What problem does it solve? Authorized black-box Web/API/CTF assessments often stall because scattered scanner hits, browser traffic, and fingerprints never become a coherent plan. This Skill turns recorded case evidence into an auditable, ranked queue of next validation steps and decides which specialist vulnerability Skill applies. ## Core Features & Use Cases - Evidence-driven routing: An offline router (next_action.py) scores candidate routes against observed signals, required capabilities, and prior attempts, suppressing disproven hypotheses instead of rescanning. - Scope and authorization gates: Every route requires declared authorization and locked scope; missing prerequisites produce WAIT or NEEDS_OPERATOR decisions rather than attack actions. - Specialist Skill dispatch: Maps signals to existing hunt-* Skills (IDOR, SSRF, XSS, SQLi, OAuth, file attacks, and more) with oracles, stop conditions, and chain-review rules that prevent treating RCE as a default goal. - Use Case: During an authorized web assessment, you record baseline observations in a case-state JSON, run the router, and receive the top three testable hypotheses with the exact specialist Skill, tool order, oracle, and stop conditions for each. ## Quick Start Ask the agent to run the blackbox-vuln-orchestrator on your authorized case-state JSON file and output the ranked next-action plan in Markdown.
