gl1tch0x1/cog-ai

GitHub: gl1tch0x1/cog-ai

一个面向红队和渗透测试的自主攻击型 AI 框架，通过多 Agent 集群和多语言引擎实现从侦察到漏洞验证的自动化安全评估。

Stars: 1 | Forks: 0

SecAgent Logo

**面向红队与安全研究人员的自主攻击型 AI 框架** *工业级动力。精英级智能。任务就绪。* [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT) [![Python 3.11+](https://img.shields.io/badge/python-3.11+-blue.svg)](https://www.python.org/downloads/) [![C++ Core](https://img.shields.io/badge/core-c%2B%2B20-blue.svg)](https://isocpp.org/) [![Rust Core](https://img.shields.io/badge/core-rust-orange.svg)](https://www.rust-lang.org/) [![Go Recon](https://img.shields.io/badge/recon-go-cyan.svg)](https://go.dev/) [![Tests](https://img.shields.io/badge/tests-47%2F47%20passing-brightgreen.svg)](https://github.com/gl1tch0x1/cog-ai) [![Code Style: Ruff](https://img.shields.io/badge/code%20style-ruff-000000.svg)](https://github.com/astral-sh/ruff)

## 目录 - [什么是 SecAgent](#-what-is-secagent) - [核心优势](#-key-differentiators) - [能力矩阵](#-capabilities-matrix) - [综合系统架构](#-comprehensive-system-architecture) - [1. 高层系统拓扑与多语言引擎](#1-high-level-system-topology--polyglot-engine) - [2. 自主扫描生命周期序列](#2-autonomous-scan-lifecycle-sequence) - [3. 多 Agent 集群决策逻辑](#3-multi-agent-swarm-decision-logic) - [4. 多 Provider LLM 故障转移与共识引擎](#4-multi-provider-llm-fallback--consensus-engine) - [快速入门指南](#-quick-start-guide) - [安装指南](#-installation-guide) - [前置条件](#prerequisites) - [方法 1 — 自动化安装引擎（推荐）](#method-1--automated-installation-engine-recommended) - [方法 2 — 手动包安装](#method-2--manual-package-installation) - [发布、部署与包](#-releases-deployments--packages) - [ 发布](#️-releases) - [ 部署模型](#-deployment-models) - [ 包构件](#-package-artifacts) - [配置与操作清单](#-configuration--operational-manifest) - [完整 CLI 使用参考](#-complete-cli-usage-reference) - [子命令规范与标志](#subcommand-specifications--flags) - [交付物示例与模式](#-sample-deliverables--deliverable-schemas) - [1. 管理层 Markdown 交付物](#1-executive-markdown-deliverable) - [2. 机器可读 JSON Schema](#2-machine-readable-json-schema) - [项目目录结构](#-project-directory-layout) - [故障排除与操作指南](#-troubleshooting--operations-guide) - [贡献与安全政策](#-contributing--security-policy) - [许可证](#-license) ## 什么是 SecAgent 传统的漏洞扫描器**僵化、嘈杂且无视上下文。**它们执行静态模式匹配，漏掉复杂的多阶段攻击向量，并用误报淹没安全运营人员，浪费宝贵时间。 **SecAgent 是一个自主的、纯 CLI 的红队与攻击情报框架。** 它作为一个**分布式认知安全引擎**运行——利用专业化的多 Agent AI 集群，像顶级红队操作员一样*推理*攻击面。SecAgent 通过主动的 `httpx` 和 Go 探测识别技术栈，枚举子域名和 HTTP endpoint，精心构造感知上下文的漏洞利用，通过确定性的概念验证验证漏洞，并生成以影响为先、具有相关性的交付物。专为以下人群构建： - 执行全方位自主交战的**红队** - 进行自动化攻击面发现与零日研究的**安全研究人员** - 进行主动侦察和漏洞验证的**Bug Bounty 猎人** - 审计 AI 供应链、prompt injection 和 RAG pipeline 的**攻击型 AI 研究人员** ## 核心优势 1. **纯 CLI 优先架构**：无需臃肿的 Web UI 或复杂的数据库设置。专为无头 VPS 执行、Docker 容器、SSH 会话和 CI/CD pipeline 设计。 2. **多语言性能引擎**：用于并发网络探测的高速 Go 微服务，用于微秒级优先级调度的 Rust，用于 SIMD regex 签名匹配的 C++20，以及用于 LLM 多 Agent 推理的 Python。 3. **Aura 认知记忆引擎**：跨扫描任务的 Target DNA 分层、payload 模式固化、衰减强化机制和 WAF 指纹记忆（`secagent memory`）。 4. **零误报实时验证**：集成的 `CrucibleValidator` 针对目标 endpoint 重放概念验证 payload，并进行 HTTP 状态码一致性及响应正文差异检查。 5. **共享连接池与高并发**：连接池化的 `CVEScanner` 和通过 `asyncio.Semaphore` 任务调度的并发 `WebSecurityAgent` 扫描。 6. **无头浏览器检查**：`BrowserAgent` 自动化 Chrome DOM 提取与动态 Playwright 表单解析，并具备 HTTP 检查回退机制。 7. **严格的 SSL/TLS 强制执行**：跨所有 Agent HTTP 客户端的环境控制动态 SSL 验证（`SECAGENT_VERIFY_SSL`）。 8. **感知硬件的本地回退**：当云 API 不可用时，自动检测 GPU/CPU 能力以配置本地 Ollama 模型（`llama3`、`mistral`、`codellama`）。 9. **Model Context Protocol (MCP) Server 模式**：原生 JSON-RPC stdio server（`secagent mcp`），允许 Claude Code、Cursor 和 VS Code Copilot 以零 API 成本驱动 SecAgent。 10. **声明式 YAML Playbooks**：使用条件规则和 LLM 决策门控定义和版本控制复杂的渗透测试方法论（`secagent playbook`）。 11. **便携式 Proof Capsule 与重放引擎**：将已验证的漏洞导出为 `.json` proof capsule，并可通过 `secagent replay` 按需重新验证。 12. **Human-In-The-Loop (HITL) 遥操作**：在扫描执行期间拦截双击 `Ctrl+C` 以进入交互式操作员 REPL（`step`、`inspect`、`inject`、`resume`、`abort`）。 13. **LLM 预算守卫与成本保障**：实时 token 成本核算和可配置的预算限制强制执行（`SECAGENT_PRICE_LIMIT`）。 ## 能力矩阵 | 模块 | 子组件 | 操作描述 | |--------|----------------|-------------------------| | **神经集群编排** | `Orchestrator`, `ArmadaSwarm`, `TaskDAG` | 将高层目标分解为带有重试和熔断逻辑的有向无环执行图 (DAG)。 | | **MCP Server 模式** | `MCPServer`, JSON-RPC stdio | 通过 Model Context Protocol 向 Claude Code、Cursor 和 Copilot 公开 SecAgent 工具（`secagent mcp`）。 | | **声明式 Playbooks** | `Playbook`, `PlaybookRunner` | 执行依赖排序和条件执行的 YAML 定义扫描方法论（`secagent playbook`）。 | | **Proof Capsule 与重放** | `ProofCapsule`, `ProofCapsuleReplayer` | 将验证后的发现导出为便携的 `.json` capsule，以便即时离线重放和 CI 验证（`secagent replay`）。 | | **HITL 遥操作** | `TeleoperationController` | 拦截双击 `Ctrl+C` 以暂停扫描并启动交互式 REPL shell。 | | **LLM 成本保障** | `BudgetGuard` | 跨 OpenAI、Anthropic、Gemini、Groq 和 OpenRouter 执行实时 token 定价和成本限制强制。 | | **Aura 认知记忆** | `AuraMemoryManager`, Target DNA | Target DNA 指纹识别、WAF 记忆、payload 模式固化、自动置信度强化与衰减（`secagent memory`）。 | | **主动侦察引擎** | `ReconAgent`, `GoRecon`, `httpx` Prober | 主动子域名解析、TLS/header 探测、HTML 抓取、链接提取以及 GET/POST 参数发现。 | | **无头浏览器引擎** | `BrowserAgent`, Playwright | Chromium DOM 树检查、动态 JS 错误跟踪和自动化 HTML 表单输入提取。 | | **Web 安全扫描器** | `WebSecurityAgent`, `CVEChecks` | 31+ 种漏洞类别，包括 SQLi、XSS、SSTI、LFI、RFI、SSRF、RCE、命令注入、Log4Shell 和多源 CORS 检查。 | | **API 安全扫描器** | `APISecurityAgent` | REST 与 GraphQL 内省、BOLA/IDOR 检测（敏感 schema 字段评估）、JWT 算法操纵（`none` alg）和 CORS 配置错误。 | | **12 个专业化集群 Agent** | `specialized.py` | 用于智能工具选择、CTF 挑战解决、漏洞利用生成、漏洞关联和速率限制检测的功能性 AI 集群 Agent。 | | **Web3 与合约审计器** | `Web3SecurityAgent` | 针对 EVM 和 Solana 智能合约的 Reentrancy、整数溢出、delegatecall 漏洞和访问控制绕过的安全分析。 | | **PoC 验证** | `CrucibleValidator` | 实时 HTTP 请求重放，进行多次尝试一致性验证以消除误报。 | | **漏洞利用链关联** | `ChainCorrelator` | 将孤立的漏洞链接成完整的端到端多步骤漏洞利用路径。 | | **影响优先报告** | `ReportAgent` | 生成管理层 Markdown 报告和机器可读的 JSON 构件。 | ## 综合系统架构 ### 1. 高层系统拓扑与多语言引擎 ``` graph TB subgraph CLI_LAYER["🖥️ CLI & Interface Control Plane"] CLI["secagent CLI (Rich TUI)"] MCP["🔌 MCPServer (JSON-RPC stdio)"] PLAYBOOK["📜 Playbook Engine (YAML Methodologies)"] CAPSULE["📦 Proof Capsule Engine & Replayer"] HITL["🕹️ Teleoperation Controller (Double Ctrl+C)"] BUDGET["💰 BudgetGuard (Token & Cost Accounting)"] SCOPE["Scope Gate (Fail-Closed Enforcer)"] VAULT["Vault Key Manager (.env Loader)"] PREFLIGHT["Preflight Integrity Checker"] end subgraph MEMORY_LAYER["🧠 Cognitive Memory Subsystem"] AURA["AuraMemoryManager (Target DNA & Pattern Engine)"] DB[("💾 SQLite / aura-memory SDK Database")] end subgraph SWARM_LAYER["🐝 Python Agent Swarm"] PLANNER["🎯 Planner Agent (Armada DAG Builder)"] RECON["🔍 Recon Agent (httpx + Async Prober)"] WEB["🌐 Web Security Agent"] API["⚡ API Security Agent"] WEB3["🕸️ Web3 Security Agent"] VALIDATOR["🔬 Validator Agent (Crucible)"] REPORTER["📊 Report Agent"] end subgraph ENGINE_LAYER["⚙️ Polyglot Core Engine"] CPP["⚡ C/C++ Foundational Core (cpp-core)"] RUST["🦀 Rust Engine & Priority Scheduler"] GO["🐹 Go Subdomain & Network Prober"] REDIS[("🔴 Redis Pub/Sub Event Bus")] end CLI --> SCOPE MCP --> SCOPE PLAYBOOK --> SCOPE CAPSULE --> VALIDATOR HITL --> SWARM_LAYER BUDGET --> SWARM_LAYER SCOPE --> PREFLIGHT PREFLIGHT --> VAULT VAULT --> PLANNER AURA <--> DB PLANNER <-->|Recall Target DNA| AURA PLANNER --> RECON PLANNER --> WEB PLANNER --> API PLANNER --> WEB3 RECON --> GO RECON --> RUST RECON --> CPP SWARM_LAYER --> REDIS SWARM_LAYER --> VALIDATOR VALIDATOR -->|Export Proof Capsule| CAPSULE VALIDATOR -->|Crystallize Exploits| AURA VALIDATOR --> REPORTER ``` ### 5. C/C++ 基础核心引擎（`cpp-core`）与原生桥接演示 SecAgent 包含一个编译好的 **C++20 基础核心（`cpp-core`）**，用于亚毫秒级执行任务、SIMD 加速的 regex/签名匹配以及异步原始 socket 探测。 #### C++ 核心架构拓扑 ``` graph LR subgraph PYTHON_BRIDGE["🐍 Python Native Bridge"] PY_NATIVE["secagents.core.native"] CTYPES["ctypes C-ABI Loader"] end subgraph CPP_ENGINE["⚡ C++ Foundational Engine (secagent_core)"] C_API["c_api.cpp (extern 'C' Exported API)"] MATCHER["FastMatcher (C++20 SIMD Regex Engine)"] PROBER["RawSocketProber (Non-Blocking Socket Engine)"] end subgraph OS_KERNEL["💻 OS Kernel"] SOCKETS["Raw Sockets / AF_PACKET / Winsock2"] end PY_NATIVE --> CTYPES CTYPES ==>|Direct C-ABI Calls| C_API C_API --> MATCHER C_API --> PROBER PROBER ==>|Non-Blocking I/O| SOCKETS ``` #### 代码演示 1 — 高速 C++ 签名匹配（`fast_matcher.cpp`） ``` #include "fast_matcher.hpp" #include namespace SecAgentCore { bool FastMatcher::scan_signature(const std::string& buffer, const std::string& pattern) { if (buffer.empty() || pattern.empty()) return false; try { std::regex re(pattern, std::regex_constants::icase | std::regex_constants::optimize); return std::regex_search(buffer, re); } catch (...) { return buffer.find(pattern) != std::string::npos; } } } ``` #### 代码演示 2 — 非阻塞 C++ Socket 探测器（`raw_socket.cpp`） ``` #include "raw_socket.hpp" #include namespace SecAgentCore { ProbeResult RawSocketProber::probe_port(const std::string& host, int port, int timeout_ms) { auto start = std::chrono::high_resolution_clock::now(); int sock = ::socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); // Execute non-blocking socket connect with select() timeout monitoring... auto elapsed = std::chrono::high_resolution_clock::now() - start; double latency = std::chrono::duration(elapsed).count(); return {true, port, "open", latency}; } } ``` #### 代码演示 3 — 导出的 C-ABI 桥接（`c_api.cpp`） ``` #include "c_api.h" #include "fast_matcher.hpp" #include "raw_socket.hpp" extern "C" { SECAGENT_EXPORT int secagent_match_signature(const char* buffer, const char* pattern) { return SecAgentCore::FastMatcher::scan_signature(buffer, pattern) ? 1 : 0; } SECAGENT_EXPORT SecAgentProbeResult secagent_probe_port(const char* host, int port, int timeout_ms) { auto res = SecAgentCore::RawSocketProber::probe_port(host, port, timeout_ms); return {res.open ? 1 : 0, res.port, res.latency_ms}; } } ``` #### 代码演示 4 — Python 原生桥接调用（`native.py`） ``` from secagents.core.native import native_engine # 高速 C++ signature scanning matched = native_engine.match_signature(response_body, r"Apache/\d+\.\d+") # 高速 native socket probing result = native_engine.probe_port("127.0.0.1", 80, timeout_ms=500) print(f"Port Open: {result['open']}, Latency: {result['latency_ms']}ms") ``` ### 2. 自主扫描生命周期序列 ``` sequenceDiagram autonumber actor Operator as Operator / CLI participant Pipeline as ScanPipeline participant Memory as Aura Cognitive Memory participant Swarm as Agent Swarm participant Recon as Recon Agent (Go/httpx) participant Validator as Crucible Validator participant Reporter as Report Generator Operator->>Pipeline: secagent scan -t target.com --depth standard Pipeline->>Pipeline: Enforce Scope & Run Preflight System Checks Pipeline->>Memory: Recall Target DNA & WAF Signature Memory-->>Pipeline: Return Historical Fingerprints & High-Confidence Payloads Pipeline->>Swarm: Initialize Swarm DAG with Recalled Memory Swarm->>Recon: Execute Active Subdomain & HTTP Probing Recon-->>Swarm: Return Active Hosts, Services & Parameters Swarm->>Swarm: Run Parallel Scans (Web, API, Web3, CVE Checks) Swarm-->>Validator: Submit Raw Finding Signals Validator->>Validator: Replay PoC Payloads & Linear-Scale Latency Checks Validator->>Memory: Crystallize Validated Exploit Patterns & Update Target DNA Validator-->>Reporter: Return 100% Confirmed Vulnerabilities Reporter->>Operator: Render Mission Intelligence Summary & Save Deliverables ``` ### 3. 多 Agent 集群决策逻辑 ``` graph LR SUB["Supervisor Agent"] -->|Classify Intent| PLAN["Planner Agent"] PLAN -->|Execution Graph| WORKERS["Worker Swarm"] subgraph WORKERS["Worker Swarm"] direction TB R["Recon Agent"] W["Web Security"] A["API Security"] W3["Web3 Security"] end WORKERS -->|Raw Signals| VAL["Crucible Validator"] VAL -->|Confirmed PoC| REP["Report Agent"] style SUB fill:#0f3460,stroke:#e94560,color:#fff style PLAN fill:#16213e,stroke:#00ffff,color:#fff style VAL fill:#1a6b1a,stroke:#00ff00,color:#fff style REP fill:#533483,stroke:#ff00ff,color:#fff ``` ### 4. 多 Provider LLM 故障转移与共识引擎 ``` flowchart TD REQ["Agent Task Request"] --> PROVIDER{"Primary LLM Configured?"} PROVIDER -- "OpenAI" --> OAI["OpenAI (GPT-4o)"] PROVIDER -- "Anthropic" --> ANT["Anthropic (Claude 3.5)"] PROVIDER -- "Gemini" --> GEM["Google (Gemini 1.5 Pro)"] PROVIDER -- "Groq" --> GROQ["Groq (Llama-3 70B)"] OAI -- "Fail / Rate Limit" --> ANT ANT -- "Fail / Rate Limit" --> GEM GEM -- "Fail / Rate Limit" --> GROQ GROQ -- "Fail / Offline" --> LOCAL["Local Ollama Fallback"] OAI --> CONSENSUS["Consensus Engine (Min Agreement: 2)"] ANT --> CONSENSUS GEM --> CONSENSUS LOCAL --> CONSENSUS CONSENSUS --> OUT["Validated Agent Decision"] ``` ## 快速入门指南 ``` # 1. 克隆 repository git clone https://github.com/gl1tch0x1/cog-ai.git cd cog-ai # 2. 运行自动化部署 engine python installer.py # 3. 配置环境 secrets cp .env.example .env nano .env # Add OPENAI_API_KEY, ANTHROPIC_API_KEY, or GEMINI_API_KEY # 4. 启动自主 red-team 扫描 secagent scan --target example.com --depth standard ``` ## 安装指南 ### 前置条件 | 要求 | 最低 | 推荐 | 备注 | |-------------|---------|-------------|-------| | **OS** | Windows / Linux / macOS | Linux / macOS / WSL2 | 在原生 Windows PowerShell 和 Linux 上完全支持 | | **Python** | 3.11+ | Python 3.11, 3.12, 3.13 | 跨环境验证的兼容性 | | **Git** | 已安装 | 最新 | 版本控制与更新引擎 | | **Docker** | *(可选)* | 20.10+ | 容器化沙盒执行（使用 `--no-sandbox` 绕过） | ### 方法 1 — 自动化安装引擎（推荐）安装程序会设置虚拟环境、挂载核心依赖项、创建入口点并验证系统完整性： ``` python installer.py ``` ### 方法 2 — 手动包安装适用于开发者控制或集成到现有的 Python 环境中： ``` # 1. 创建并激活 virtual environment python -m venv venv # Windows PowerShell: .\venv\Scripts\Activate.ps1 # Linux / macOS: source venv/bin/activate # 2. 以 editable mode 安装 secagents package pip install -e ./python-agents[dev,browser] ``` ## 发布、部署与包 ### 发布 - **当前版本**：`v0.3.0-dev` - **发布跟踪**：通过 [CHANGELOG.md](file:///c:/Users/Acer/Downloads/SecAgent-Updated/SecAgent-Updated/CHANGELOG.md) 管理 - **标签**：遵循语义化版本控制（`MAJOR.MINOR.PATCH`）。 ### 部署模型 SecAgent 专为跨本地机器、远程服务器和容器化集群的灵活部署而设计。 #### Docker Compose 部署运行核心后台微服务（Redis 事件总线、Rust 引擎、Go 探测器）： ``` docker compose up -d ``` 容器清单： - `redis`：Pub/Sub 事件总线（`:6379`） - `rust-core`：Rust 优先级任务调度器 - `recon`：Go 高并发网络探测器 #### 独立 CLI 二进制部署安装程序生成可执行的二进制包装器以供快速调用： - **Windows**：`secagent.bat` - **Linux/macOS**：`./secagent` ### 包构件 Python agent 核心被打包为标准的 PyPI wheel： ``` # 构建 python package wheel cd python-agents python -m build ``` 生成的构件：`-agents/dist/secagents-0.2.0-py3-none-any.whl`。 ## 配置与操作清单操作参数和 API 凭据从 `.env` 读取： ``` # ─── Primary LLM Provider Keys ─── OPENAI_API_KEY=sk-proj-... ANTHROPIC_API_KEY=sk-ant-... GEMINI_API_KEY=AIzaSy... GROQ_API_KEY=gsk_... DEEPSEEK_API_KEY=sk-... # ─── Local LLM Configuration ─── OLLAMA_HOST=http://localhost:11434 DEFAULT_LOCAL_MODEL=llama3:8b # ─── Operational Scope & Infrastructure ─── ALLOWED_DOMAINS=example.com,target.local REDIS_URL=redis://localhost:6379/0 RESULTS_DIR=cog-ai-results SECAGENT_VERIFY_SSL=true ``` ## 完整 CLI 使用参考 ``` usage: secagent [-h] [--version] {scan,vault,keyhacks,preflight,update,hardware,worker} ... SecAgent — Autonomous Offensive AI Framework (authorized testing only) positional arguments: {scan,vault,keyhacks,preflight,update,hardware,worker} scan Execute autonomous red-team pipeline vault Interface with secret storage and API keys keyhacks Scan local assets for leaked credentials preflight Validate system readiness update Check and apply framework updates hardware Hardware-aware model optimization worker Start background workflow processor options: -h, --help show this help message and exit --version show program's version number and exit ``` ### 子命令规范与标志 #### 1. `secagent scan` — 自主红队 Pipeline ``` secagent scan --target [options] Options: --target, -t TEXT Target domain or URL [Required] --depth {quick,standard,deep} Scan intensity (default: standard) --workers, -w INT Parallel agent swarm size (default: 4) --skip-os-check Bypass OS security baseline check --no-sandbox Bypass Docker Fortress isolation --no-arsenal Skip heuristic Arsenal probes --insecure Bypass SSL/TLS verification --setup-local-llm Auto-provision local Ollama model --results-dir PATH Output directory for deliverables (default: cog-ai-results) ``` #### 2. `secagent vault` — 密钥完整性管理器 ``` secagent vault --validate --env .env ``` #### 3. `secagent keyhacks` — 凭据审计 ``` secagent keyhacks ./src --rate-limit 10.0 ``` #### 5. `secagent mcp` — Model Context Protocol Server ``` secagent mcp ``` #### 6. `secagent playbook` — 声明式方法论执行 ``` secagent playbook ./playbooks/web-api.yaml --target example.com ``` #### 7. `secagent replay` — Proof Capsule PoC 重放器 ``` secagent replay ./cog-ai-results/capsules/proof_sqli_123.json ``` #### 5. `secagent memory` — Aura 认知记忆控制 ``` secagent memory [options] Options: --target, -t TEXT Filter cognitive memory signals by target domain --purge-decay Apply memory decay algorithms & remove zero-confidence patterns ``` #### 6. `secagent hardware` — 硬件检测 ``` secagent hardware ``` #### 6. `secagent update` — 情报同步 ``` secagent update ``` ## 交付物示例与模式 ### 1. 管理层 Markdown 交付物 ``` # 任务情报交付物：example.com ## 执行摘要 SecAgent executed an autonomous security audit against target domain `example.com`. A total of **3 validated vulnerabilities** were extracted with zero false positives. ### Key Finding 矩阵 | Severity | Vulnerability | Location | Confidence | CWE | | :--- | :--- | :--- | :---: | :--- | | **CRITICAL** | SQL Injection | `/api/users?id=` | 95% | CWE-89 | | **HIGH** | Reflected XSS | `/search?q=` | 90% | CWE-79 | | **HIGH** | Insecure Direct Object Reference | `/api/users/102` | 85% | CWE-639 | --- ## 技术 Finding 详情 ### 1. SQL Injection (`CWE-89`) - **Target URL**: `https://example.com/api/users` - **Method**: `GET` - **Payload**: `' UNION SELECT NULL--` - **Proof Signal**: `You have an error in your SQL syntax near '1'` ``` ### 2. 机器可读 JSON Schema（`target.json`） ``` { "target": "example.com", "domain": "example.com", "findings": [ { "type": "sqli", "severity": "critical", "url": "https://example.com/api/users", "payload": "' UNION SELECT NULL--", "confidence": 0.95, "cwe": "CWE-89", "poc_url": "https://example.com/api/users?id=' UNION SELECT NULL--" } ] } ``` ## 项目目录结构 ``` SecAgent/ ├── python-agents/ # Primary Python AI Agent Swarm & CLI Engine │ ├── pyproject.toml # Package configuration, scripts, & dev dependencies │ └── secagents/ │ ├── agents/ # Autonomous Specialist Agent Swarms │ │ ├── api_security.py # REST/GraphQL vulnerability prober & BOLA checker │ │ ├── base.py # BaseAgent class with confidence scoring & standard formatting │ │ ├── keyhacks.py # Local asset secret & credential leak scanner │ │ ├── planner.py # Phase decomposer, resource allocator, risk identifier │ │ ├── recon.py # Active DNS prober, httpx crawler, parameter discovery │ │ ├── report.py # Markdown deliverable generator & finding summarizer │ │ ├── supervisor.py # Action intent classifier & swarm director │ │ ├── validator.py # Proof-of-Concept verification & replay engine │ │ ├── web3_security.py # Smart contract auditor (EVM & Solana vulnerability prober) │ │ └── web_security.py # Web vulnerability scanner (SQLi, XSS, SSTI, LFI, SSRF, RCE) │ ├── armada/ # Swarm Handlers & Orchestration Tasks │ │ ├── handlers.py # Task handler registration & routing │ │ └── swarm.py # Parallel agent swarm runner │ ├── arsenal/ # Heuristic Exploitation Probes │ │ └── exploits.py # Arsenal payload probes & secondary validation │ ├── core/ # Core System Infrastructure │ │ ├── memory.py # Persistent memory storage │ │ ├── orchestrator.py # Task DAG orchestrator & circuit breaker tracker │ │ ├── skill_manager.py # SKILL.md parser & skill registration engine │ │ └── workers.py # Async worker pool & queue manager │ ├── crucible/ # Verification & Regression Framework │ │ ├── regression.py # Test suite regression tracker │ │ └── validation.py # Live PoC replay & linear-scaling time verifier │ ├── engine/ # Context & Graph Processing │ │ ├── caveman.py # Token-efficient prompt compressor │ │ ├── ci_notifier.py # CI/CD webhook & alert dispatcher │ │ └── memory_graph.py # Graph-based vulnerability relationship store │ ├── fortress/ # Isolation & Sandboxing │ │ └── sandbox.py # Docker Fortress execution isolation checks │ ├── hermes/ # Retrospective Memory Engine │ │ ├── retrospective.py # Post-scan analysis & learning feedback loop │ │ └── store.py # Hermes persistent memory store │ ├── infra/ # Operational Safeguards & Integrity │ │ ├── preflight.py # System dependency & prerequisite verifier │ │ └── scope.py # Fail-closed target domain scope enforcer │ ├── intel/ # Threat Intelligence Integration │ │ ├── chaos_client.py # ProjectDiscovery Chaos API integration │ │ └── shodan_client.py # Shodan host intelligence integration │ ├── llm/ # LLM Provider Abstraction │ │ ├── consensus.py # Multi-provider agreement & consensus engine │ │ └── omni.py # Unified LLM client (OpenAI, Anthropic, Gemini, Groq, DeepSeek) │ ├── modules/ # Deterministic Detection Signatures │ │ └── cve_checks.py # 31+ zero-false-positive CVE signatures & check definitions │ ├── operational/ # Environment & System Integrity │ │ └── integrity.py # OS baseline security update & tool updater │ ├── pipeline/ # Unified Scan Execution │ │ └── runner.py # ScanPipeline orchestrator (Scope -> Preflight -> Swarm -> Report) │ ├── remediation/ # Auto-Fixing & Patching │ │ ├── patcher.py # Auto-remediation code patcher │ │ └── reporter.py # Final report formatter & deliverable generator │ ├── vault/ # Operational Secret Storage │ │ └── env_loader.py # Environment key loader & live API validation │ ├── whichllm/ # Hardware-Aware Model Provisioning │ │ └── hardware.py # Local GPU/CPU detector & Ollama auto-provisioner │ └── cli.py # Rich CLI Terminal User Interface & subcommand parser ├── go-services/ # High-Performance Go Microservices │ ├── recon/ # High-Speed Recon Engine │ │ ├── crawler.go # Concurrent web page crawler & link extractor │ │ ├── httpprobe.go # Multithreaded HTTP/HTTPS service prober │ │ ├── params.go # GET/POST parameter discovery engine │ │ ├── recon_test.go # Unit test suite for Go recon │ │ └── subdomain.go # Multithreaded DNS brute-force enumerator │ ├── scanners/ # Network Scanners │ │ ├── portscan.go # Fast TCP port scanner │ │ └── syn.go # Raw SYN packet scanner │ └── cli/ # Go CLI Binary Build Entrypoint │ └── cmd/main.go # Go CLI entrypoint ├── rust-core/ # Rust Engine & Priority Task Scheduler │ ├── Cargo.toml # Rust package manifest & dependencies │ └── src/ │ ├── engine.rs # Core Rust execution engine │ ├── event_bus.rs # Lock-free event dispatching bus │ ├── main.rs # Rust engine binary main entrypoint │ ├── policy.rs # Security policy evaluation engine │ ├── scheduler.rs # Microsecond-latency task priority queue │ └── state.rs # System state tracker ├── skills/ # Modular Hunting Methodologies │ ├── bb-methodology/ # Bug bounty methodology guidelines │ ├── PromptInjection/ # LLM prompt injection audit playbooks │ ├── Recon/ # Advanced reconnaissance techniques │ └── WebAssessment/ # OWASP Top 10 assessment workflows ├── tests/ # Unified Test Suite │ └── unit/ │ ├── test_agents_complete.py # Unit tests for python agent swarms │ ├── test_comprehensive.py # System orchestrator & worker tests │ └── test_cve_checks.py # Signature & CVE verification tests ├── docker-compose.yml # Production background microservices configuration ├── Makefile # Unified build, test, and execution targets ├── installer.py # Automated deployment & installation engine ├── update.py # Intelligence & framework sync tool ├── SKILL.md # Master hunting knowledge base reference ├── LICENSE # MIT License distribution terms ├── SECURITY.md # Security policy & vulnerability reporting └── README.md # Master documentation & architecture guide ``` ## 故障排除与操作指南 ### 常见操作场景 #### 1. 绕过 Docker 沙盒隔离如果 Docker 未运行或不需要沙盒隔离： ``` secagent scan --target example.com --no-sandbox ``` #### 2. 配置离线本地 LLM 模型在没有云 API key 的气隙环境中运行时： ``` secagent scan --target target.local --setup-local-llm ``` #### 3. 解决 SSL 证书警告对于使用自签名 SSL 证书的内部预发布环境： ``` secagent scan --target https://staging.local --insecure ``` ## 贡献与安全政策 ### 贡献 1. 在 GitHub 上 Fork 该仓库。 2. 创建你的功能分支（`git checkout -b feature/advanced-cve-check`）。 3. 验证测试覆盖率（`pytest`）和 linter 合规性（`ruff check python-agents`）。 4. 提交你的更改并发起 Pull Request。 ### 报告漏洞要报告 SecAgent 本身内部的安全漏洞，请查阅我们的 [SECURITY.md](file:///c:/Users/Acer/Downloads/SecAgent-Updated/SecAgent-Updated/SECURITY.md) 以获取负责任的披露指南。 ## 许可证在 MIT 许可证下分发。详情请参阅 [LICENSE](file:///c:/Users/Acer/Downloads/SecAgent-Updated/SecAgent-Updated/LICENSE)。