resume

$npx mdskill add H-mmer/pentest-agents/resume

Resume previous hunt on target.com and display findings

  • Read brain for confirmed findings and exhaustively tested techniques.
  • Identify untested endpoints and suggest next steps based on patterns.
  • Generate a chain plan with potential vulnerabilities to dispatch for further investigation.
  • Display the current state of what has been tested versus what remains to be explored.

SKILL.md

.github/skills/resumeView on GitHub ↗
---
name: resume
description: "Resume a previous hunt. Shows hunt history, untested endpoints, memory-informed suggestions. Usage: /resume target.com"
disable-model-invocation: false
---
Resume hunt on: $ARGUMENTS

## What This Does
1. Read brain for target: `uv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py brief $ARGUMENTS`
2. Read brain exhausted: `uv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py exhausted $ARGUMENTS`
3. **Read chain-pending advisory**: `cat .claude/agent-memory-local/chain-pending.md 2>/dev/null` — feeder findings from prior session waiting for chain dispatch. SURFACE THESE FIRST — they have proven dollar value if chained, vs untested surface which is speculative.
4. **Generate / refresh chain plan**: `uv run python3 $CLAUDE_PROJECT_DIR/tools/chain_plan.py $ARGUMENTS` — writes `evidence/<target>/CHAIN_PLAN.md` with 3-5 candidate next-links per pending feeder finding plus the agent to dispatch for each. Read this BEFORE picking the next vuln class — proven feeders trump speculative untested surface.
5. Read recon data from recon/ directory
6. Show what's been tested vs what remains
7. Suggest next techniques based on brain patterns

## Output
```
RESUME: target.com
═══════════════════

Brain Status:
  Confirmed findings: N
  Exhausted techniques: N
  Effective techniques: N

Untested Surface:
  1. /api/v2/users/{id}/export — not tested
  2. /api/v2/users/{id}/share — not tested
  ...

Suggestions:
  - Tech stack [X] matches pattern where IDOR was found before
  - Sibling endpoints of confirmed finding not yet tested

Actions:
  [h] /hunt target.com — resume hunting
  [s] /surface target.com — re-rank attack surface
  [r] /recon target.com — re-run recon (surface may have changed)
  [m] /monitor check — check for target changes since last session
```

## Top-Tier Resume Logic

Resume by value, not chronology.

Priority order:
1. `chain-pending` confirmed feeders with clear next link
2. validated partials needing one proof artifact
3. changed assets from `/monitor`
4. untested P1 crown-jewel endpoints
5. high-confidence class hypotheses from prior wins
6. stale recon refresh

Show what not to redo. If an area is exhausted, include the exact blocker and matrix coverage. A resumed hunt should start with a single best command, not a menu of every possible command.

More from H-mmer/pentest-agents

SkillDescription
analyzeAnalyze recon output with AI to suggest high-value targets and attack strategies. Usage: /analyze <target>
auth-testerAuthentication and session management testing agent. Use for login bypass, session fixation, password reset flow abuse, MFA bypass, OAuth flaws, and privilege escalation testing. Provide the application URL and any credentials for testing.
autopilotAutonomous hunt orchestrator. INSATIABLE in --autonomous mode: enforces an EXHAUSTION CONTRACT (26 canonical hunter classes, surface probe A-I, depth-engine ≥25 attempts/class, wall-clock floor 90 min/target, PRE-COMPLETION GATE before any summary). No early stops, no clarifying questions, no auxiliary-agent substitution. Usage: /autopilot target.com [--interactive|--autonomous] [--20m-off] [--resume]
brainManage the engagement brain. Subcommands: 'init' to set up, 'brief <target>' for pre-flight, 'status' for overview, 'exhausted [target]' to see dead ends.
browser-agentBrowser automation agent for interactive web testing. Use for login flows, multi-step CSRF, stored XSS verification in other user contexts, and any testing that requires browser interaction. Requires Claude in Chrome MCP.
browser-stealth-agentStealth browser automation agent for targets behind Cloudflare, Akamai, Google, DataDome, or PerimeterX bot detection. Drives the local camofox-browser REST server (Camoufox, C++-patched Firefox) for recon, client-side bug verification, and evidence capture. Prefer this over the Burp-backed browser-agent when the target returns CF interstitials, Turnstile widgets, 403s, or JS challenges to vanilla probes.
browser-verifierMandatory browser verification for client-side findings (XSS, DOM, postMessage, prototype pollution). Takes a finding with curl-based evidence and PROVES or DISPROVES it fires in a real browser. No finding ships without browser verification. Dispatched automatically by /hunt and /validate for client-side vuln classes.
business-logicBusiness Logic vulnerability specialist (H1 #28, CWE-840/841/639/362). Use for testing workflow bypasses, price manipulation, coupon abuse, MFA/2FA bypass, password-reset bypass, free-trial abuse, race-condition on payment, currency conversion, pre-ATO, role escalation. Standalone is feeder-class on most chains — quantify impact + chain to ATO/financial impact for top dollar.
chainBuild deep exploit chains — dispatches chain-builder agent. Given bug A, recursively walks the chain graph. Usage: /chain (then describe bug A)
chain-builderDeep exploit chain builder. Given bug A, recursively walks the chain graph — each confirmed link becomes the new A. No depth limit. Supports 2-link to 10+ link chains. Use when you have any finding that needs escalation.