HACKBOTS - Using Agent Frameworks

Jason Haddix opens by defining hackbots as offensive security automation, with a focus on dynamic black-box testing such as web application reconnaissance. He describes an agent he built for himself that ran against a bug bounty program over several hours and produced multiple critical findings. Modern agent harnesses now let practitioners define agents as markdown skills instead of writing orchestration code, which lowers the barrier to building them.

The core of the talk is method. Before writing a skill, the team maps the expert workflow out, then splits large methodologies into micro-skills, because models tend to skip steps in long checklists. He walks through a JavaScript analysis skill as the example: downloading inline and external scripts, recovering source maps, mining endpoints and parameters, flagging secrets and dangerous sinks, and documenting frameworks. He also covers context engineering. Turning the process into a checklist ledger, adding a separate review pass that rejects incomplete runs, giving concrete examples of good output, and writing exact tool syntax all reduce invented commands and missed steps. Running several models and repeated runs is recommended because outputs vary between runs.

The session ends with a live build of the skill, which was still underway when time ran out. The practical takeaways are to keep skills small, specify output layout and full tool paths, keep output folders outside skill folders to avoid context rot, and read the reasoning traces to find where an agent fails.