analyze
Analyze recon output with AI to suggest high-value targets and attack strategies. Usage: /analyze <target>
Show engagement dashboard with program info, scope, brain state, findings, agent activity, and cost estimate.
Claude Code
$ npx -y skills add H-mmer/pentest-agents --skill status --agent claude-code
Codex
$ npx skills add H-mmer/pentest-agents --skill status -a codex -y
Cursor
$ npx skills add H-mmer/pentest-agents --skill status -a cursor -y
Gemini CLI
$ npx skills add H-mmer/pentest-agents --skill status -a gemini-cli -y
GitHub Copilot
$ npx skills add H-mmer/pentest-agents --skill status -a github-copilot -y
OpenCode
$ npx skills add H-mmer/pentest-agents --skill status -a opencode -y
Windsurf
$ npx skills add H-mmer/pentest-agents --skill status -a windsurf -y
name: status description: "Show engagement dashboard with program info, scope, brain state, findings, agent activity, and cost estimate." disable-model-invocation: false
Show the engagement status dashboard.
Run `uv run python3 $CLAUDE_PROJECT_DIR/tools/statusline.py` to display the full dashboard.
After displaying, offer relevant next actions based on the state:
Status should drive the next decision.
Always surface:
End with exactly three recommended next actions ordered by expected value. Avoid generic "continue hunting" unless the target and vuln class are named.
Bug bounty agent framework for Claude Code, Codex, Gemini, Cursor, Windsurf, Copilot, and OpenClaw — 48 agents, 26 commands, 19 CLI tools, 2 MCP servers, autonomous hunt loops, exploit chain builder.
Analyze recon output with AI to suggest high-value targets and attack strategies. Usage: /analyze <target>
Autonomous hunt orchestrator. INSATIABLE in --autonomous mode: enforces an EXHAUSTION CONTRACT (26 canonical hunter classes,…
Manage the engagement brain. Subcommands: 'init' to set up, 'brief <target>' for pre-flight, 'status' for overview, 'exhausted…
Build deep exploit chains — dispatches chain-builder agent. Given bug A, recursively walks the chain graph. Usage: /chain (then…
Run the finding correlation engine to discover attack chains from individual findings.
Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication,…
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys)…
Clean and finalize authorized natural-language text intended for readers by auditing suspicious invisible Unicode and rewriting…