDOR on /api/users/{id} PASS Confirmed with real data
5 XSS on comments PASS Cookie theft PoC works
PASSED: 2 findings → ready for /report
KILLED: 3 findings → removed from queue
uv run python3 ../../tools/brain.py record <target> exhausted "<finding>" "<kill reason>"/report or /validate for full PoC + evidenceBatch triage should reduce the queue aggressively.
For each finding, produce:
Do not average weak findings into a stronger story. Chain them only when one finding provides a capability the next finding consumes.