quickscan

SkillSecurity

ALL agents dispatched by this command MUST use model: "inherit" in the Agent tool call.

Available today. Use it from your connected AI after setup.

No other account needed.

Connect ahel once, and every AI you use reads what you have installed.

Then ask your AI: use the quickscan skill

About this capability

Run a quick security scan on a target. Consults the Brain first, validates scope, runs passive recon + vuln scan in parallel.

What this skill tells your AI

The instructions your AI receives, as published by h-mmer/pentest-agents in .claude/skills/quickscan/SKILL.md and read by ahel’s review.

ALL agents dispatched by this command MUST use model: "inherit" in the Agent tool call.

Run a quick security assessment on: $ARGUMENTS

Workflow:

Brain: uv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py brief $ARGUMENTS — check what we already know. Note exhausted areas.
Scope: uv run python3 $CLAUDE_PROJECT_DIR/tools/scope_check.py $ARGUMENTS — if out of scope, STOP.
Launch IN PARALLEL (skip areas the brain marks EXHAUSTED):
- recon agent with passive-only depth, passing brain context about known subdomains/tech
- config-auditor agent for headers, CSP, CORS, TLS, cookies
Record results: for each new finding, run uv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py record <target> <status> <technique> <details>
Log session: uv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py log "quickscan completed on $ARGUMENTS"
Summarize: separate NEW findings from KNOWN, recommend next steps.

Quickscan should answer "is there obvious money or obvious risk here in 30 minutes?"

Spend the first five minutes on scope, policy headers, brain, and live host sanity.
Spend the next ten on high-signal passive recon: JS routes, exposed APIs, auth flows, cloud/storage names, source maps, security headers, and known vendor panels.
Spend ten on two targeted probes only: the best config/information leak candidate and the best auth/tenant-boundary candidate.
Spend five on triage: new, known, killed, or needs full hunt.

Never report from quickscan alone unless the proof is already complete. Promote strong leads to /hunt, /validate, or /chain.

Advanced