Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

H Mmer/Learn — measured AI agent skill | DecimalAI

h-mmer/learn

NewSkillScoreMaintained

Record a platform response and update learning. Usage: /learn <report_id> <status> [--bounty 500] [--vuln-type XSS]

by h-mmer

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

decimalai skills pull h-mmer-learn

Get this skill — curl · raw file

curl -fsSL https://app.decimal.ai/s/h-mmer-learn/SKILL.md

Raw file: /s/h-mmer-learn/SKILL.md ↗ · machine-readable summary at /s/h-mmer-learn.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 7d ago

—+6% tokens0% turns32% of whole cases pass with skill (7/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-05	✗→✓	▲ Improved	33%	0%
case-15	✗→✓	▲ Improved	-18%	0%
case-16	✗→✓	▲ Improved	-31%	0%
case-18	✗→✓	▲ Improved	5%	0%
case-08	✓→✗	▼ Worse	-72%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/1/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

H-mmer / pentest-agents

providers/codex/.agents/skills/learn/SKILL.md

View on GitHub ↗

Imported 8/1/2026Version v1

Skill contents

SKILL.md

Record platform response: $ARGUMENTS

Parse arguments and run: uv run python3 ../../tools/response_tracker.py log $ARGUMENTS
Also update brain: uv run python3 ../../tools/brain.py log "Report response: $ARGUMENTS"
Sync to global brain: uv run python3 ../../tools/global_brain.py sync-from-local
Show updated insights: uv run python3 ../../tools/response_tracker.py insights

Top-Tier Learning Loop

Convert every platform response into a future hunting rule.

If accepted: record the decisive proof artifact, impact framing, asset type, vuln variant, bounty tier, and why triage agreed.
If duplicate: record the duplicated primitive and which uniqueness signal was missing.
If N/A: record the exact sentence or policy clause that killed it.
If informative: record the missing chain or business impact required to make it payable.
If severity changed: record the evidence that moved it up or down.

End with one concrete update: a brain pattern, a never-submit rule, a report wording change, or a target ranking adjustment.

Want to see if h-mmer/learn would activate on your phrasing? Try it before you install — no LLM call, no signup.

Other measured skills in the registry, with their headline benchmark lift.