H-mmer/pentest-agents - 第 4 页

new

Create a new engagement workspace. Usage: /new <platform> <program> [--type web-app|api|mobile|smart-contract]

原文语言：英语

pipeline

Prepare the battlefield — recon, scanning, and surface ranking. Stops before hunting. Run /hunt or /autopilot after. Usage: /pipeline or /pipeline <target>

原文语言：英语

quality

Score a report draft before submission. Usage: /quality <draft-path-or-finding-description>

原文语言：英语

quickscan

Run a quick security scan on a target. Consults the Brain first, validates scope, runs passive recon + vuln scan in parallel.

原文语言：英语

remember

Log a finding or pattern to persistent brain memory. Auto-fills from session context. Usage: /remember

原文语言：英语

resume

Resume a previous hunt. Shows hunt history, untested endpoints, memory-informed suggestions. Usage: /resume target.com

原文语言：英语

sast

Source code vulnerability hunting (SAST). Decomposes analysis into specialized passes: map entry points, map dangerous ops, trace flows, find gaps, adversarial validation, exploit. Usage: /sast <repo_path> [--lang c|cpp|rust|java|python|go|php] [--min-score…

原文语言：英语

status

Show engagement dashboard with program info, scope, brain state, findings, agent activity, and cost estimate.

原文语言：英语

surface

Show ranked attack surface for a target. Invokes recon-ranker agent. Usage: /surface target.com

原文语言：英语

sync

Sync program scope, policy, and hacktivity from a bug bounty platform. Usage: /sync hackerone tesla or /sync bugcrowd uber

原文语言：英语

triage

Batch-validate ALL findings through the 7-Question Gate. Kills weak findings in bulk. Usage: /triage

原文语言：英语

validate

Validate a finding through the 7-Question Gate + 4 gates. Kills weak findings FAST. Usage: /validate <finding description>

原文语言：英语

analyze

Analyze recon output with AI to suggest high-value targets and attack strategies. Usage: /analyze <target>

原文语言：英语

brain

Manage the engagement brain. Subcommands: 'init' to set up, 'brief <target>' for pre-flight, 'status' for overview, 'exhausted [target]' to see dead ends.

原文语言：英语

chain

Build deep exploit chains — dispatches chain-builder agent. Given bug A, recursively walks the chain graph. Usage: /chain (then describe bug A)

原文语言：英语

correlate

Run the finding correlation engine to discover attack chains from individual findings.

原文语言：英语

cost

Show cost tracking and ROI for this engagement.

原文语言：英语

dupcheck

Check if a vulnerability has already been reported. Searches platform hacktivity + local findings. Usage: /dupcheck <vuln_type> e.g. /dupcheck XSS in search endpoint

原文语言：英语

fullscan

Full security assessment with brain coordination. Multi-phase, skips known-exhausted areas, builds on prior knowledge.

原文语言：英语

learn

Record a platform response and update learning. Usage: /learn <report_id> <status> [--bounty 500] [--vuln-type XSS]

原文语言：英语

mindmap

Generate a text-based attack surface mindmap. Shows tech stack → vuln class → endpoint relationships. Usage: /mindmap <target>

原文语言：英语

monitor

Monitor targets for changes. Usage: /monitor baseline (first run), /monitor check (detect changes), /monitor scope (check platform for scope updates)

原文语言：英语

new

Create a new engagement workspace. Usage: /new <platform> <program> [--type web-app|api|mobile|smart-contract]

原文语言：英语

pipeline

Prepare the battlefield — recon, scanning, and surface ranking. Stops before hunting. Run /hunt or /autopilot after. Usage: /pipeline or /pipeline <target>

原文语言：英语

quality

Score a report draft before submission. Usage: /quality <draft-path-or-finding-description>

原文语言：英语

quickscan

Run a quick security scan on a target. Consults the Brain first, validates scope, runs passive recon + vuln scan in parallel.

原文语言：英语

remember

Log a finding or pattern to persistent brain memory. Auto-fills from session context. Usage: /remember

原文语言：英语

resume

Resume a previous hunt. Shows hunt history, untested endpoints, memory-informed suggestions. Usage: /resume target.com

原文语言：英语

sast

Source code vulnerability hunting (SAST). Decomposes analysis into specialized passes: map entry points, map dangerous ops, trace flows, find gaps, adversarial validation, exploit. Usage: /sast <repo_path> [--lang c|cpp|rust|java|python|go|php] [--min-score…

原文语言：英语

status

Show engagement dashboard with program info, scope, brain state, findings, agent activity, and cost estimate.

原文语言：英语

surface

Show ranked attack surface for a target. Invokes recon-ranker agent. Usage: /surface target.com

原文语言：英语

sync

Sync program scope, policy, and hacktivity from a bug bounty platform. Usage: /sync hackerone tesla or /sync bugcrowd uber

原文语言：英语

triage

Batch-validate ALL findings through the 7-Question Gate. Kills weak findings in bulk. Usage: /triage

原文语言：英语

validate

Validate a finding through the 7-Question Gate + 4 gates. Kills weak findings FAST. Usage: /validate <finding description>

原文语言：英语

hunt-business-logic

Hunting skill for business-logic vulnerabilities (CWE-840 Business Logic Errors, CWE-841 Improper Enforcement of Behavioral Workflow, CWE-639 Authorization Bypass via User-Controlled Key in business contexts, CWE-362 race conditions on financial flows). Built…

原文语言：英语

hunt-idor

Hunting skill for Insecure Direct Object Reference / Broken Object Level Authorization (BOLA — OWASP API1:2023). Built from 1,117 public IDOR bug bounty reports across HackerOne, Bugcrowd, Intigriti, GitHub Security Advisories, Huntr, plus 2024-2026 meta…

原文语言：英语

hunt-llm-ai

Hunting skill for LLM and Agentic AI vulnerabilities — direct + indirect prompt injection, ASCII smuggling data exfil, agentic tool-use abuse, system prompt leakage, vector DB cross-tenant, model server RCE, insecure output handling. Built from public bug…

原文语言：英语

hunt-oauth

Hunting skill for OAuth 2.0 / 2.1, OpenID Connect (OIDC), SAML SSO, and JWT authentication. Built from 365 public OAuth/SSO bug bounty reports across HackerOne, GitHub Security Advisories, PortSwigger Research, GitHub Security Lab, Detectify, Doyensec, Salt…

原文语言：英语

hunt-rce

Hunting skill for remote code execution. Built from 1,218 public RCE bug bounty reports across HackerOne, Project Zero, Intigriti, GitHub Security Advisories, and curated awesome-* lists, plus 2024-2026 meta verified against NVD — React Server Components…

原文语言：英语

hunt-xss

Hunting skill for Cross-Site Scripting (XSS) — DOM-based, stored, reflected, mutation-based (mXSS), and modern variants. Built from public bug bounty reports across HackerOne, Intigriti, Bugcrowd, Huntr, and GitHub Security Advisories, plus 2024-2026 meta…

原文语言：英语