mad-Hacks_ai
A single-folder, keyless offensive-security toolkit for Claude Code. This session is the backbone — no API keys, no server, no second bill. It runs a full kill-chain (recon → weaponize → exploit → verify → report) over real system tools, under a strict authorization + evidence + anti-fabrication doctrine, backed by a persistent brain that compounds across engagements and every repo you feed it.
Distilled from T3MP3ST (AGPL-3.0) + shuvonsec/claude-bug-bounty. Folded in: xalgorix (Apache-2.0 · autonomous-pentest methodology), hahwul/dalfox v3 (MIT · Rust XSS scanner with native OOB + MCP), Rifteo/skills (MIT · 38-skill peer library), mazen160/secrets-patterns-db (1610 curated regexes via scripts/secrets-scan.sh), bikini/exploitarium (39 PoC folders / 12 CVEs), moscovium-mc/CloudRip (CF origin discovery), shadowsock5/Poc (Chinese CMS aggregator), devanshbatham/Awesome-Bugbounty-Writeups (per-class disclosed-writeup index), skraft9/vulnerability-research (active CVE research — 6 attack primitives + 3 tools), Mr-Infect/AI-penetration-testing (OWASP LLM Top 10 corpus), usestrix/strix (Apache-2.0 · pentest agent framework), project-lambda-zero/AILA (modular AI-security-platform archetype), swisskyrepo/PayloadsAllTheThings (last-resort payload archive), zhaoxuya520/reverse-skill (43 categorized technique docs), and the CoffinXP / Lostsec writeup corpus. Attribution/licenses in packs/. 19 packs at 100% integration (measured via scripts/verify-packs.sh --strict); per-pack A/B contribution via scripts/pack-eval.sh.
Three entry points
/mad-hacks <target-or-task> general operator mode — full kill chain, doctrine-gated
/mad-hunt <target> [--auto] autonomous bug-bounty spine (exhaustion contract)
/cdc-research <target> --goal "…" Concurrent Divergent-Cognition vuln research
--deployment "…" (parallel families, chain-until-impact, no CVE shortcuts)
[--mode bug-bounty|pentest|research]
/mad-hacks — general operator. Loads SKILL.md, routes assets via references/router.md (3-tier lazy load)./mad-hunt — bounty spine: scope-gate → surface probe A–J → surface × payout-ranked specialists (≥25 attempts/class) → 7-Q + t3-verifier REFUTE gate → chain-builder escalation → platform-ready draft. Loop: references/mad-hunt.md./mad-audit — invariant-driven source audit (sliced, small active context, strict verifier with inverted framing). audit-slice.sh init <t> → .audit/{system-context,threat-model,invariants,slices,progress,decisions}.yaml → slice-planner → per-slice audit-hunt.sh 3-dim scoring (attack-surface + invariant-coverage + dependency) → 2-6 hunters → verifier-strict → decisions.yaml (negative memory) → next slice. Loop: references/mad-audit.md./cdc-research — novel-vuln loop with chain-until-impact + layered halting (soft budget · plateau tripwire · hard budget · operator interrupt). Spec: references/cdc-harness.md. State: scripts/cdc-state.sh.
The intelligence layer (the part that makes it get smarter)
The canonical file-brain is the source of truth. Sitting on top of it:
┌──────────────────────────────────────┐
│ SOURCE (canonical) │
│ references · scripts · tools · │
│ brain/{lessons,tools,payloads} · │ prose (append-only)
│ brain/{lessons,patterns,tools}.jsonl│ atomic records (queryable, retrieval-attributed)
│ brain/registry/pack-index.jsonl │ per-pack integration state (SPOT)
│ packs/<name>/EXTRACTION.md │ per-pack extraction manifest
│ packs · agents · engagements │
└──────────────┬───────────────────────┘
│
▼
┌──────────────────────────────────────┐
│ REGISTRY (regenerable) │ scripts/build-registry.py
│ brain/registry/assets.jsonl (406) │ 8 types: reference · script · tool ·
│ brain/registry/assets.db (SQLite │ payload · lesson · agent · pattern · pack
│ FTS5 / BM25) │ common schema per row:
│ brain/registry/assets.faiss │ id · type · title · description ·
│ (optional, opt-in) │ capabilities · classes · technologies ·
│ │ prerequisites · commands · outputs ·
│ │ provenance (incl. source_pack) ·
│ │ epistemic_status · confidence
└──────────────┬───────────────────────┘
│
▼
┌──────────────────────────────────────┐
│ INTELLIGENCE ROUTER │ scripts/intelligence-recall.sh
│ (Reciprocal Rank Fusion, k=60) │
│ │
│ lex (FTS5) │ BM25-ranked, stdlib-only
│ + sem (FAISS, if installed) │ MiniLM cosine
│ + writeups (6.7k row MCP corpus) │ SQLite keyword
│ + target (.engagement/<t>/ state) │ observed / tested / exhausted
│ ═════════════════════════════════ │
│ fused, deduplicated, ranked │
└──────────────┬───────────────────────┘
│
▼
┌──────────────────────────────────────┐ scripts/engagement-state.sh
│ ENGAGEMENT STATE │ .engagement/<slug>/
│ TECHNOLOGY · OBSERVED · TESTED · │ EXHAUSTED.md as structured
│ EXHAUSTED · HYPOTHESES · │ [class][vector][variant] records
│ EVIDENCE.jsonl (epistemic ternary) │ deadangle: OBSERVED/DERIVED/INFERRED/HYPOTHESIS
└──────────────┬───────────────────────┘
│
▼
┌──────────────────────────────────────┐
│ SPECIALIST HUNTERS │ 19 agents, all wired to:
│ xss / ssrf / idor / rce / ssti / │ 1. ToolSearch(burp,dalfox)
│ oauth / cors / csrf / xxe / sqli / │ 2. intelligence-recall.sh
│ open-redirect / subdomain-takeover / │ 3. engagement-state.sh recall
│ race / business-logic / graphql / │ 4. probe → capture back:
│ file-upload / info-disclosure / │ observe / tested /
│ cloud-recon / config-auditor │ exhausted / evidence / learn
└──────────────────────────────────────┘
optional cache: brain-sync-ruflo.sh --from-registry
exports the registry with provenance.last_verified so ruflo staleness
is detectable at query time. Toolkit still works if ruflo disappears.
Every specialist hunter's Preflight preamble runs the same 3-step boot: ToolSearch → intelligence-recall → engagement-state recall, then probes, then writes results back. The file tree remains authoritative; the registry is a regenerable index; the router hides where knowledge lives from the agents.
Layout
mad-Hacks_ai/ ← symlinked to ~/.claude/skills/mad-hacks (the /mad-hacks skill)
├── SKILL.md operator entry point + coverage map + toolkit table
├── CLAUDE.md orchestrator / dispatch rules / hard rules
├── commands/ /mad-hunt · /cdc-research (symlinked into ~/.claude/commands/)
├── workflows/ cdc-verify.js (parallel adversarial verify pass — structured schemas)
├── references/ router (load-on-CLASSIFY asset map) · doctrine · pipeline · operators ·
│ └── prompts/ arsenal · mission-families · runbooks · frontier-lanes · knowledge-packs ·
│ vuln-playbooks · payload-arsenal · report-template · tech-stack-playbooks ·
│ cdc-harness · mad-hunt · hunt-xss · hunt-registration · hunt-session ·
│ hunt-cache-deception · wordpress-recon · recon-oneliners ·
│ dalfox-guide · xalgorix-methodology · rifteo-skills-catalog ·
│ deadangle · engagement-handoff · burp-integration
│ prompts/ = verbatim recipe library (8 operator system prompts + more)
├── scripts/ brain · scope · scope.py · preamble.py · preflight · recon · web-scan ·
│ surface-probe · xss-surface · code-audit · cloud-audit · mobile-audit ·
│ binary-audit · contract-audit · report · oob · cdc-state ·
│ engagement-state · build-registry · build-embeddings ·
│ intelligence-recall · build-writeup-corpus · refresh-writeup-feeds ·
│ brain-sync-ruflo · reinstall-packs · ingest · optimize (keyless)
├── brain/ persistent memory (dual form: prose for humans, JSONL for machines):
│ ├── lesson-index.md class → keyword-set for recall-class
│ ├── lessons.md append-only global heuristics — prose (125+)
│ ├── tools.md tools learned — prose (47+)
│ ├── lessons.jsonl atomic lessons — normalized JSONL (18 records, source_pack-attributed)
│ ├── patterns.jsonl conditional {precondition, action} triggers — atomic (23 records)
│ ├── tools.jsonl atomic tool records — normalized JSONL (5 records)
│ ├── eval/ reference-queries.jsonl — canonical A/B eval query set (24 queries)
│ ├── payloads/ per-class libraries (37 files, 19k+ probes)
│ ├── targets/ per-target memory (gitignored)
│ ├── telemetry/ retrievals.jsonl — retrieval-hit log (gitignored, session-local)
│ └── registry/
│ ├── pack-index.jsonl TRACKED — per-pack integration state (SPOT for verify-packs)
│ ├── assets.jsonl GITIGNORED — 406 rows, regenerable via build-registry.py
│ ├── assets.db GITIGNORED — SQLite FTS5 (BM25) lexical index
│ ├── assets.faiss GITIGNORED — optional FAISS semantic index
│ └── assets.embed-map.jsonl
├── wordlists/ deduped: params · sensitive-files · content-discovery · raft · api-endpoints ·
│ common · onelistforall.txt.gz
├── tools/ scanner scripts extracted from ingested repos (48 files, all registry-indexed)
├── agents/ t3-{recon,scanner,exploiter,verifier,reporter} (symlinked into ~/.claude/agents/)
├── packs/ attribution + methodology from ingested repos — 19 packs at 100% integration
│ VENDORED (tracked in-repo, may have .vendored/.internal markers):
│ writeups/ · cyberstrike/ · strix/ · claude-bughunter/ · claude-bug-bounty/ ·
│ t3mp3st/ · reverse-skill/ · payloads-all-the-things/ · ai-pentesting/
│ EXTERNALLY CLONED (contents gitignored; EXTRACTION.md + markers tracked):
│ xalgorix/ · dalfox/ · rifteo-skills/ · secrets-patterns-db/ ·
│ exploitarium/ · CloudRip/ · Poc/ · Awesome-Bugbounty-Writeups/ ·
│ vulnerability-research/ · AILA/
│ rehydrate: `bash scripts/reinstall-packs.sh` (URLs+SHAs in UPSTREAM.md)
│ EVERY pack has: EXTRACTION.md manifest + entry in pack-index.jsonl
│ (contract enforced by scripts/verify-packs.sh, wired to pre-commit)
├── .engagement/ per-target state (gitignored) — TECHNOLOGY / OBSERVED / TESTED /
│ EXHAUSTED / HYPOTHESES / EVIDENCE.jsonl / LOG
├── .cdc/ per-target CDC harness working state (gitignored)
└── engagements/ per-target working evidence (gitignored)
Doctrine (non-negotiable — every run)
- Authorization first.
bash scripts/scope.sh init <target> then scripts/preflight.sh <target>. A tool working or a host answering is not consent — authorization comes only from the engagement contract.
- Execution modes.
safe_command → run. receipt_required (nmap, nuclei, ffuf, sqlmap, curl-vs-target, dalfox scan) → pause for explicit user OK. catalog_only/import_only (msfconsole, pacu, frida, hydra) → never run here — hand to the user.
- VERIFY + REFUTE. Real only if it appears in captured tool output.
t3-verifier emits a mandatory visible verdict card with the Verified / Inferred / Assumed ternary (references/deadangle.md) — a CONFIRMED verdict whose claims are majority-Inferred/Assumed is grounds for DOWNGRADED.
- Redact secrets/PII. Absolute stops apply regardless of scope (no credential entry, data deletion, fund movement, destructive payloads on the user's behalf).
- No CVE / patch-diff / changelog shortcuts as proof. Reproduce against the realistic deployment. Read dependency source when behavior depends on it — runtime is oracle, docs are hypothesis.
Installed arsenal (keyless, on this machine)
Recon/DNS: nmap · subfinder · amass · dnsx · waybackurls · dig · whois · katana · gau · asnmap · chaos
Web: curl · httpx-toolkit · ffuf · gobuster · nikto · wafw00f · arjun · dalfox v2 (v3 upgrade recommended — brew install dalfox)
Vuln/scan: nuclei · semgrep · osv-scanner
Secrets/crypto: gitleaks · trufflehog · openssl · testssl.sh
OOB: interactsh-client — wrapped by scripts/oob.sh (per-target ledger, seed/fire/poll/attribute)
Report: pandoc / cmark / python-docx / weasyprint / wkhtmltopdf — whichever is present (scripts/report.sh build-{html,docx,pdf,all})
Optional (semantic retrieval): pip3 install faiss-cpu sentence-transformers — unlocks FAISS layer in intelligence-recall.sh
scripts/preflight.sh <target> prints live availability. Active tools are receipt_required — used only with confirmed scope.
Retrieval status — LIVE vs OPTIONAL (honest labels)
| Layer | Status | Baseline (against tests/intelligence/queries.jsonl) |
|---|
| SQLite FTS5 / BM25 lexical | LIVE — stdlib only, ships with every clone | MRR 0.530, R@10 0.562 |
| RRF fusion (lex + writeups + target) | LIVE — via intelligence-recall.sh (phase 1) | MRR 0.549, R@10 0.625 |
| Security-vocabulary query expansion | LIVE — zero-threshold fallback, tight OR pool | rescues synonym (R@10 0→0.700) + tech-cross (MRR 0→0.750) |
| State-as-filter (audit correction #7) | LIVE — phase 2 of the router: exhausted-class demote (0.4×) + hypothesis-alignment boost (+0.15 × median × signal) applied after RRF | --state-filter=on|off|auto; 37/37 state adversarial tests |
| Engagement state (target memory) | LIVE — .engagement/<t>/ (OBSERVED / TESTED / EXHAUSTED / HYPOTHESES / EVIDENCE) | 37/37 state adversarial tests pass (was 9/9) |
| Evidence ledger + epistemic ternary | LIVE — EVIDENCE.jsonl | Verified/Inferred/Assumed labels never silently upgrade |
| FAISS + sentence-transformers semantic | OPTIONAL — pip3 install faiss-cpu sentence-transformers + python3 scripts/build-embeddings.py | Not measured until enabled |
| Ruflo semantic cache | OPTIONAL — brain-sync-ruflo.sh --from-registry + ruflo MCP | Provenance-tagged; toolkit works without it |
Registry (brain/registry/) | REGENERABLE — do not hand-edit — assets.jsonl + assets.db regenerated from source by build-registry.py; canonical remains the file tree. NOTE: pack-index.jsonl in the same dir is NOT regenerable — it's the SPOT for per-pack integration state, tracked separately | 406 rows across 8 types (reference · script · tool · payload · lesson · agent · pattern · pack) |
| Pack integration state () |
Per-category MRR (RRF, 2026-09-04 v2): direct 0.676 · synonym 0.578 · tech-cross 0.750 · ambiguous 0.357 · indirect 0.125.
The retrieval suite (tests/intelligence/) freezes these numbers. Every future router change is compared numerically, not "looks good on toy queries." The suite has caught two bad tunes already (blind expansion regressed MRR −30%, threshold-<5 fallback regressed MRR −6%) and validated the good ones (zero-threshold expansion +28%, state-as-filter refactor +17%). Per-category floors are now hardcoded — any category regressing >5% below baseline fails the suite.
Operator-integration surface — tests/e2e/ covers what the retrieval suite doesn't:
- Scope gate as security boundary (
test_scope_boundary.py, 45 assertions) — 14 adversarial variants (suffix-confusion, IPv6-mapped IPv4, credentials-injection, IDN/punycode, wildcard depth, trailing-dot, mixed-case, deny-wins) + fail-closed invariant (engagement-state.sh init refuses OUT-OF-SCOPE targets when --scope-check <SCOPE.md> is passed or .t3mp3st/SCOPE.md is discoverable; exit code 4).
- Agent portability + provenance (
test_agent_portability.py, 255 assertions) — fresh sync / corrupt / delete / manifest self-consistency. Every hunter's declared requires_scripts + requires_references verified against the repo — dead links caught before hunter dispatch.
- Full
/mad-hunt pipeline walk (test_engagement_e2e.py, 65 assertions) — deterministic synthetic chain: scope → state → recon → classifier → intelligence recall → exhausted-not-prioritized → hypothesis-surfaced → evidence-captured → verifier-input → report-input → brain-learns. Every hop asserts its contract.
- Combined: 414+ assertions across retrieval + state + operator + portability. Runs in ~90 s.
bash tests/run-all.sh.
MCP integration (auto-detected)
- Burp Suite MCP — every specialist hunter runs
ToolSearch("burp proxy repeater intruder collaborator") at dispatch; if present, Repeater = primary probe channel + Collaborator = primary OOB backend. Register: claude mcp add burp ... (recipe: references/burp-integration.md).
- dalfox v3 MCP — 6-tool stdio server (
scan_with_dalfox, get_results_dalfox, list_scans_dalfox, cancel_scan_dalfox, delete_scan_dalfox, preflight_dalfox). xss-hunter prefers when loaded. Register: claude mcp add dalfox -- dalfox mcp. Guide: references/dalfox-guide.md.
- writeup-search MCP — search 6,749-row corpus (23 CoffinXP full-body + 6,554 pentester.land + 172 fresh RSS). See "Writeup corpus" below.
- bounty-platforms MCP — H1/Bugcrowd/Immunefi/YesWeHack scope + policy + hacktivity + submit + draft-report tools.
- ruflo MCP (optional cache) — after
bash scripts/brain-sync-ruflo.sh --from-registry, use mcp__ruflo__memory_import_claude to populate a semantic cache namespaced "mad-hacks". Provenance timestamps make staleness detectable. Never a source of truth; the file-brain is.
Bootstrap (reproducibility)
The 55 hunter+operator agents live at agents/{hunters,operators}/ (repo-canonical) with sha256 anchors in agents/manifest.json. Fresh clone → live runtime in two commands:
python3 scripts/agents-manifest.py # regenerate manifest if any agent edited
bash scripts/agents-sync.sh # sync repo agents into ~/.claude/agents/
bash scripts/agents-verify.sh # confirm installed sha256s match manifest (read-only)
The verify contract: git checkout + agents-sync → same mad-Hacks behavior on any machine. agents-verify.sh --strict fails on any drift (missing agent, sha256 mismatch, unsatisfied requires_scripts/requires_references). Suite test_agent_portability.py exercises fresh-sync / corrupt / delete / manifest self-consistency (255 assertions).
An effective run (concrete)
# 0. Authorization
bash scripts/scope.sh init <target>
bash scripts/preflight.sh <target>
# 1. Engagement state — capture what you know before probing
bash scripts/engagement-state.sh init <target> --tech "Next.js 14 App Router on Vercel Edge, Postgres, Cloudflare, defaults"
bash scripts/engagement-state.sh observe <target> "webhook /api/hook accepts url= param"
bash scripts/engagement-state.sh hypothesis <target> add "SSRF via redirect chain to internal ELB" --priority high
# 2. Intelligence router — single query surface
bash scripts/intelligence-recall.sh "webhook ssrf redirect chain" --target <target> --class ssrf --limit 12
# Returns: fused lexical + semantic + writeups + target-memory bundle
# (agents call this instead of the old 3-way brain.sh chain)
# 3. Pick the right entry point
/mad-hunt <target> # bounty
/cdc-research <target> # research
# (both drive specialist hunters whose Preflight preambles auto-run steps 2+3)
# 4. Blind classes seed OOB attribution
bash scripts/oob.sh seed <target> ssrf webhook-url-param
# 5. Capture back (mandatory after every dispatch)
bash scripts/engagement-state.sh evidence <target> add \
--observation "server responded 500 'connection refused' on http://169.254.169.254" \
--evidence "evidence/ssrf-imds.txt" \
--interpretation "backend can reach IMDS host but v1 is blocked" \
--hypothesis "IMDSv2 enabled — need token flow" \
--epistemic DERIVED --confidence HIGH
bash scripts/engagement-state.sh exhausted <target> ssrf url_parameter direct-metadata "IMDSv1 blocked — v2 token flow required"
bash scripts/brain.sh learn "IMDSv2 blocked → probe v2 token flow via PUT before assuming SSRF is dead"
# 6. End-of-session
# write .t3mp3st/<target>/HANDOFF.md per references/engagement-handoff.md
bash scripts/refresh-writeup-feeds.sh # optional — pull fresh RSS entries
bash scripts/build-registry.py # optional — refresh the index if you added lessons/tools
Writeup corpus (writeup-search MCP data source)
bash scripts/build-writeup-corpus.sh # base corpus: 23 CoffinXP + 6,554 pentester.land
bash scripts/refresh-writeup-feeds.sh # +11 RSS feeds (PortSwigger/Datadog/samcurry/Medium tags/…)
# dedupes on source URL, cron-friendly, --dry-run flag
pkill -f mcp-writeup-server # Claude Code auto-respawns w/ fresh DB (or /mcp reconnect)
Corpus lives at ~/.local/share/pentest-writeups/metadata.db (SQLite). Tools available after reconnect: search_writeups (keyword search across full text + metadata), search_techniques (per-class technique packs), search_payloads (context-organized payload pack + mutation matrix + detection ladder), get_writeup. Source catalog: references/writeup-sources.md. The intelligence router queries this alongside the registry.
Pack integration contract (enforced by pre-commit)
Every pack under packs/ MUST satisfy this 4-link chain, or carry an escape-hatch marker:
UPSTREAM.md row → router.md route → EXTRACTION.md manifest → pack-index.jsonl entry
(or .vendored) (or .internal) (mandatory) (mandatory)
Markers a pack can carry:
.vendored — pack is mad-hacks-native or historically vendored; skips the UPSTREAM check.internal — pack is routing-agnostic infrastructure; skips the router check.deprecated — pack is queued for removal; skips all checks
Enforcement:
bash scripts/verify-packs.sh --report # human-readable table + summary (exit 0)
bash scripts/verify-packs.sh --strict # exit 1 if ANY pack breaks the chain (pre-commit gate)
bash scripts/verify-packs.sh --json # one JSON row per pack, machine-readable
The pre-commit hook (.githooks/pre-commit, wired via git config core.hooksPath .githooks) runs --strict on every commit. Bypasses require explicit --no-verify and are discouraged.
A/B per-pack impact eval
Every atomic record in brain/{lessons,patterns,tools}.jsonl carries source_pack. The A/B mechanism masks a pack and measures the retrieval delta:
# One-off: query with a pack excluded
MADHACKS_BRAIN_EXCLUDE=xalgorix bash scripts/brain.sh recall-class workflow
# Automated per-pack scorecard against the 24-query reference set
bash scripts/pack-eval.sh --report
Contribution score = (records_surfaced_with - records_surfaced_without) / records_with * 100%. High score = pack is uniquely load-bearing. Zero = pack is redundant (other packs cover the same classes). Reference queries live at brain/eval/reference-queries.jsonl — stable set; changing it invalidates historical scores.
Retrieval attribution is logged to brain/telemetry/retrievals.jsonl (session-local, gitignored) — every recall-class/search that surfaces a JSONL record appends {ts, subcmd, query, record_type, record_id, source_pack}. Aggregate over multiple hunts to close the loop from retrieval-hit → confirmed-finding per pack.
Feed it more (it compounds)
bash scripts/ingest.sh <repo-or-file> # classify + propose merges (read-only)
bash scripts/brain.sh recall <target> # target-specific memory
bash scripts/brain.sh recall-class <class> # class-relevant lessons + patterns (JSONL-aware)
bash scripts/brain.sh search "<query>" # hybrid FTS5 + JSONL grep across the registry
bash scripts/brain.sh registry [--rebuild] # regenerate assets.jsonl + FTS index
bash scripts/brain.sh payload <class> <file> # wordlists/payloads → brain (deduped)
bash scripts/brain.sh tool "<name> — <use>" # tools learned — prose (append-only)
bash scripts/brain.sh learn "<heuristic>" # reusable lessons — prose (append-only)
bash scripts/optimize.sh [--aggressive] # keep storage lean
When ingesting a new pack (the full contract):
# 1. Clone the pack under packs/<name>/ (add row to UPSTREAM.md with URL + pinned SHA)
# 2. Classify what it contributes (read-only proposal)
bash scripts/ingest.sh packs/<name>/
# 3. Extract atomic records into the JSONL SPOTs — DO NOT write prose summaries
# Append to brain/lessons.jsonl, brain/patterns.jsonl, brain/tools.jsonl
# Each record carries source_pack:"<name>" for retrieval attribution
# 4. Write the extraction manifest (contract)
cp packs/EXTRACTION.md.template packs/<name>/EXTRACTION.md # then fill in the sections
# 5. Add the pack-index row (append one line to brain/registry/pack-index.jsonl)
# 6. Verify the chain passes
bash scripts/verify-packs.sh --strict
# 7. Measure impact (must move the needle on ≥1 reference query)
bash scripts/pack-eval.sh --report | grep <name>
Methodology docs & reports go in packs/. Externally-cloned packs are .gitignored except their EXTRACTION.md + integration markers — rehydrate on a fresh clone via bash scripts/reinstall-packs.sh (upstream URLs + pinned commits in packs/UPSTREAM.md).
Session handoff (end-of-day)
Write .t3mp3st/<target>/HANDOFF.md per references/engagement-handoff.md — under 100 lines, findings-by-id, coverage tested/skipped/partial, open threads, ordered next-steps. Next session opens with cat HANDOFF.md + bash scripts/engagement-state.sh recall <target>.
Authorized use only
Point it only at systems you own or have explicit written permission to test. scripts/scope.sh records the receipt; preflight.sh gates on it. A tool working is never consent.
