Get started with vulnerability review through a guided practice target, from threat modeling to scanning and triage. Ask questions about the pipeline and receive answers grounded in its documentation and source, with references and a next command.
中文简介正在准备中。当前显示英语简介。
The front door for this repo. With no argument: a 30-second intro, then an offer to walk you through your first run on the canary target. With a question: answers it from this repo's own docs and source, cites where it looked, and hands you the next command. Use for "how do I…", "why does…", "where is…", "can this…", or just "/quickstart" to get oriented.
安装前可以查看交给 AI 代理的指令内容。
Two modes, picked by whether $ARGUMENTS is empty.
$ARGUMENTS as the operator's question.Keep it short and a little warm; this is the first thing a new operator sees.
Say roughly:
Welcome! This repo takes you from finding your first vulnerability to patching at scale, using a set of Claude Code skills and an autonomous pipeline. Two ways in: interactive skills (no setup, safe, start here) and the autonomous pipeline (Docker, scales to hundreds of parallel agents).
The ramp-up:
| Day 1 | Threat-model + first static scan + triage | | Day 2 | Run the reference pipeline (C/C++) | | Day 3-4 | Customize it for your stack | | Week 2 | Autonomous scanning, triage, and patching |
Day-1 goal: threat-model, scan, and triage the bundled canary target. Most teams get there before lunch.
Remind them to export CLAUDE_CODE_SUBAGENT_MODEL=<model-id> so subagents
use the same model as the session.
Then AskUserQuestion with three options:
README.md Step 1 and stop.Runs the three Step-1 skills on targets/canary, pausing after each to show
what landed on disk. These only read/write files in the repo; no sandbox
needed.
/threat-model bootstrap targets/canary via Task. When done, open
THREAT_MODEL.md, show the focus areas, explain in 2-3 sentences how
this steers the scan./vuln-scan targets/canary via Task. When done, open
targets/canary/VULN-FINDINGS.md, summarize the count and top 2-3
findings, point at VULN-FINDINGS.json./triage targets/canary/VULN-FINDINGS.json via Task. When done, open
TRIAGE.md, explain what changed vs. raw findings (verified, deduped,
re-ranked).Pause for the operator between each (AskUserQuestion); don't barrel through.
Close with a one-line recap of the three artifacts on disk, then point at
README Step 2 for the execution-verified pipeline. Never run vuln-pipeline
or anything that executes target code here; that's Step 2 and needs
Docker + a sandbox.
Answer the operator's question using this repo as ground truth: README,
docs/*.md, harness/*.py, dnr_harness/*.py, targets/*/config.yaml,
.claude/skills/*.
Don't answer from general knowledge when the repo has a specific answer.
| If the question is about… | Read first | Then offer |
|---|---|---|
| running the pipeline | docs/pipeline.md, README Step 2 | the recon / run command |
| too many findings, triage | docs/triage.md | /triage <path> |
| porting, Java/Go/Rust/etc. | docs/customizing.md, README Step 3 | /customize |
| safety, sandbox, Docker | docs/security.md | cite; no action |
| rate limits, 429, token budget | docs/pipeline.md: Rate limits, docs/troubleshooting.md#rate-limits | cite the numbers |
| duplicates, dedup | docs/troubleshooting.md#duplicate-findings | known_bugs: hint |
| CLI flags, "what does --X do" | harness/cli.py (grep the argparse) | exact flag + example |
| which model, subagent pinning | docs/troubleshooting.md: Subagents | the export line |
| best practices, prompting | docs/best-practices.md, docs/prompting.md | cite the principle |
| threat model, attack surface, scope | docs/threat-model.md | /threat-model bootstrap <target-dir> |
| scan, audit, find vulns | .claude/skills/vuln-scan/SKILL.md | /vuln-scan <target-dir> |
| "how do I start" | README Step 1 | offer Guided first run |
| patching, fix, diff, re-attack | docs/patching.md, README Step 4 | /patch <input> |
| threat hunting, incident response, logs | docs/detection-response.md | /dnr-hunt or /dnr-respond |
| autonomous D&R, dnrcanary | docs/detection-response.md, targets/dnrcanary/README.md | the dnr-pipeline run command |
| binary, embedded, other domains | docs/other-use-cases.md | cite section |
| anything else | README Table of contents | best-match doc |
> source: the file(s) and section you used.Grep for it in
harness/cli.py or the target configs and quote what you find.还没有评价。欢迎分享你的使用感受。
无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
Adapt a C/C++ vulnerability pipeline to another language, target, or detection method. The workflow gathers requirements, proposes file changes for approval, updates the implementation, and validates it against a test target containing known bugs.
中文简介正在准备中。当前显示英语简介。
Hunt for signs of compromise in web and application logs without an initial alert. Establish normal activity, record investigative hypotheses, check source code, and reproduce issues locally before producing incident records and a report.
中文简介正在准备中。当前显示英语简介。
Investigate an alert or suspicious identifier using logs and source code. Assess attack success, measure affected data and users, test the suspected flaw locally, and produce a response plan for human review and execution.
中文简介正在准备中。当前显示英语简介。
Turn security findings into candidate code fixes with review results and summaries. Depending on the input, use independent source review or a pipeline with execution checks, then provide diffs for a person to review and apply.
中文简介正在准备中。当前显示英语简介。
Build a threat model that identifies valuable assets, attack entry points, potential threats, and mitigation priorities. Use source code and past vulnerabilities, an interview with the application owner, or a combination of both.
中文简介正在准备中。当前显示英语简介。
Turn raw security findings into a ranked list for engineering review. Check claims against source code, merge duplicates, assess how feasible exploitation is, and assign component owners, with results in JSON and Markdown.
中文简介正在准备中。当前显示英语简介。