headless-mode

Automate unattended API hypothesis testing with stealth delays and logging.

Updated Aug 23, 2026

Search Tags:#automation #api-testing #headless #hypothesis #curl #security-testing #bug-bounty

Ready to run

npx skills add https://github.com/AshtonVaughan/bountyhound --skill headless-mode

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: headless-mode
Source: https://github.com/AshtonVaughan/bountyhound/tree/main/bountyhound/skills/headless-mode
Command: npx skills add https://github.com/AshtonVaughan/bountyhound --skill headless-mode

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Overnight unattended API-based hypothesis testing to run curl/HTTP tests while you sleep.

Core Features & Use Cases

Automated manifests: generate structured test manifests and execute them sequentially.
Stealthy execution: run tests with configured delays to avoid detection and throttle requests.
Comprehensive results: log full request/response data for review and reporting.

Quick Start

Configure credentials for test accounts, then start automated headless testing using the manifest format.

Frequently Asked Questions about headless-mode

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate unattended API testing for bug bounty programs?▼

You automate unattended API testing by generating structured test manifests that execute sequentially with configured stealth delays. This allows curl and HTTP tests to run overnight, logging full request and response data for later review.

Can I run curl HTTP tests overnight while avoiding detection?▼

Yes, you can run curl HTTP tests overnight while avoiding detection by applying configured stealth delays between requests. This throttles testing speed to prevent detection during authorized bug bounty engagements.

What is headless hypothesis testing and when do I need it?▼

Headless hypothesis testing is the automated, unattended execution of API tests structured around specific security hypotheses. You need it for authorized bug bounty programs to continuously validate vulnerabilities without manual intervention.

How do I log full request and response data for API security testing?▼

You log full request and response data for API security testing by executing automated test manifests. The execution loop processes hypotheses sequentially and automatically records comprehensive results for reporting.

Does this automated testing approach require manual script configuration?▼

The automated testing approach supports optional scripts within its execution loop, alongside references and assets. You configure credentials for test accounts and define the manifest format to start headless testing.

What are the limitations of using stealth delays for unattended API testing?▼

The primary limitation of using stealth delays for unattended API testing is increased execution time, as throttling requests to avoid detection slows down the sequential processing of test manifests during bug bounty engagements.