status

$npx mdskill add H-mmer/pentest-agents/status

Display engagement status dashboard and recommend next actions

  • Identify missing scope information for program synchronization.
  • Initiate brain initialization if no current brain state is available.
  • Suggest quick scan or full scan to find findings without reports.
  • Recommend reporting findings that have not been submitted yet.

SKILL.md

.github/skills/statusView on GitHub ↗
---
name: status
description: "Show engagement dashboard with program info, scope, brain state, findings, agent activity, and cost estimate."
disable-model-invocation: false
---
Show the engagement status dashboard.

Run `uv run python3 $CLAUDE_PROJECT_DIR/tools/statusline.py` to display the full dashboard.

After displaying, offer relevant next actions based on the state:
- If no scope: suggest `/sync`
- If no brain: suggest `/brain init`
- If no findings: suggest `/quickscan` or `/fullscan`
- If findings but no reports: suggest `/report`
- If exhausted vectors are high: suggest focusing on untested areas

## Top-Tier Dashboard Bar

Status should drive the next decision.

Always surface:
- highest-value untested target
- strongest confirmed finding not yet reported
- chain-pending feeders
- stale recon or scope data
- blockers requiring user action
- cost burn versus validated output
- evidence gaps before submission

End with exactly three recommended next actions ordered by expected value. Avoid generic "continue hunting" unless the target and vuln class are named.

More from H-mmer/pentest-agents

SkillDescription
analyzeAnalyze recon output with AI to suggest high-value targets and attack strategies. Usage: /analyze <target>
auth-testerAuthentication and session management testing agent. Use for login bypass, session fixation, password reset flow abuse, MFA bypass, OAuth flaws, and privilege escalation testing. Provide the application URL and any credentials for testing.
autopilotAutonomous hunt orchestrator. INSATIABLE in --autonomous mode: enforces an EXHAUSTION CONTRACT (26 canonical hunter classes, surface probe A-I, depth-engine ≥25 attempts/class, wall-clock floor 90 min/target, PRE-COMPLETION GATE before any summary). No early stops, no clarifying questions, no auxiliary-agent substitution. Usage: /autopilot target.com [--interactive|--autonomous] [--20m-off] [--resume]
brainCentral knowledge coordinator. Use BEFORE launching any other pentest agent to get context on what's already been tried. Also use AFTER any agent completes to record findings, exhausted vectors, and learned patterns. The brain prevents redundant work across sessions and agents.
browser-agentBrowser automation agent for interactive web testing. Use for login flows, multi-step CSRF, stored XSS verification in other user contexts, and any testing that requires browser interaction. Requires Claude in Chrome MCP.
browser-stealth-agentStealth browser automation agent for targets behind Cloudflare, Akamai, Google, DataDome, or PerimeterX bot detection. Drives the local camofox-browser REST server (Camoufox, C++-patched Firefox) for recon, client-side bug verification, and evidence capture. Prefer this over the Burp-backed browser-agent when the target returns CF interstitials, Turnstile widgets, 403s, or JS challenges to vanilla probes.
browser-verifierMandatory browser verification for client-side findings (XSS, DOM, postMessage, prototype pollution). Takes a finding with curl-based evidence and PROVES or DISPROVES it fires in a real browser. No finding ships without browser verification. Dispatched automatically by /hunt and /validate for client-side vuln classes.
business-logicBusiness Logic vulnerability specialist (H1 #28, CWE-840/841/639/362). Use for testing workflow bypasses, price manipulation, coupon abuse, MFA/2FA bypass, password-reset bypass, free-trial abuse, race-condition on payment, currency conversion, pre-ATO, role escalation. Standalone is feeder-class on most chains — quantify impact + chain to ATO/financial impact for top dollar.
chainBuild deep exploit chains — dispatches chain-builder agent. Given bug A, recursively walks the chain graph. Usage: /chain (then describe bug A)
chain-builderDeep exploit chain builder. Given bug A, recursively walks the chain graph — each confirmed link becomes the new A. No depth limit. Supports 2-link to 10+ link chains. Use when you have any finding that needs escalation.