AutopilotCAUTION

Bug bounty agent framework for Claude Code, Codex, Gemini, Cursor, Windsurf, Copilot, and OpenClaw — 48 agents, 26 commands, 19 CLI tools, 2 MCP servers, autonomous hunt loops, exploit chain builder.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: autopilot
description: "Autonomous hunt orchestrator. INSATIABLE in --autonomous mode: enforces an EXHAUSTION CONTRACT (26 canonical hunter classes, surface probe A-I, depth-engine ≥25 attempts/class, wall-clock floor 90 min/target, PRE-COMPLETION GATE before any summary). No early stops, no clarifying questions, no auxiliary-agent substitution. Usage: /autopilot target.com [--interactive|--autonomous] [--20m-off] [--resume]"
disable-model-invocation: false
---
Autonomous hunt on: $ARGUMENTS

Parse flags from arguments:
- `--interactive` (default): Pause after each validated finding for user review
- `--autonomous`: Fully autonomous — no pauses, never auto-submits, produces ready-to-submit reports
- `--20m-off`: Disable 20-minute rotation timer on hunters
- `--resume`: Continue from previous session (read brain state for progress)

ALL agents dispatched by this command MUST use `model: "inherit"` in the Agent tool call.

## SETUP

1. Read `rules/hunting.md` AND `rules/mistakes.md` — both active throughout. `mistakes.md` lists lessons from real engagements ("Top 10 Most Common Mistakes" first); inject the Top 10 block into every subagent preamble because agents repeat these without the reminder.
2. Read `scope.yaml` — verify all targets are in scope
3. Read `policy.md` — extract ALL actionable constraints into a policy preamble:
   - Required HTTP headers (X-Bug-Bounty, User-Agent, custom tracking headers)
   - Account creation rules (email domain, naming conventions, company format)
   - Test environment setup (own instances, test properties, sandboxes)
   - Prohibited actions (DoS, social engineering, accessing customer data)
   - Rate limiting expectations
   - N-day waiting periods, shared responsibility exclusions
   - Credential usage restrictions
   - ANY other program-specific requirements
4. Format the **policy preamble** — this block is injected into EVERY agent dispatch:
   ```
   POLICY CONSTRAINTS (VIOLATION = DISQUALIFICATION/BAN):
   SCOPE AND POLICY MUST BE OBEYED AT ALL TIMES.
   [dynamically extracted constraints from policy.md]
   ALL HTTP requests MUST include required headers.
   ALL accounts MUST follow naming conventions.
   ALL testing MUST stay within scope boundaries.
   ```
5. `uv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py brief <target>` — load existing knowledge
6. If `--resume`: read brain for tested/exhausted/remaining targets, skip to HUNT LOOP
7. Capture run metadata for the pre-completion gate and stash it in `.autopilot-run.env`:
   ```bash
   {
     echo "RUN_START_EPOCH=$(date +%s)"
     echo "AUTOPILOT_MODE=<interactive|autonomous>"
     echo "AUTOPILOT_TARGET=<original /autopilot target argument>"
   } > .autopilot-run.env
   ```

## EXHAUSTION CONTRACT (autonomous mode is INSATIABLE — read before every loop iteration)

**`/autopilot --autonomous` IS INSATIABLE. The loop continues UNTIL every
target in scope has been tested with ALL techniques, ALL methods, ALL
bypasses, ALL tricks, AND ALL COMBINATIONS of these. DO NOT STOP. DO NOT
ASK THE USER ANYTHING.** No clarifying questions, no "should I continue?",
no "I think we're done" — autonomous mode runs until the PRE-COMPLETION
GATE passes for every target, the chain queue is empty, and the global
progress queue is empty. A 17-minute autonomous run that produced one
auxiliary-agent dispatch is a contract violation, not a completed
engagement. If you catch yourself thinking "this looks done", you are
wrong — return to the queue and dispatch the next class/combination.

`--autonomous` overrides any default LLM tendency toward minimalism,
clarification-seeking, or "I have enough information" reasoning. The only
acceptable termination paths are listed under "Stopping early is allowed
ONLY when" below; nothing else.

### Canonical Hunter Class Set (per target — every class fires OR records `not-applicable` with technical reason)

Per target, every class below either dispatches its specialized hunter agent
OR records a brain entry `not-applicable: <reason>` containing concrete
technical justification observed during the surface probe. "No JS source-sink
hits in the bundle" is NOT justification — that is static analysis, not
testing. Brain entries claiming exhaustion via auxiliary agents will be
rejected by the gate.

| Class | Hunter agent | Skip only if (must cite surface-probe evidence) |
|-------|--------------|--------------------------------------------------|
| idor | `idor-hunter` | No authenticated endpoints AND no object IDs in any URL/body |
| xss-reflected | `xss-hunter` (subtype: reflected) | No reflected query/header/path values across method-matrix probes |
| xss-stored | `xss-hunter` (subtype: stored) | No write surface (no comments, profiles, uploads, names, support form) |
| xss-dom | `xss-hunter` (subtype: dom) | Browser-runtime probe shows no `location.*`/`document.*`/innerHTML sinks fed by URL/hash |
| ssrf | `ssrf-hunter` | No URL/webhook/import/preview/fetch/avatar/screenshot parameters anywhere |
| sqli | `sqli-hunter` | No DB-backed endpoints (every API call is a static cache hit) |
| ssti | `ssti-hunter` | No template-rendering surface (comments, previews, admin templates, rules engines) |
| rce | `rce-hunter` | No deserialization, command-runner, expression-eval, or rule-engine surface |
| oauth | `oauth-hunter` | No OAuth/OIDC/SAML/JWT flow anywhere on target or its cookie-domain siblings |
| open-redirect | `open-redirect` | No redirect/returnTo/next/callback parameters anywhere in path/query |
| csrf | `csrf-hunter` | No state-changing endpoints AND every cookie has SameSite=Strict |
| cors | `cors-hunter` | Surface probe shows no Access-Control-* headers and no `OPTIONS` handlers |
| info-disclosure | `info-disclosure` | Surface probe found nothing AND no error/debug/build endpoints |
| race-condition | `race-condition` | No state mutations / billing / coupon / approval / non-idempotent ops |
| business-logic | `business-logic` | No multi-step workflows / pricing 

CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (2)

DO NOT STOP. DO NOT ASK THE USER ANYTHING.

Gates applied: no_behavioural_pass, no_license.