hackthebox
HackTheBox platform operations and automations to solve challenges, machines and capture the flags hacking competitions
- Installs
- 196
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/transilienceai/communitytools --skill hackthebox- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads hackthebox automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Workflow
- workflow.md — Complete workflow with commands. Read this for each step
Steps
- Get Credentials —
python3 .claude/tools/env-reader.py HTB_USER HTB_PASS HTB_TOKEN ANTHROPIC_API_KEY SLACK_BOT_TOKEN HTB_SLACK_CHANNEL_ID - Only for "Machine" kind of competition -> Verify vpn is running, otherwise download the vpn file from the platform and instruct the user on how to enable it
- Generate output dirs —
mkdir -p YYMMDD_<name>/{recon,findings,logs,artifacts,tools,reports}for each challenge. Do not seedattack-chain.mdorexperiments.mdfrom the orchestrator — those are the coordinator subagent's first action (seeskills/coordination/reference/spawning-recipes.md). - To achieve the tasks given by the user, when possible use the HTB_TOKEN, otherwise login to the platform using playwright at https://account.hackthebox.com/login and fill the login form with the HTB_USER and HTB_PASS
- If necessary, start the machines
- If necessary, check network connectivity to the machines
- Spawn coordinator subagent per target —
Agent(name="coordinator-{tag}", run_in_background=True, ...)perspawning-recipes.md. Never run the P0-P6 coordinator workflow inline in the orchestrator session — the bookkeeping discipline (attack-chain.md, experiments.md, goal_attempts counting, mandatory skeptic at experiments 5/15/25) requires the subagent boundary. Max N concurrent agents, queue-based spawning. - Post-solve Phase 3 — parent orchestrator (not coordinator) always runs
/skill-update+ Slack after each coordinator returns its PHASE3_SUMMARY (see workflow.md step 8)
References
- workflow.md — Workflow overview with credentials, VPN, setup, and coordinator spawn
- spawning-recipes.md — Coordinator agent spawn prompt templates (exploitation, flag submission, completion report, stats)
- completion-report-schema.md — Challenge completion report structure & template
- slack-notifications.md — Slack completion notification format & examples
- platform-navigation.md — Platform site navigation guide
- vpn-pool-routing.md — VPN pool isolation. Pre-flight check before spawning any machine (release_arena vs dedivip_lab vs others)
- vpn-setup.md — VPN connectivity troubleshooting
- anti-bot-bypass.md — Cloudflare/Turnstile detection evasion
FAQ
What does the hackthebox skill do?
HackTheBox platform operations and automations to solve challenges, machines and capture the flags hacking competitions
How do I install hackthebox?
Run npx skills add https://github.com/transilienceai/communitytools --skill hackthebox in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/hackthebox/ (personal) or .claude/skills/hackthebox/ (project).
Which AI agents can use hackthebox?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is hackthebox safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains hackthebox?
It is published by transilienceai in transilienceai/communitytools. It has 196 recorded installs.
More from transilienceai/communitytools
attack-path-stitcher
transilienceai/communitytools
Stitches confirmed single-asset findings into multi-hop attack paths across the organization. Builds a graph where nodes are assets and edges are confirmed exploit hops citing the findings that enable them.
blockchain-security
transilienceai/communitytools
Smart contract security testing and blockchain CTF exploitation. Covers Solidity vulnerability analysis, EVM storage manipulation, delegatecall attacks, CREATE/CREATE2 address prediction, and common DeFi exploit patterns. Use when analyzing Solidity contracts, solving blockchain challenges, or testing smart contract security.
hackerone
transilienceai/communitytools
HackerOne bug bounty automation - parses scope CSVs, deploys parallel pentesting agents per asset, validates PoCs, and generates platform-ready submission reports.
osint
transilienceai/communitytools
Open-source intelligence gathering - company repository enumeration, secret scanning, git history analysis, employee footprint, and code exposure discovery.
reconnaissance
transilienceai/communitytools
Open the skill to read its SKILL.md instructions.
cve-poc-generator
transilienceai/communitytools
Open the skill to read its SKILL.md instructions.
Popular other skills
hyperframes-cli
heygen-com/hyperframes
The HyperFrames CLI by job - scaffold, check, look at frames, edit the timeline, preview, render locally or in the cloud, publish, project history - plus reading its JSON and recovering from build or render failures.
triage
mattpocock/skills
Move issues and external PRs through a state machine of triage roles, categorise, verify, grill if needed, and write agent-ready briefs.
ask-matt
mattpocock/skills
Ask which skill or flow fits your situation. A router over the skills in this repo.
to-questionnaire
mattpocock/skills
Turn a decision you can't fully answer into a questionnaire for someone else to fill in.
loop-me
mattpocock/skills
Grill me about specs for the workflows I want to build, within this workspace.