Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add pashki975/thm-claude-kit --skill thm-methodologygit clone --depth 1 https://github.com/pashki975/thm-claude-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pashki975/thm-claude-kit/thm-methodology)<a href="https://agentmods.dev/skills/pashki975/thm-claude-kit/thm-methodology"><img src="https://agentmods.dev/badge/skills/pashki975/thm-claude-kit/thm-methodology/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pashki975/thm-claude-kit/thm-methodology"><img src="https://agentmods.dev/badge/skills/pashki975/thm-claude-kit/thm-methodology.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00063 | $0.00635 |
| Opus 5 | $0.00032 | $0.00318 |
| Sonnet 5 | $0.00013 | $0.00127 |
| Haiku 4.5 | $0.00006 | $0.00064 |
Grade A, and why
thm-methodology scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 55 lines — stays where its author put it; the contents beside it link to each section on GitHub.
TryHackMe Methodology
Follow this flow. Never skip enumeration to jump to exploitation.
0. Setup
- Confirm VPN up and target reachable (/vpn-check)
- Create room folder + scans/ + notes.md
1. Recon
- Full TCP port scan, then targeted -sV -sC on open ports (/recon)
- Don't forget UDP — SNMP/TFTP/DNS hide there (/enum-udp). Run it in parallel with TCP enum.
- Record every open port/service in notes.md
2. Enumerate per service
Match each open port to its enumeration path:
- 80/443/8080 → web (/enum-web): dirs, vhosts, tech stack, source, robots.txt
- 139/445 → SMB (/enum-smb)
- 21 → FTP: try anonymous login
- 22 → SSH: note version, save creds for later; don't brute unless hinted
- 25/110/143 → mail
- 3306/1433/5432/27017/6379 → databases (/db-enum): creds to reuse + RCE paths
- 161/69/53 (UDP) → /enum-udp
- Map service versions to CVEs (cve-researcher agent)
3. Foothold
- Exploit the most promising verified vector
- Set up listener + payload (/listener) for reverse shells
- Upgrade to a stable TTY immediately after landing a shell
4. Post-exploitation / privesc
- Grab the user flag
- Run local enum with the checklist (/linux-privesc): sudo -l, SUID, capabilities, cron/pspy, cred hunting
- Analyze with privesc-advisor agent
- Escalate to root, grab root flag
5. Pivot (if the room has more than one host)
- Check the foothold for a second NIC / internal subnet (ip a, ip route, arp -a)
- Tunnel in (/tunnel) with ligolo-ng, chisel, sshuttle, or SSH forwards
- Record each internal host in notes.md as a new target and re-run this methodology against it
6. Loot & document
- Record all flags and creds in notes.md
- Generate writeup (report-writer agent)
Rules
- Stay strictly on the assigned target IP/range
- Enumerate thoroughly before exploiting — most CTF blockers are missed enum
- Reuse found credentials everywhere (SSH/SMB/web/db) — password reuse is rampant on THM
- When stuck: re-read scan output, try a bigger wordlist, check UDP, check for vhosts, revisit versions
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 55 lines · 63 tokens per session scan A af0d98fb45cb
thm-methodology is a skill published in the GitHub repository pashki975/thm-claude-kit (2 stars, last pushed 25d ago), licensed MIT. It adds 63 tokens to every session and 635 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
elvish-translation-tools
Use when translating, reviewing, or maintaining UI / document translations into Sindarin or Quenya (Tolkien's Elvish languages). Triggers include: working with a Sindarin / sjn / Quenya / qya locale file; asked to translate an English string into Elvish; reviewing existing Elvish translations for correctness; adding…
crisis-catalyst
Reframe a crisis, constraint, or setback as a forcing function for founder-mode decisions that were previously politically blocked. Based on Chesky's pandemic transformation and Andy Grove's "great companies are defined by their crises." Use when facing a serious challenge and want to use it as fuel, not just survive…
founder-quiz
Take a behavioral self-assessment to discover where you sit on the founder mode spectrum. 15 questions that reveal your actual operating mode — not what you think you do, but what you actually do. Use for honest self-reflection.
hiring-scorecard
Score an executive or senior hire using Brian Chesky's 'guilty until proven innocent' framework. Generates a reference check script, identifies red flags, and assesses builder vs. manager fit. Use when evaluating a candidate for a senior role.
org-health
Diagnose organizational health against Brian Chesky's framework. Detects the division → politics → bureaucracy → complacency arc that kills founder-led companies. Use when a founder suspects their org structure is slowing them down.
decision-check
Determine whether a decision is a founder-only move (requires institutional memory, passion, and permission) or a manageable decision that can be delegated. Based on Chesky's framework of what only a founder can do. Use when deciding whether to stay involved in or hand off a decision.