> ## Documentation Index
> Fetch the complete documentation index at: https://p-bitm-2269ecee.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# Modules
> Create, review, and execute operator-triggered module payloads.
Modules are operator-triggered HTML and JavaScript payload definitions. They
are stored in the module library and may be assigned to campaigns.
## Library operations
Each module defines a name, description, category, optional icon and link,
input descriptors, and a payload. The backend validates size and shape before
persistence.
Open **Modules** and select **New Module**.
Enter the name, description, category, optional icon and link, and the
inputs the operator must supply.
Add the bounded HTML and JavaScript payload, including deterministic
cleanup for timers, listeners, media resources, and visible UI.
Save the module, then select it in the campaign wizard. It becomes available
to authorized operators for execution on an active selected session.
## Controlled module demonstrations
Each recording below uses synthetic data and a target covered by written
authorization. Treat them as demonstrations of visible behavior and cleanup,
not as operating instructions.
### ClickFix module
### Credential collection module
### Face KYC module
### Network scanner module
The Modules page also supports editing, cloning, exporting, and deleting
library records. The exported JSON is suitable for backup, review, or use as a
source definition. The dashboard does not currently provide a module-import
action.
To ship a reviewed module as a repository seed, add its JSON definition to the
top level of `modules/` before the backend's initial startup. The supplied
Compose files mount that directory at `/modules` and enable seed data. At
startup, P-BitM reads its `*.json` files only when the module library is empty.
If the deployment already contains a module, adding another file to `modules/`
does not import it; re-create that definition with **New Module**.
Module inputs are resolved when an authorized operator executes the module for
a selected active session. The backend wraps visual content in a managed
overlay and supplies cleanup behavior.
## Safety
Modules are active code. Review them for:
* engagement scope and expected user-visible behavior;
* safe parameter handling;
* bounded output;
* campaign-local data submission;
* reliable cleanup;
* absence of hard-coded secrets or unrelated external endpoints.
Do not use library examples as authorization to execute a module. Scope and
operator approval remain external requirements.
See the [module format reference](/reference/module-format).
Developers preparing a reusable seed module or runtime change should also read
[creating and contributing attack vectors](/development/attack-vectors).