hackthebox

Name: hackthebox
Availability: InStock
Author: YukiIto1999

Automate HackTheBox login, machine spawning, challenge runs, and flag submission.

Updated Apr 23, 2026

Search Tags:#automation #api #vpn #playwright #browser #ctf #hackthebox

Ready to run

npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill hackthebox

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hackthebox
Source: https://github.com/YukiIto1999/ctf-sleuth/tree/main/.claude/skills/hackthebox
Command: npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill hackthebox

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Automates HackTheBox platform interactions to login, spawn machines, run challenges, and submit flags.

Core Features & Use Cases

Web automation with headed browsers to bypass Cloudflare Turnstile during HTB login and challenge interactions.
HTB API integration for flag submission, machine management, and challenge metadata.
End-to-end workflow support from credential management to output reporting, including recon, exploitation notes, and completion reporting.
Output scaffolding: per-challenge directories with recon, findings, logs, artifacts, and reports.

Quick Start

Run the sleuth workflow with your input to start an HTB task.

Frequently Asked Questions about hackthebox

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate HackTheBox machine spawning and flag submission?▼

Automate HackTheBox machine spawning and flag submission by using a headed Playwright browser to handle Cloudflare Turnstile during login, combined with an HTB API token for non-UI actions like machine management and flag submission.

How do I bypass Cloudflare Turnstile when automating HTB login?▼

Bypass Cloudflare Turnstile during HTB login by running web automation through a headed Playwright browser, which allows the interactive challenge to resolve naturally while the automation handles credential entry and session management.

Do I need an HTB API token to automate challenges and machines?▼

An HTB API token is required for non-UI actions such as flag submission, machine management, and retrieving challenge metadata, while a headed Playwright browser handles the interactive web workflows.

What is the best way to structure output directories for HTB automation tasks?▼

Structure HTB automation output by scaffolding per-challenge directories that organize recon data, findings, logs, artifacts, and completion reports, enabling end-to-end workflow tracking from initial access to final flag submission.

Can I use browser automation to run end-to-end HTB workflows including VPN setup?▼

Browser automation supports end-to-end HTB workflows including VPN setup, recon, exploitation notes, and completion reporting, requiring a configured environment for VPN access alongside the headed Playwright browser and HTB API token.

Why does HTB automation require a headed browser instead of headless mode?▼

HTB automation requires a headed Playwright browser because headless mode cannot bypass Cloudflare Turnstile, which requires a visible browser environment to process the interactive challenge during login and challenge interactions.