pipeline

Agent Skills › H-mmer/pentest-agents › pipeline

pipeline

GitHub

执行侦察、扫描和表面排名，为渗透测试准备战场。该技能仅负责前期情报收集与资产分级，不执行实际漏洞利用或报告。完成后输出P1/P2及Kill List，供后续/hunt或/autopilot使用。

.claude/skills/pipeline/SKILL.md H-mmer/pentest-agents

Trigger Scenarios

用户请求进行目标侦察或环境准备用户输入 /pipeline 命令在狩猎前需要获取资产优先级列表

Install

npx skills add H-mmer/pentest-agents --skill pipeline -g -y

More Options

Non-standard path

npx skills add https://github.com/H-mmer/pentest-agents/tree/main/.claude/skills/pipeline -g -y

Use without installing

npx skills use H-mmer/pentest-agents@pipeline

指定 Agent (Claude Code)

npx skills add H-mmer/pentest-agents --skill pipeline -a claude-code -g -y

安装 repo 全部 skill

npx skills add H-mmer/pentest-agents --all -g -y

预览 repo 内 skill

npx skills add H-mmer/pentest-agents --list

SKILL.md

Frontmatter

{
    "name": "pipeline",
    "description": "Prepare the battlefield — recon, scanning, and surface ranking. Stops before hunting. Run \/hunt or \/autopilot after. Usage: \/pipeline or \/pipeline <target>",
    "disable-model-invocation": false
}

Prepare the battlefield for: $ARGUMENTS

This command runs recon, scanning, and surface ranking — everything needed BEFORE hunting. It does NOT hunt, validate, or report. Use /hunt or /autopilot for that.

Phase 0: SETUP

Read scope.yaml — resolve and verify targets
- If $ARGUMENTS is empty: uv run python3 $CLAUDE_PROJECT_DIR/tools/scope_check.py --list
- If $ARGUMENTS is a domain: uv run python3 $CLAUDE_PROJECT_DIR/tools/scope_check.py $ARGUMENTS
Read policy.md — extract policy preamble for all agent dispatches
Brain init or brief:
- If no brain exists: uv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py init
- If brain exists: uv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py brief <target>

Phase 1: RECON

Dispatch recon agent (model: inherit) with policy preamble and scope
After recon: dispatch config-auditor agent (model: inherit) for header/TLS/cookie review
After config: dispatch js-analyzer agent (model: inherit) for JavaScript analysis
Brain update: uv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py record <target> recon "<results summary>"

Phase 2: SCANNING (parallel, max 3)

Dispatch in parallel (all model: inherit, all with policy preamble):
- vuln-scanner agent with nuclei on discovered hosts
- waf-profiler agent on primary targets
Brain update with scan results

Phase 3: RANK

Dispatch recon-ranker agent (model: inherit) with recon data + brain knowledge
Output P1/P2/Kill list

Complete

Battlefield ready.

P1 targets: [list]
P2 targets: [list]
Kill list:  [list]

Next steps:
  /hunt <target>     — manual hunting on a specific target
  /autopilot         — autonomous hunting across all P1 targets
  /surface           — re-rank surface with current brain knowledge

Sync brain: uv run python3 $CLAUDE_PROJECT_DIR/tools/global_brain.py sync-from-local

Top-Tier Pipeline Standard

The pipeline prepares a battlefield, not a folder of scan files.

Scope first: every generated target must be in-scope or tagged out-of-scope with reason.
Normalize assets into stable inventories: hosts, endpoints, JS files, APIs, auth flows, cloud buckets, repos, mobile packages, and third-party integrations.
Rank during collection. Do not wait until the end to identify crown jewels.
Preserve raw evidence and parsed summaries. A hunter should be able to replay the exact source of every target.
End with P1, P2, and Kill lists plus the best first vuln class for each P1. If no P1 exists, say why and recommend monitoring or a different program.