☢ VULNPOCALYPSE
PORTABLE AGENT WORKFLOW // LOCAL EXECUTION ONLY

ARM IT ONCE.
KEEP THE HUMAN
IN COMMAND.

Use the coding harness you already know. Install one project-local skill, prove the draft-only connection, then start with a bounded mapping prompt.

JOIN BEFORE CONNECTINGClaim the human session and separate credentials at /join.
01 // CHOOSE

USE YOUR
EXISTING HARNESS.

Codex is used in the live demo, not required. Do not burn hunt time switching tools. All four load the same SKILL.md, call the same draft API, and stop at the same human gate.

LIVE DEMO

CODEX

PROJECT PATH .agents/skills/vulnpocalypse-hunter FIRST INVOCATION $vulnpocalypse-hunter

Launch Codex inside the target repository. Keep normal approvals and sandbox boundaries enabled.

SUPPORTED

CLAUDE CODE

PROJECT PATH .claude/skills/vulnpocalypse-hunter FIRST INVOCATION Use the vulnpocalypse-hunter skill.

Keep approval prompts enabled and work only inside the selected target repository.

SUPPORTED

OPENCODE

PROJECT PATH .agents/skills/vulnpocalypse-hunter FIRST INVOCATION Load the vulnpocalypse-hunter skill.

The native skill tool discovers this portable path. Keep shell and external-directory permissions bounded.

SUPPORTED

PI

PROJECT PATH .agents/skills/vulnpocalypse-hunter FIRST INVOCATION /skill:vulnpocalypse-hunter

Automatic discovery also works. Keep the session history and work only in the target workspace.

PORTABLE DEFAULT: .agents/skills works for Codex, OpenCode, and Pi. Claude Code uses .claude/skills.

02 // INSTALL

DROP ONE FOLDER.
NOT A GLOBAL PROMPT.

Download and extract vulnpocalypse-hunter into the project path for your harness. Confirm the resulting folder contains SKILL.md, scripts/, references/, and assets/.

DOWNLOAD SKILL ZIP ↓
03 // CONNECT

ENVIRONMENT ONLY.
NEVER THE REPOSITORY.

Use only the draft-scoped vp_… token. Never place the separate vr_… browser recovery code in a shell, prompt, file, agent history, or repository.

macOS / Linux shell 
export VULNPOCALYPSE_API_URL="https://rtv.0-days.com"
export VULNPOCALYPSE_TOKEN="vp_…"
Windows PowerShell 
$env:VULNPOCALYPSE_API_URL="https://rtv.0-days.com"
$env:VULNPOCALYPSE_TOKEN="vp_…"
04 // CHECK

PROVE THE WIRE.
CREATE NOTHING.

From inside the extracted vulnpocalypse-hunter folder:

python scripts/vuln_api.py check

If python is unavailable, try python3 or py -3.

05 // HUNT

MAP FIRST.
TEST SECOND.

Open the authenticated target manifest, then start with a planning-only prompt. The agent may prepare a private draft only after you approve the complete JSON. The downloaded skill applies the same weak-versus-reviewable gates in references/EVIDENCE.md. Only your browser can submit it.

Use the vulnpocalypse-hunter skill.
Read the selected target manifest, map the attack surface,
and rank no more than five source-specific hypotheses.
Do not run a test yet.
OPEN THE FULL PROMPT CONSOLE OPEN EVIDENCE UPGRADES
AGENT GETSvp_… draft token · target manifest · synthetic data
HUMAN KEEPSvr_… recovery code · judgment · final submission
NEITHER DOESDoS · destructive tests · vendor contact · publication
06 // AFTER

KEEP HUNTING.
NO EVENT REQUIRED.

DEF CON ends; the loop does not have to. hunter-loop is the take-home edition of this same HUNTER methodology and evidence gates with the event stripped out: no VULNPOCALYPSE_API_URL, no token, no submission. You name your own authorized scope—your own system, a bug bounty program's published scope, or a signed engagement—and it writes a local Markdown report that you review and hand to a maintainer yourself, on your own timeline.

DOWNLOAD HUNTER-LOOP ZIP ↓