How do I install the Fullscan skill?

Run npx skillmds@latest add h-mmer/fullscan in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Fullscan safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Fullscan?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Fullscan free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Fullscan?

h-mmer (@h-mmer) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Fullscan by h-mmer — Agent Skill

Name: Fullscan
Author: h-mmer

File contents

ALL agents dispatched by this command MUST use model: "inherit" in the Agent tool call.

Full security assessment on: $ARGUMENTS

Phase 0: Brain Briefing

uv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py init (if first run)
uv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py brief $ARGUMENTS
uv run python3 $CLAUDE_PROJECT_DIR/tools/scope_check.py $ARGUMENTS

Phase 1: Recon (skip already-discovered assets)

Launch recon agent with brain context. Focus on discovering NEW subdomains and services beyond what's already known.

Phase 2: Scanning (skip exhausted areas)

Launch IN PARALLEL, each with brain context about what's been scanned before:

vuln-scanner — skip known false positives, focus new hosts
config-auditor — check if previously noted misconfigs are fixed
js-analyzer — focus on new/changed JS files

Record all results to the brain after each agent returns.

Phase 3: Targeted Testing (brain-guided)

Based on Phase 2 + brain knowledge, selectively launch ONLY agents targeting UNTESTED or ACTIVE vectors:

xss-hunter ONLY on endpoints not marked exhausted
api-audit ONLY on newly discovered or untested endpoints
auth-tester ONLY if new auth flows found

Record all results to the brain.

Phase 4: Reporting

uv run python3 $CLAUDE_PROJECT_DIR/tools/dedup_findings.py --scan-dir scans/ --db findings.json --stats
uv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py status
Launch poc-builder for each confirmed finding
Launch report-writer with full brain context
uv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py log "Full scan completed on $ARGUMENTS"

Top-Tier Fullscan Standard

A full scan must leave a defensible coverage ledger.

Start with the crown jewels: auth, tenant data, billing, admin, integrations, uploads, webhooks, exports, AI/tool surfaces, and source/repo exposure.
For each phase, record both positives and negatives. "Scanned" is invalid unless it names tools, targets, timestamps, and skipped areas.
Do not let scanner output dominate. Use scanners to find leads, then spend human-grade effort on state changes, authorization boundaries, and parser differentials.
Before reporting, run /correlate or /chain on all confirmed and partial findings. Single low bugs should not escape the scan if a plausible chain remains.
Final output must contain: confirmed findings, killed false positives, exhausted high-value paths, untested residual risk, and the next best command.

---name: fullscandescription: Full security assessment with brain coordination. Multi-phase, skips known-exhausted areas, builds on prior knowledge.---ALL agents dispatched by this command MUST use `model: "inherit"` in the Agent tool call.Full security assessment on: $ARGUMENTS## Phase 0: Brain Briefing1. `uv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py init` (if first run)2. `uv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py brief $ARGUMENTS`3. `uv run python3 $CLAUDE_PROJECT_DIR/tools/scope_check.py $ARGUMENTS`## Phase 1: Recon (skip already-discovered assets)Launch `recon` agent with brain context. Focus on discovering NEW subdomains and services beyond what's already known.## Phase 2: Scanning (skip exhausted areas)Launch IN PARALLEL, each with brain context about what's been scanned before:- `vuln-scanner` — skip known false positives, focus new hosts- `config-auditor` — check if previously noted misconfigs are fixed- `js-analyzer` — focus on new/changed JS filesRecord all results to the brain after each agent returns.## Phase 3: Targeted Testing (brain-guided)Based on Phase 2 + brain knowledge, selectively launch ONLY agents targeting UNTESTED or ACTIVE vectors:- `xss-hunter` ONLY on endpoints not marked exhausted- `api-audit` ONLY on newly discovered or untested endpoints - `auth-tester` ONLY if new auth flows foundRecord all results to the brain.## Phase 4: Reporting1. `uv run python3 $CLAUDE_PROJECT_DIR/tools/dedup_findings.py --scan-dir scans/ --db findings.json --stats`2. `uv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py status`3. Launch `poc-builder` for each confirmed finding4. Launch `report-writer` with full brain context5. `uv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py log "Full scan completed on $ARGUMENTS"`## Top-Tier Fullscan StandardA full scan must leave a defensible coverage ledger.1. Start with the crown jewels: auth, tenant data, billing, admin, integrations, uploads, webhooks, exports, AI/tool surfaces, and source/repo exposure.2. For each phase, record both positives and negatives. "Scanned" is invalid unless it names tools, targets, timestamps, and skipped areas.3. Do not let scanner output dominate. Use scanners to find leads, then spend human-grade effort on state changes, authorization boundaries, and parser differentials.4. Before reporting, run `/correlate` or `/chain` on all confirmed and partial findings. Single low bugs should not escape the scan if a plausible chain remains.5. Final output must contain: confirmed findings, killed false positives, exhausted high-value paths, untested residual risk, and the next best command.

Frequently asked questions

Fullscan