Bug bounty agent framework for Claude Code, Codex, Gemini, Cursor, Windsurf, Copilot, and OpenClaw — 48 agents, 26 commands, 19 CLI tools, 2 MCP servers, autonomous hunt loops, exploit chain builder.
This repository also configures its own agents. See what pentest-agents tells them →
Skill Cursor
WAF fingerprinting and behavior mapping specialist. Use to identify the WAF, map its blocking rules, find bypass techniques, and document WAF behavior for other agents. Always run this before xss-hunter or injection testing on WAF-protected targets.
Skill Cursor
Smart contract and Web3/DeFi security auditor. Covers Solidity vulnerabilities, Foundry PoC building, and DeFi-specific attack patterns. Use for Immunefi, Code4rena, and other Web3 bug bounty programs.
Skill Cursor
XSS specialist covering reflected (H1 #60), stored (H1 #61), and DOM (H1 #62). Dispatcher passes subtype — 'reflected', 'stored', or 'dom' — in the task; falls back to inference from target. Use for parameter reflection, persisted inputs (comments/profiles/uploads/filenames), or client-side source→sink analysis.
Skill Cursor
XXE specialist (H1 #63). Use for testing XML parsing endpoints, file upload processors, SOAP services, SVG handlers, and any feature accepting XML input.
Skill Cursor
Analyze recon output with AI to suggest high-value targets and attack strategies. Usage: /analyze.
Skill Cursor
Autonomous hunt orchestrator. INSATIABLE in --autonomous mode: enforces an EXHAUSTION CONTRACT (26 canonical hunter classes, surface probe A-I, depth-engine ≥25 attempts/class, wall-clock floor 90 min/target, PRE-COMPLETION GATE before any summary). No early stops, no clarifying questions, no auxiliary-agent…
Skill Cursor
Manage the engagement brain. Subcommands: 'init' to set up, 'brief ' for pre-flight, 'status' for overview, 'exhausted [target]' to see dead ends.
Skill Cursor
Build deep exploit chains — dispatches chain-builder agent. Given bug A, recursively walks the chain graph. Usage: /chain (then describe bug A).
Skill Cursor
Run the finding correlation engine to discover attack chains from individual findings.
Skill Cursor
Show cost tracking and ROI for this engagement.
Skill Cursor
Check if a vulnerability has already been reported. Searches platform hacktivity + local findings. Usage: /dupcheck e.g. /dupcheck XSS in search endpoint.
Skill Cursor
Full security assessment with brain coordination. Multi-phase, skips known-exhausted areas, builds on prior knowledge.
Skill Cursor
Active vulnerability hunting on a target. Loads scope, reads brain, detects tech stack, runs targeted tests with concrete payloads. Usage: /hunt target.com [--vuln-class idor|xss|ssrf|sqli|ssti|oauth|rce|race|graphql|upload|business-logic|llm-ai].
Skill Cursor
Record a platform response and update learning. Usage: /learn [--bounty 500] [--vuln-type XSS].
Skill Cursor
Generate a text-based attack surface mindmap. Shows tech stack → vuln class → endpoint relationships. Usage: /mindmap.
Skill Cursor
Monitor targets for changes. Usage: /monitor baseline (first run), /monitor check (detect changes), /monitor scope (check platform for scope updates).
Skill Cursor
Create a new engagement workspace. Usage: /new [--type web-app|api|mobile|smart-contract].
Skill Cursor
Prepare the battlefield — recon, scanning, and surface ranking. Stops before hunting. Run /hunt or /autopilot after. Usage: /pipeline or /pipeline.
Skill Cursor
Score a report draft before submission. Usage: /quality.
Skill Cursor
Run a quick security scan on a target. Consults the Brain first, validates scope, runs passive recon + vuln scan in parallel.
Skill Cursor
Log a finding or pattern to persistent brain memory. Auto-fills from session context. Usage: /remember.
Skill Cursor
Generate submission-ready reports for all confirmed findings. Runs dedup, PoC builder, quality check, and report writer. Usage: /report bounty or /report pentest.
Skill Cursor
Resume a previous hunt. Shows hunt history, untested endpoints, memory-informed suggestions. Usage: /resume target.com.
Skill Cursor
Source code vulnerability hunting (SAST). Decomposes analysis into specialized passes: map entry points, map dangerous ops, trace flows, find gaps, adversarial validation, exploit. Usage: /sast [--lang c|cpp|rust|java|python|go|php] [--min-score 4] [--max-files 30] [--skip-static] [--best-of N].
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: