quality

$npx mdskill add H-mmer/pentest-agents/quality

Quality-check a report draft: $ARGUMENTS

SKILL.md

.github/skills/qualityView on GitHub ↗
---
name: quality
description: "Score a report draft before submission. Usage: /quality <draft-path-or-finding-description>"
disable-model-invocation: false
---
Quality-check a report draft: $ARGUMENTS

1. If a file path is given, read the draft file.
2. Launch `quality-check` agent with the draft content.
3. Show the score and any issues to fix.
4. If score < 7, recommend specific improvements.
5. If score >= 7, confirm the report is ready for submission.

## Top-Tier Quality Bar

Block reports that are merely plausible.

Score against:
- reproducibility: exact steps, accounts, URLs, headers, and stable artifacts
- impact proof: real capability demonstrated without prohibited access
- severity fit: CVSS/vector matches the proven final state, not the hoped-for chain
- novelty: dupcheck considered and prior art handled
- evidence hygiene: screenshots, recordings, PoC paths, and request/response pairs exist on disk
- triage empathy: title, summary, and remediation let the program act fast

If any artifact is missing, say exactly what command or capture step fixes it. Do not let a fluent report compensate for weak proof.

More from H-mmer/pentest-agents

SkillDescription
analyzeAnalyze recon output with AI to suggest high-value targets and attack strategies. Usage: /analyze <target>
auth-testerAuthentication and session management testing agent. Use for login bypass, session fixation, password reset flow abuse, MFA bypass, OAuth flaws, and privilege escalation testing. Provide the application URL and any credentials for testing.
autopilotAutonomous hunt orchestrator. INSATIABLE in --autonomous mode: enforces an EXHAUSTION CONTRACT (26 canonical hunter classes, surface probe A-I, depth-engine ≥25 attempts/class, wall-clock floor 90 min/target, PRE-COMPLETION GATE before any summary). No early stops, no clarifying questions, no auxiliary-agent substitution. Usage: /autopilot target.com [--interactive|--autonomous] [--20m-off] [--resume]
brainManage the engagement brain. Subcommands: 'init' to set up, 'brief <target>' for pre-flight, 'status' for overview, 'exhausted [target]' to see dead ends.
browser-agentBrowser automation agent for interactive web testing. Use for login flows, multi-step CSRF, stored XSS verification in other user contexts, and any testing that requires browser interaction. Requires Claude in Chrome MCP.
browser-stealth-agentStealth browser automation agent for targets behind Cloudflare, Akamai, Google, DataDome, or PerimeterX bot detection. Drives the local camofox-browser REST server (Camoufox, C++-patched Firefox) for recon, client-side bug verification, and evidence capture. Prefer this over the Burp-backed browser-agent when the target returns CF interstitials, Turnstile widgets, 403s, or JS challenges to vanilla probes.
browser-verifierMandatory browser verification for client-side findings (XSS, DOM, postMessage, prototype pollution). Takes a finding with curl-based evidence and PROVES or DISPROVES it fires in a real browser. No finding ships without browser verification. Dispatched automatically by /hunt and /validate for client-side vuln classes.
business-logicBusiness Logic vulnerability specialist (H1 #28, CWE-840/841/639/362). Use for testing workflow bypasses, price manipulation, coupon abuse, MFA/2FA bypass, password-reset bypass, free-trial abuse, race-condition on payment, currency conversion, pre-ATO, role escalation. Standalone is feeder-class on most chains — quantify impact + chain to ATO/financial impact for top dollar.
chainBuild deep exploit chains — dispatches chain-builder agent. Given bug A, recursively walks the chain graph. Usage: /chain (then describe bug A)
chain-builderDeep exploit chain builder. Given bug A, recursively walks the chain graph — each confirmed link becomes the new A. No depth limit. Supports 2-link to 10+ link chains. Use when you have any finding that needs escalation.