brain
$
npx mdskill add H-mmer/pentest-agents/brainBrain management: $ARGUMENTS
SKILL.md
.github/skills/brainView on GitHub ↗
--- name: brain description: "Manage the engagement brain. Subcommands: 'init' to set up, 'brief <target>' for pre-flight, 'status' for overview, 'exhausted [target]' to see dead ends." disable-model-invocation: false --- Brain management: $ARGUMENTS Route to the brain tool: - If "$ARGUMENTS" is "init": run `uv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py init` - If "$ARGUMENTS" starts with "brief": run `uv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py brief <target>` - If "$ARGUMENTS" is "status": run `uv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py status` - If "$ARGUMENTS" starts with "exhausted": run `uv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py exhausted <target>` - If "$ARGUMENTS" starts with "record": run `uv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py record <target> <status> <technique> "<details>"` After running, also launch the `brain` agent to update the MEMORY.md index if any state changed. ## Top-Tier Memory Bar Bad memory makes the whole suite worse. Record facts as reusable evidence, not diary entries. For every record, include: - `target`: canonical host or repo name - `surface`: endpoint, file, workflow, account role, or component - `technique`: vuln class plus variant, not just "tested auth" - `status`: confirmed, partial, exhausted, blocked, duplicate-risk, chain-pending - `evidence`: request id, file path, response marker, screenshot path, command output, or blocker - `next_action`: the exact command or test a future session should run Never store "no bug" without the tested matrix. An exhausted entry must say what was tried and why that evidence is strong enough to skip it later.
More from H-mmer/pentest-agents
- analyzeAnalyze recon output with AI to suggest high-value targets and attack strategies. Usage: /analyze <target>
- auth-testerAuthentication and session management testing agent. Use for login bypass, session fixation, password reset flow abuse, MFA bypass, OAuth flaws, and privilege escalation testing. Provide the application URL and any credentials for testing.
- autopilotAutonomous hunt orchestrator. INSATIABLE in --autonomous mode: enforces an EXHAUSTION CONTRACT (26 canonical hunter classes, surface probe A-I, depth-engine ≥25 attempts/class, wall-clock floor 90 min/target, PRE-COMPLETION GATE before any summary). No early stops, no clarifying questions, no auxiliary-agent substitution. Usage: /autopilot target.com [--interactive|--autonomous] [--20m-off] [--resume]
- browser-agentBrowser automation agent for interactive web testing. Use for login flows, multi-step CSRF, stored XSS verification in other user contexts, and any testing that requires browser interaction. Requires Claude in Chrome MCP.
- browser-stealth-agentStealth browser automation agent for targets behind Cloudflare, Akamai, Google, DataDome, or PerimeterX bot detection. Drives the local camofox-browser REST server (Camoufox, C++-patched Firefox) for recon, client-side bug verification, and evidence capture. Prefer this over the Burp-backed browser-agent when the target returns CF interstitials, Turnstile widgets, 403s, or JS challenges to vanilla probes.
- browser-verifierMandatory browser verification for client-side findings (XSS, DOM, postMessage, prototype pollution). Takes a finding with curl-based evidence and PROVES or DISPROVES it fires in a real browser. No finding ships without browser verification. Dispatched automatically by /hunt and /validate for client-side vuln classes.
- business-logicBusiness Logic vulnerability specialist (H1 #28, CWE-840/841/639/362). Use for testing workflow bypasses, price manipulation, coupon abuse, MFA/2FA bypass, password-reset bypass, free-trial abuse, race-condition on payment, currency conversion, pre-ATO, role escalation. Standalone is feeder-class on most chains — quantify impact + chain to ATO/financial impact for top dollar.
- chainBuild deep exploit chains — dispatches chain-builder agent. Given bug A, recursively walks the chain graph. Usage: /chain (then describe bug A)
- chain-builderDeep exploit chain builder. Given bug A, recursively walks the chain graph — each confirmed link becomes the new A. No depth limit. Supports 2-link to 10+ link chains. Use when you have any finding that needs escalation.
- cloud-reconCloud misconfiguration scanner. Use for S3 bucket enumeration, Azure blob discovery, GCP storage checks, exposed cloud services, and cloud metadata analysis. Provide target domain or known cloud identifiers.