Agent Skills
› H-mmer/pentest-agents
› brain
brain
GitHub管理安全测试的“大脑”状态，支持初始化、预检、查看概览及死胡同分析。通过执行Python脚本记录目标、技术、状态及证据，确保记忆高质量复用，并自动更新索引以优化后续会话。
触发场景
需要初始化或管理安全测试上下文时
查询测试进度、预检目标或标记已耗尽的测试点时
安装
npx skills add H-mmer/pentest-agents --skill brain -g -y
SKILL.md
Frontmatter
{
"name": "brain",
"description": "Manage the engagement brain. Subcommands: 'init' to set up, 'brief <target>' for pre-flight, 'status' for overview, 'exhausted [target]' to see dead ends."
}
Brain management: $ARGUMENTS
Route to the brain tool:
- If "$ARGUMENTS" is "init": run
uv run python3 ../../tools/brain.py init - If "$ARGUMENTS" starts with "brief": run
uv run python3 ../../tools/brain.py brief <target> - If "$ARGUMENTS" is "status": run
uv run python3 ../../tools/brain.py status - If "$ARGUMENTS" starts with "exhausted": run
uv run python3 ../../tools/brain.py exhausted <target> - If "$ARGUMENTS" starts with "record": run
uv run python3 ../../tools/brain.py record <target> <status> <technique> "<details>"
After running, also launch the brain agent to update the MEMORY.md index if any state changed.
Top-Tier Memory Bar
Bad memory makes the whole suite worse. Record facts as reusable evidence, not diary entries.
For every record, include:
target: canonical host or repo namesurface: endpoint, file, workflow, account role, or componenttechnique: vuln class plus variant, not just "tested auth"status: confirmed, partial, exhausted, blocked, duplicate-risk, chain-pendingevidence: request id, file path, response marker, screenshot path, command output, or blockernext_action: the exact command or test a future session should run
Never store "no bug" without the tested matrix. An exhausted entry must say what was tried and why that evidence is strong enough to skip it later.
版本历史
- 41d49b6 当前 2026-07-24 11:58
