cost

$npx mdskill add H-mmer/pentest-agents/cost

Analyzes engagement costs and recommends budget moves based on ROI

  • Identifies which agents consumed the most cost during an engagement.
  • Compares actual spend to expected value for each phase of the hunt.
  • Highlights agents with high spending but low output, suggesting potential optimizations.
  • Provides recommendations such as continuing a chain, reducing parallelism, or updating rules based on findings.

SKILL.md

.github/skills/costView on GitHub ↗
---
name: cost
description: "Show cost tracking and ROI for this engagement."
disable-model-invocation: false
---
Show engagement cost data.

Run these in sequence:
1. `uv run python3 $CLAUDE_PROJECT_DIR/tools/cost.py summary`
2. `uv run python3 $CLAUDE_PROJECT_DIR/tools/cost.py roi`
3. Provide analysis: which agents consumed the most, whether the spend is justified by findings.

## Top-Tier ROI Review

Cost review is a hunting control, not accounting trivia.

- Segment spend by phase: recon, ranking, hunting, validation, reporting, rework.
- Flag any agent class with high spend and low durable output: no new surface, no killed hypotheses, no confirmed evidence.
- Compare spend to expected value: bounty range, report probability, duplicate risk, and remaining proof work.
- Recommend one concrete budget move: continue, pivot class, reduce parallelism, raise min-score, skip noisy targets, or run a focused chain pass.
- Treat repeated false positives as a training signal. Link the spend spike to `/learn`, `/brain`, or rules updates.

More from H-mmer/pentest-agents

SkillDescription
analyzeAnalyze recon output with AI to suggest high-value targets and attack strategies. Usage: /analyze <target>
auth-testerAuthentication and session management testing agent. Use for login bypass, session fixation, password reset flow abuse, MFA bypass, OAuth flaws, and privilege escalation testing. Provide the application URL and any credentials for testing.
autopilotAutonomous hunt orchestrator. INSATIABLE in --autonomous mode: enforces an EXHAUSTION CONTRACT (26 canonical hunter classes, surface probe A-I, depth-engine ≥25 attempts/class, wall-clock floor 90 min/target, PRE-COMPLETION GATE before any summary). No early stops, no clarifying questions, no auxiliary-agent substitution. Usage: /autopilot target.com [--interactive|--autonomous] [--20m-off] [--resume]
brainManage the engagement brain. Subcommands: 'init' to set up, 'brief <target>' for pre-flight, 'status' for overview, 'exhausted [target]' to see dead ends.
browser-agentBrowser automation agent for interactive web testing. Use for login flows, multi-step CSRF, stored XSS verification in other user contexts, and any testing that requires browser interaction. Requires Claude in Chrome MCP.
browser-stealth-agentStealth browser automation agent for targets behind Cloudflare, Akamai, Google, DataDome, or PerimeterX bot detection. Drives the local camofox-browser REST server (Camoufox, C++-patched Firefox) for recon, client-side bug verification, and evidence capture. Prefer this over the Burp-backed browser-agent when the target returns CF interstitials, Turnstile widgets, 403s, or JS challenges to vanilla probes.
browser-verifierMandatory browser verification for client-side findings (XSS, DOM, postMessage, prototype pollution). Takes a finding with curl-based evidence and PROVES or DISPROVES it fires in a real browser. No finding ships without browser verification. Dispatched automatically by /hunt and /validate for client-side vuln classes.
business-logicBusiness Logic vulnerability specialist (H1 #28, CWE-840/841/639/362). Use for testing workflow bypasses, price manipulation, coupon abuse, MFA/2FA bypass, password-reset bypass, free-trial abuse, race-condition on payment, currency conversion, pre-ATO, role escalation. Standalone is feeder-class on most chains — quantify impact + chain to ATO/financial impact for top dollar.
chainBuild deep exploit chains — dispatches chain-builder agent. Given bug A, recursively walks the chain graph. Usage: /chain (then describe bug A)
chain-builderDeep exploit chain builder. Given bug A, recursively walks the chain graph — each confirmed link becomes the new A. No depth limit. Supports 2-link to 10+ link chains. Use when you have any finding that needs escalation.