new

Name: new
Author: H-mmer/pentest-agents

$npx mdskill add H-mmer/pentest-agents/new

Create a new engagement workspace: $ARGUMENTS

SKILL.md

---
name: new
description: "Create a new engagement workspace. Usage: /new <platform> <program> [--type web-app|api|mobile|smart-contract]"
disable-model-invocation: false
---
Create a new engagement workspace: $ARGUMENTS

Parse arguments as: <platform> <program> [--type <template>]
Default template: web-app

Run: `uv run python3 $CLAUDE_PROJECT_DIR/tools/scaffold.py $ARGUMENTS`

After creation, tell the user to: cd into the workspace, start claude, and run /sync.

## Top-Tier Workspace Bar

A new workspace is not ready until it can support evidence-grade hunting.

After scaffold, verify or create:
- `scope.yaml` placeholder with platform, program, in-scope and out-of-scope sections
- `policy.md` placeholder for required headers, rate limits, account rules, and prohibited actions
- `recon/`, `findings/`, `evidence/`, `poc/`, `reports/drafts/`, and `scans/`
- brain initialized or clear instruction to run `/brain init`
- next commands in order: `/sync`, `/pipeline`, `/analyze`, then `/hunt` or `/autopilot`

Warn if the program type needs special setup: mobile test device, API tokens, sandbox tenant, OAuth app, webhook receiver, cloud account, or smart-contract fork.

More from H-mmer/pentest-agents

Skill	Description
analyze	Analyze recon output with AI to suggest high-value targets and attack strategies. Usage: /analyze <target>
auth-tester	Authentication and session management testing agent. Use for login bypass, session fixation, password reset flow abuse, MFA bypass, OAuth flaws, and privilege escalation testing. Provide the application URL and any credentials for testing.
autopilot	Autonomous hunt orchestrator. INSATIABLE in --autonomous mode: enforces an EXHAUSTION CONTRACT (26 canonical hunter classes, surface probe A-I, depth-engine ≥25 attempts/class, wall-clock floor 90 min/target, PRE-COMPLETION GATE before any summary). No early stops, no clarifying questions, no auxiliary-agent substitution. Usage: /autopilot target.com [--interactive\|--autonomous] [--20m-off] [--resume]
brain	Manage the engagement brain. Subcommands: 'init' to set up, 'brief <target>' for pre-flight, 'status' for overview, 'exhausted [target]' to see dead ends.
browser-agent	Browser automation agent for interactive web testing. Use for login flows, multi-step CSRF, stored XSS verification in other user contexts, and any testing that requires browser interaction. Requires Claude in Chrome MCP.
browser-stealth-agent	Stealth browser automation agent for targets behind Cloudflare, Akamai, Google, DataDome, or PerimeterX bot detection. Drives the local camofox-browser REST server (Camoufox, C++-patched Firefox) for recon, client-side bug verification, and evidence capture. Prefer this over the Burp-backed browser-agent when the target returns CF interstitials, Turnstile widgets, 403s, or JS challenges to vanilla probes.
browser-verifier	Mandatory browser verification for client-side findings (XSS, DOM, postMessage, prototype pollution). Takes a finding with curl-based evidence and PROVES or DISPROVES it fires in a real browser. No finding ships without browser verification. Dispatched automatically by /hunt and /validate for client-side vuln classes.
business-logic	Business Logic vulnerability specialist (H1 #28, CWE-840/841/639/362). Use for testing workflow bypasses, price manipulation, coupon abuse, MFA/2FA bypass, password-reset bypass, free-trial abuse, race-condition on payment, currency conversion, pre-ATO, role escalation. Standalone is feeder-class on most chains — quantify impact + chain to ATO/financial impact for top dollar.
chain	Build deep exploit chains — dispatches chain-builder agent. Given bug A, recursively walks the chain graph. Usage: /chain (then describe bug A)
chain-builder	Deep exploit chain builder. Given bug A, recursively walks the chain graph — each confirmed link becomes the new A. No depth limit. Supports 2-link to 10+ link chains. Use when you have any finding that needs escalation.