# Autonomous Godmode Hunter

> Autonomous end-to-end security research and full-surface bug hunting engine. Executes non-stop reconnaissance, attack-surface discovery, parameter mining, multi-stage vulnerability verification, minimal-impact PoC generation, and structured reporting on authorized targets.

- Skill: `zyrexnn/autonomous-godmode-hunter` (Agent Skill)
- Install (CLI): `npx skillmds@latest add zyrexnn/autonomous-godmode-hunter`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zyrexnn/autonomous-godmode-hunter/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- Author: zyrexnn (https://skillmd.com/u/zyrexnn)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zyrexnn/autonomous-godmode-hunter

---


# Autonomous God-Mode Bug Hunter Skill

## 1. Operational Directive & Scope Rule
1. **Explicit Operator Authorization**: When target domains, URLs, or CIDRs are specified in `scope.yaml` or conversation prompt, proceed with aggressive, exhaustive, and continuous technical validation.
2. **Non-Destructive & Rate Controlled**: Never perform DoS, volume saturation, or destructive data alterations. Always strive for **Maximum Technical Validation with Minimum Unnecessary Impact**.
3. **Zero False Positives**: Never declare a vulnerability confirmed without reproducible HTTP request/response proofs, browser console logs, or execution evidence.

## 2. Autonomous Execution Pipeline

```
                [ Target Defined in scope.yaml ]
                              │
               ┌──────────────┴──────────────┐
               ▼                             ▼
        [ Passive Recon ]             [ Active Discovery ]
     - Subfinder / Assetfinder      - HTTPx Probe & Tech Detect
     - Historical URL Mining (gau)  - Katana SPA / JS Crawling
               │                             │
               └──────────────┬──────────────┘
                              ▼
               [ Attack Surface Ranking & Fuzzing ]
     - Content / Directory Fuzzing (ffuf / feroxbuster)
     - Parameter Mining (burp-parameter-names)
     - Client-side JS Secret & Endpoint Extraction
                              │
                              ▼
               [ Deep Vulnerability Hypothesis ]
     - Auth & Session Handling (Dual-account matrix)
     - IDOR / BOLA / Mass-Assignment Testing
     - Injection Vectors (SQLi, SSTI, Command Injection)
     - Client-side Flaws (DOM XSS, CORS, CSRF via Puppeteer MCP)
     - SSRF & OOB Interaction Testing
                              │
                              ▼
               [ Controlled Exploit Validation ]
     - Replay & Mutate Requests
     - Isolate Root Cause Flaw
     - Generate Minimal-Impact PoC Script (Python)
                              │
                              ▼
               [ Evidence Capture & Reporting ]
     - Raw HTTP Request & Response Proofs
     - Write CVSS v3.1 Structured Markdown Report to reports/
```

## 3. Autonomous Tooling Integration Guide

- **Reconnaissance**: `subfinder -d <target> -silent | httpx -silent -status-code -title -rate-limit 10 -t 5`
- **Crawling**: `katana -u <url> -silent -depth 3 -rate-limit 10 -concurrency 3`
- **Fuzzing & Content Discovery**: `ffuf -u <url>/FUZZ -w tools/wordlists/common.txt -rate 5 -t 5 -mc 200,301,302,403` (fallback: `katana` crawl + `httpx` probe)
- **Vulnerability Scanning**: `nuclei -u <url> -tags cve,auth-bypass -rate-limit 10 -c 5 -silent`
- **XSS Analysis**: `dalfox url <url> --silence` (fallback: `nuclei` xss templates or Puppeteer MCP)
- **SQLi Verification**: `sqlmap -u "<url>?param=1" --batch --banner` (fallback: `nuclei` sqli templates or deterministic Python PoC)
- **Browser Automation**: Use MCP tools (`puppeteer_navigate`, `puppeteer_screenshot`, `puppeteer_evaluate`) for dynamic JavaScript and DOM verification.

## 4. Verification Checkpoint Matrix

| Vulnerability Type | Validation Standard | Evidence Requirement |
|---|---|---|
| **IDOR / BOLA** | Cross-tenant access between Account A & B | Both Request/Response pairs with leaked object |
| **Auth Bypass** | Accessing protected endpoint without valid credentials | Response payload showing privileged view |
| **SQL Injection** | DBMS version or deterministic differential response | Database banner or timing difference proof |
| **XSS / DOM Flaw** | Script execution context or DOM sink manipulation | Browser MCP console logs / DOM snapshot |
| **SSRF** | Server-side request callback or internal metadata fetch | Raw response headers and body |

## 5. Target-Scoped Output Hierarchy & Deliverables
Always create target-scoped directories before saving outputs (`TARGET_SLUG` e.g. `example_com` or `127_0_0_1_8888`):
- Directory Setup: `mkdir -p reports/<TARGET_SLUG>/findings reports/<TARGET_SLUG>/pocs reports/<TARGET_SLUG>/evidence`
- Finding Report (Confirmed `low`, `medium`, `high`, `critical` only): `reports/<TARGET_SLUG>/findings/<severity>_<vuln_name>.md` (clean snake_case, no square brackets)
- Informational & Recon Findings: Group into `reports/<TARGET_SLUG>/evidence/recon_notes.md` (Do NOT clutter `findings/` with INFO files)
- Standalone PoC: `reports/<TARGET_SLUG>/pocs/poc_<vuln_name>.py`
- Visual / HTTP Evidence: `reports/<TARGET_SLUG>/evidence/<filename>`
- Consolidated Summary: Run `aggregate_reports <TARGET_SLUG>` to index findings into `reports/<TARGET_SLUG>/SUMMARY.md`.