## TL;DR
Hydra prints found credentials as individual per-attempt lines ("host ... login - ... password - ...") and also prints a summary line that agents misread as the authoritative result. Parse the per-attempt found lines, not the summary. Run hydra with -o to a file, grep the found-credential pattern, and report each hit with its host, login, and service.

```text
agent failed to parse hydra result file, marking valid credentials as failed
```

## Use this when
- Hydra's output file contains found-credential lines but your agent reported zero valid credentials.
- Your agent read the "0 of 1 target successfully completed" style summary and stopped there.
- You run authorized credential tests against lab accounts or client-approved test credentials.

## Not for this skill when
- Hydra found nothing. Then the output file has no found-credential lines and the agent is correct.
- The task involves credentials you are not authorized to test. This skill is for authorized engagements and labs only.
- Hydra crashed before writing output. That is a crash issue, not a parsing issue.

## Steps
1. Search the output file for hydra's found-credential pattern: lines containing the service in brackets followed by login and password fields. Verify: the grep count is greater than zero while the agent reported zero.
2. Confirm each hit is a real find, not a retry or error line: real hits carry the bracketed service tag and a host field. Verify: every extracted line has all four parts (service, host, login, password).
3. Fix the agent parser: match the found-credential line pattern and collect host, login, and password groups; ignore the summary line entirely. Verify: the parser's hit count equals the grep count.
4. Cross-check against the authorized credential list for the engagement so test-account hits are labeled as expected. Verify: no hit references an account outside the engagement's credential scope.
5. Store hits in the findings file immediately, with the hydra command line and timestamp. Verify: a second parser run on the same file returns the identical list.

## Variant phrasings
### hydra found password but agent reports none
Symptom-level search.
### parse hydra output file for valid logins
Workflow phrasing.
### agent misreads hydra summary line
Same failure, different angle.

Compatibility: Hydra 9.x output format. The found-credential line format has been stable across 9.x.

## Why it happens
Hydra's summary line counts targets and valid passwords in a phrasing that reads like a final verdict, so agents treat it as the result and never look at the per-attempt lines where the actual hits live. The summary is a progress statement, not the findings list.

## Edge cases / pitfalls
- Restore files (-R) and partial runs can contain duplicate hit lines from retried attempts. Dedupe on host plus login plus service before reporting.
- Some services print extra status lines that resemble hit lines. Require the bracketed service tag and all fields before counting a hit.
- Handle found credentials as sensitive material: the findings file lives in the engagement workspace, never in a shared log.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_e-_qjaAP-QQv_PLGSxdFOQ