autopilot

Runs an autonomous bug bounty hunt loop with scope checks, recon, validation, and reporting checkpoints.

1|Updated Aug 21, 2026
One-click install
npx skills add https://github.com/marcboggs/BMAD-AppSec-Orchestrator --skill autopilot-marcboggs
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: autopilot
Source: https://github.com/marcboggs/BMAD-AppSec-Orchestrator/tree/main/bughunter/skills/pentest/autopilot
Command: npx skills add https://github.com/marcboggs/BMAD-AppSec-Orchestrator --skill autopilot-marcboggs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Manual bug bounty hunting requires repeatedly coordinating scope verification, reconnaissance, endpoint ranking, vulnerability testing, and report drafting, which is slow and error-prone across multiple targets. ## Core Features & Use Cases - Autonomous Hunt Loop: Chains scope check, recon, attack surface ranking, hunting, 7-question validation, and report drafting into one continuous workflow. - Configurable Checkpoint Modes: Choose --paranoid, --normal, --yolo, or --quick to control how often the loop pauses for human review and how many tokens it consumes. - Safety Guarantees: Every URL is checked against a scope allowlist, all requests are logged to hunt-memory/audit.jsonl, rate limits and a circuit breaker prevent hammering, and reports are never auto-submitted. - Use Case: A bug bounty hunter points the skill at target.com in --paranoid mode on a new program, letting it recon and test P1 endpoints while pausing on every finding for human approval. ## Quick Start Ask the agent to run /autopilot target.com in a fresh session to start a full scoped hunt with paranoid checkpoints.

Frequently Asked Questions about autopilot

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run an autonomous bug bounty hunt on a target?▼

Run /autopilot target.com in a fresh session. It executes scope check, recon, attack surface ranking, hunting, validation, and report drafting in sequence, pausing at checkpoints based on the mode you select.

What is the difference between paranoid, normal, and yolo checkpoint modes?▼

Paranoid stops on every finding and partial signal, normal stops after each validation batch, and yolo stops only after the full surface is exhausted. All modes still require explicit human approval before any report is submitted.

Can I test multiple targets in one session?▼

Testing multiple targets in one session causes context cross-contamination between targets. Start a separate session per target, or run /pickup target.com when switching targets to reload the correct context.

How do I reduce token usage during a long hunt?▼

Use /autopilot target.com --quick for a faster surface scan with roughly 40% fewer tokens, or /hunt target.com --vuln-class idor to test a single bug class. Run /compact periodically to compress context without losing findings.

Does autopilot submit vulnerability reports automatically?▼

No. Reports are never auto-submitted and always require explicit human approval. Additionally, PUT, DELETE, and PATCH requests require human approval even in yolo mode, and every request is logged to hunt-memory/audit.jsonl.