DEDUPED Hot AI repos, turned into use cases Get 5 a day

How to retest a fixed vulnerability and record whether it still reproduces with Autonomous Pentest Agent

Start a retest on one finding and get a result of still reproducible, fixed, or cannot confirm.

Authorization notice. Autonomous Pentest Agent is dual-use. Only use it on software, sites and systems you own or have explicit permission to test.

Who it is forA security reviewer checking whether a developer fixed a finding from an earlier task.

The problemConfirming a fix usually means rerunning the whole scan, which is slow and can change the original task.

The outcomeA retest session with a verdict, evidence, and a link to the session, saved in the finding details.

What you need first

  • A PostgreSQL database, or Docker so the install script can start one
  • An LLM API key: ANTHROPIC_API_KEY or OPENAI_API_KEY, or the key entered later in the UI's LLM 配置 page
  • Docker for the one-click install path, or the Go toolchain and Node.js for a local build from source
  • Written authorization to test the target systems

Steps

  1. Open the task detail page and select the 复测 tab.
  2. Find the finding in the list and click 复测, or open the finding and click 发起复测 in the 漏洞复测 area.
  3. Enter the fixed version and any test conditions or limits, then start the retest.
  4. Wait for the 复测中 status to finish and open the session link to read the evidence.
  5. Check the verdict: 仍可复现, 已修复, or 无法确认.

Prompt for your agent

Using the repo kutukam/autonomous-pentest-agent, start a retest for finding <finding-id> in task <task-id> with the fixed version <version>. Report the verdict and the session link. Verify that the verdict and the evidence are saved in the finding details before you close the task.

Caveat. A retest sends live traffic to the target again, so run it only on systems you are authorized to test and that are safe to probe.

Share: X LinkedIn Hacker News Email Copy link

Disclaimer

Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked "Seen in the wild", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email [email protected] and we will look at it promptly. Full disclaimer page