hackthebox
starsforks
How to install hackthebox?
transilienceai/communitytools/hackthebox
$npx -y skills add transilienceai/communitytools --skill hacktheboxHackTheBox platform operations and automations to solve challenges, machines and capture the flags hacking competitions
SKILL.md
| 1 | ## Workflow |
| 2 | - [workflow.md](reference/workflow.md) — Complete workflow with commands. Read this for each step |
| 3 | |
| 4 | ### Steps |
| 5 | 1. Get Credentials — `python3 .claude/tools/env-reader.py HTB_USER HTB_PASS HTB_TOKEN ANTHROPIC_API_KEY SLACK_BOT_TOKEN HTB_SLACK_CHANNEL_ID` |
| 6 | 2. Only for "Machine" kind of competition -> Verify vpn is running, otherwise download the vpn file from the platform and instruct the user on how to enable it |
| 7 | 3. Generate output dirs — `mkdir -p YYMMDD_<name>/{recon,findings,logs,artifacts,tools,reports}` for each challenge. **Do not seed `attack-chain.md` or `experiments.md` from the orchestrator** — those are the coordinator subagent's first action (see `skills/coordination/reference/spawning-recipes.md`). |
| 8 | 4. To achieve the tasks given by the user, when possible use the HTB_TOKEN, otherwise login to the platform using playwright at https://account.hackthebox.com/login and fill the login form with the HTB_USER and HTB_PASS |
| 9 | 5. If necessary, start the machines |
| 10 | 6. If necessary, check network connectivity to the machines |
| 11 | 7. Spawn coordinator subagent per target — `Agent(name="coordinator-{tag}", run_in_background=True, ...)` per `spawning-recipes.md`. **Never run the P0-P6 coordinator workflow inline in the orchestrator session** — the bookkeeping discipline (attack-chain.md, experiments.md, goal_attempts counting, mandatory skeptic at experiments 5/15/25) requires the subagent boundary. Max N concurrent agents, queue-based spawning. |
| 12 | 8. Post-solve Phase 3 — parent orchestrator (not coordinator) always runs `/skill-update` + Slack after each coordinator returns its PHASE3_SUMMARY (see workflow.md step 8) |
| 13 | |
| 14 | ## References |
| 15 | - [workflow.md](reference/workflow.md) — Workflow overview with credentials, VPN, setup, and coordinator spawn |
| 16 | - [spawning-recipes.md](../coordination/reference/spawning-recipes.md) — Coordinator agent spawn prompt templates (exploitation, flag submission, completion report, stats) |
| 17 | - [completion-report-schema.md](../../formats/htb-completion-report.md) — Challenge completion report structure & template |
| 18 | - [slack-notifications.md](reference/slack-notifications.md) — Slack completion notification format & examples |
| 19 | - [platform-navigation.md](reference/platform-navigation.md) — Platform site navigation guide |
| 20 | - [vpn-pool-routing.md](reference/vpn-pool-routing.md) — VPN pool isolation. Pre-flight check before spawning any machine (release_arena vs dedivip_lab vs others) |
| 21 | - [vpn-setup.md](reference/vpn-setup.md) — VPN connectivity troubleshooting |
| 22 | - [anti-bot-bypass.md](../reconnaissance/reference/anti-bot-bypass.md) — Cloudflare/Turnstile detection evasion |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
