Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

H Mmer/Surface — measured AI agent skill | DecimalAI

h-mmer/surface

SkillScore68Maintained

Show ranked attack surface for a target. Invokes recon-ranker agent. Usage: /surface target.com

by h-mmer

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

decimalai skills pull h-mmer-surface

Get this skill — curl · raw file

curl -fsSL https://app.decimal.ai/s/h-mmer-surface/SKILL.md

Raw file: /s/h-mmer-surface/SKILL.md ↗ · machine-readable summary at /s/h-mmer-surface.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 7d ago

—-15% tokens0% turns68% of whole cases pass with skill (15/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-07	✗→✓	▲ Improved	13%	0%
case-08	✗→✓	▲ Improved	-10%	0%
case-10	✗→✓	▲ Improved	-10%	0%
case-14	✗→✓	▲ Improved	-42%	0%
case-15	✗→✓	▲ Improved	-51%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/1/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

H-mmer / pentest-agents

providers/codex/.agents/skills/surface/SKILL.md

View on GitHub ↗

Imported 8/1/2026Version v1

Skill contents

SKILL.md

Rank attack surface for: $ARGUMENTS

Verify recon data exists in recon/ directory. If not, suggest /recon first.
Read brain data for this target.
Launch recon-ranker agent: "Rank the attack surface for $ARGUMENTS. Read recon/ for discovery data and brain for tested endpoints. Output P1/P2/Kill ranking."
Show the ranking to the user.
Suggest: /hunt $ARGUMENTS to start testing P1 targets.

Top-Tier Surface Ranking

Rank by exploit economics.

P1 requires at least two of:

crown-jewel function: auth, billing, admin, tenant data, integrations, uploads, exports, webhooks, AI/tool execution
weak boundary: cross-tenant IDs, mixed roles, public/private transition, OAuth callback, parser boundary, file ingestion
novelty: new asset, changed JS, low hacktivity coverage, unusual vendor or beta endpoint
proof path: two-account test, clear callback, readable response, browser-verifiable sink, local PoC

Kill or P3 assets that are static marketing pages, hardened vendor panels with no program-owned data, or endpoints already exhausted with strong evidence. Every P1 must include the best first vuln class and first request to try.

Want to see if h-mmer/surface would activate on your phrasing? Try it before you install — no LLM call, no signup.

Other measured skills in the registry, with their headline benchmark lift.