/quality
Score a report draft before submission. Usage: /quality <draft-path-or-finding-description>
$ npx -y skills add H-mmer/pentest-agents --skill quality --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
- Fires itselfAuto-invocation. Claude auto-loads it when your prompt matches the work.Auto-invocation is when the right skill fires by itself at the right moment, driven by a FLOW.md router and a hook, instead of you invoking it by name. It is the difference between a skill being installed and a skill actually getting used.Read the full definition →
- You can call itInvoke it directly when you want it.
- Slash command
/quality
Context preview
The summary Claude sees to decide when to auto-load this skill.
Score a report draft before submission. Usage: /quality <draft-path-or-finding-description>
SKILL.md
quality.SKILL.mdname: quality description: "Score a report draft before submission. Usage: /quality <draft-path-or-finding-description>" disable-model-invocation: false
Quality-check a report draft: $ARGUMENTS
1. If a file path is given, read the draft file. 2. Launch `quality-check` agent with the draft content. 3. Show the score and any issues to fix. 4. If score < 7, recommend specific improvements. 5. If score >= 7, confirm the report is ready for submission.
Top-Tier Quality Bar
Block reports that are merely plausible.
Score against:
- reproducibility: exact steps, accounts, URLs, headers, and stable artifacts
- impact proof: real capability demonstrated without prohibited access
- severity fit: CVSS/vector matches the proven final state, not the hoped-for chain
- novelty: dupcheck considered and prior art handled
- evidence hygiene: screenshots, recordings, PoC paths, and request/response pairs exist on disk
- triage empathy: title, summary, and remediation let the program act fast
If any artifact is missing, say exactly what command or capture step fixes it. Do not let a fluent report compensate for weak proof.
Bug bounty agent framework for Claude Code, Codex, Gemini, Cursor, Windsurf, Copilot, and OpenClaw — 48 agents, 26 commands, 19 CLI tools, 2 MCP servers, autonomous hunt loops, exploit chain builder.
Repo: H-mmer/pentest-agents
Other skills on pentest-agents.
- /analyze
Analyze recon output with AI to suggest high-value targets and attack strategies. Usage: /analyze <target>
Open skill - /autopilot
Autonomous hunt orchestrator. INSATIABLE in --autonomous mode: enforces an EXHAUSTION CONTRACT (26 canonical hunter classes, surface probe A-I, depth-engine ≥25 attempts/class, wall-clock floor 90 min/target, PRE-COMPLETION GATE before any summary). No early stops, no clarifying
Open skill - /brain
Manage the engagement brain. Subcommands: 'init' to set up, 'brief <target>' for pre-flight, 'status' for overview, 'exhausted [target]' to see dead ends.
Open skill - /chain
Build deep exploit chains — dispatches chain-builder agent. Given bug A, recursively walks the chain graph. Usage: /chain (then describe bug A)
Open skill - /correlate
Run the finding correlation engine to discover attack chains from individual findings.
Open skill - /cost
Show cost tracking and ROI for this engagement.
Open skill