Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

H Mmer/Quickscan — measured AI agent skill | DecimalAI

h-mmer/quickscan

SkillScore77Maintained

Run a quick security scan on a target. Consults the Brain first, validates scope, runs passive recon + vuln scan in parallel.

by h-mmer

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

decimalai skills pull h-mmer-quickscan

Get this skill — curl · raw file

curl -fsSL https://app.decimal.ai/s/h-mmer-quickscan/SKILL.md

Raw file: /s/h-mmer-quickscan/SKILL.md ↗ · machine-readable summary at /s/h-mmer-quickscan.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 7d ago

—-30% tokens0% turns77% of whole cases pass with skill (17/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-07	✗→✓	▲ Improved	13%	0%
case-08	✗→✓	▲ Improved	110%	0%
case-10	✗→✓	▲ Improved	-41%	0%
case-12	✗→✓	▲ Improved	-31%	0%
case-13	✗→✓	▲ Improved	-65%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/1/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

H-mmer / pentest-agents

providers/codex/.agents/skills/quickscan/SKILL.md

View on GitHub ↗

Imported 8/1/2026Version v1

Skill contents

SKILL.md

ALL agents dispatched by this command MUST use in the subagent dispatch tool call.

Run a quick security assessment on: $ARGUMENTS

Workflow:

Brain: uv run python3 ../../tools/brain.py brief $ARGUMENTS — check what we already know. Note exhausted areas.
Scope: uv run python3 ../../tools/scope_check.py $ARGUMENTS — if out of scope, STOP.
Launch IN PARALLEL (skip areas the brain marks EXHAUSTED):

recon agent with passive-only depth, passing brain context about known subdomains/tech
config-auditor agent for headers, CSP, CORS, TLS, cookies

Record results: for each new finding, run uv run python3 ../../tools/brain.py record <target> <status> <technique> <details>
Log session: uv run python3 ../../tools/brain.py log "quickscan completed on $ARGUMENTS"
Summarize: separate NEW findings from KNOWN, recommend next steps.

Top-Tier Quickscan Loop

Quickscan should answer "is there obvious money or obvious risk here in 30 minutes?"

Spend the first five minutes on scope, policy headers, brain, and live host sanity.
Spend the next ten on high-signal passive recon: JS routes, exposed APIs, auth flows, cloud/storage names, source maps, security headers, and known vendor panels.
Spend ten on two targeted probes only: the best config/information leak candidate and the best auth/tenant-boundary candidate.
Spend five on triage: new, known, killed, or needs full hunt.

Never report from quickscan alone unless the proof is already complete. Promote strong leads to /hunt, /validate, or /chain.

Want to see if h-mmer/quickscan would activate on your phrasing? Try it before you install — no LLM call, no signup.

Other measured skills in the registry, with their headline benchmark lift.