/autopilot

name: autopilot
description: "Autonomous hunt orchestrator. INSATIABLE in --autonomous mode: enforces an EXHAUSTION CONTRACT (26 canonical hunter classes, surface probe A-I, depth-engine ≥25 attempts/class, wall-clock floor 90 min/target, PRE-COMPLETION GATE before any summary). No early stops, no clarifying questions, no auxiliary-agent substitution. Usage: /autopilot target.com [--interactive|--autonomous] [--20m-off] [--resume]"
disable-model-invocation: false

Autonomous hunt on: $ARGUMENTS

Parse flags from arguments:

• `--interactive` (default): Pause after each validated finding for user review
• `--autonomous`: Fully autonomous — no pauses, never auto-submits, produces ready-to-submit reports
• `--20m-off`: Disable 20-minute rotation timer on hunters
• `--resume`: Continue from previous session (read brain state for progress)

ALL agents dispatched by this command MUST use `model: "inherit"` in the Agent tool call.

SETUP

1. Read `rules/hunting.md` AND `rules/mistakes.md` — both active throughout. `mistakes.md` lists lessons from real engagements ("Top 10 Most Common Mistakes" first); inject the Top 10 block into every subagent preamble because agents repeat these without the reminder. 2. Read `scope.yaml` — verify all targets are in scope 3. Read `policy.md` — extract ALL actionable constraints into a policy preamble:

• Required HTTP headers (X-Bug-Bounty, User-Agent, custom tracking headers)
• Account creation rules (email domain, naming conventions, company format)
• Test environment setup (own instances, test properties, sandboxes)
• Prohibited actions (DoS, social engineering, accessing customer data)
• Rate limiting expectations
• N-day waiting periods, shared responsibility exclusions
• Credential usage restrictions
• ANY other program-specific requirements

4. Format the **policy preamble** — this block is injected into EVERY agent dispatch:

   POLICY CONSTRAINTS (VIOLATION = DISQUALIFICATION/BAN):
   SCOPE AND POLICY MUST BE OBEYED AT ALL TIMES.
   [dynamically extracted constraints from policy.md]
   ALL HTTP requests MUST include required headers.
   ALL accounts MUST follow naming conventions.
   ALL testing MUST stay within scope boundaries.

5. `uv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py brief <target>` — load existing knowledge 6. If `--resume`: read brain for tested/exhausted/remaining targets, skip to HUNT LOOP 7. Capture run metadata for the pre-completion gate and stash it in `.autopilot-run.env`:

   {
     echo "RUN_START_EPOCH=$(date +%s)"
     echo "AUTOPILOT_MODE=<interactive|autonomous>"
     echo "AUTOPILOT_TARGET=<original /autopilot target argument>"
   } > .autopilot-run.env

EXHAUSTION CONTRACT (autonomous mode is INSATIABLE — read before every loop iteration)

**`/autopilot --autonomous` IS INSATIABLE. The loop continues UNTIL every target in scope has been tested with ALL techniques, ALL methods, ALL bypasses, ALL tricks, AND ALL COMBINATIONS of these. DO NOT STOP. DO NOT ASK THE USER ANYTHING.** No clarifying questions, no "should I continue?", no "I think we're done" — autonomous mode runs until the PRE-COMPLETION GATE passes for every target, the chain queue is empty, and the global progress queue is empty. A 17-minute autonomous run that produced one auxiliary-agent dispatch is a contract violation, not a completed engagement. If you catch yourself thinking "this looks done", you are wrong — return to the queue and dispatch the next class/combination.

`--autonomous` overrides any default LLM tendency toward minimalism, clarification-seeking, or "I have enough information" reasoning. The only acceptable termination paths are listed under "Stopping early is allowed ONLY when" below; nothing else.

Canonical Hunter Class Set (per target — every class fires OR records `not-applicable` with technical reason)

Per target, every class below either dispatches its specialized hunter agent OR records a brain entry `not-applicable: <reason>` containing concrete technical justification observed during the surface probe. "No JS source-sink hits in the bundle" is NOT justification — that is static analysis, not testing. Brain entries claiming exhaustion via auxiliary agents will be rejected by the gate.

| Class | Hunter agent | Skip only if (must cite surface-probe evidence) | |-------|--------------|--------------------------------------------------| | idor | `idor-hunter` | No authenticated endpoints AND no object IDs in any URL/body | | xss-reflected | `xss-hunter` (subtype: reflected) | No reflected query/header/path values across method-matrix probes | | xss-stored | `xss-hunter` (subtype: stored) | No write surface (no comments, profiles, uploads, names, support form) | | xss-dom | `xss-hunter` (subtype: dom) | Browser-runtime probe shows no `location.*`/`document.*`/innerHTML sinks fed by URL/hash | | ssrf | `ssrf-hunter` | No URL/webhook/import/preview/fetch/avatar/screenshot parameters anywhere | | sqli | `sqli-hunter` | No DB-backed endpoints (every API call is a static cache hit) | | ssti | `ssti-hunter` | No template-rendering surface (comments, previews, admin templates, rules engines) | | rce | `rce-hunter` | No deserialization, command-runner, expression-eval, or rule-engine surface | | oauth | `oauth-hunter` | No OAuth/OIDC/SAML/JWT flow anywhere on target or its cookie-domain siblings | | open-redirect | `open-redirect` | No redirect/returnTo/next/callback parameters anywhere in path/query | | csrf | `csrf-hunter` | No state-changing endpoints AND every cookie has SameSite=Strict | | cors | `cors-hunter` | Surface probe shows no Access-Control-* headers and no `OPTIONS` handlers | | info-disclosure | `info-disclosure` | Surface probe found nothing AND no error/debug/build endpoints | | race-condition | `race-condition` | No state mutations / billing / coupon / approval / non-idempotent ops | | business-logic | `business-logic` | No multi-step workflows / pricing