vigolium

vigolium/piolium

Instructions file CodexOpenCode

Instructions for vigolium/piolium, a project described as: A Pi-native extension for thorough, agentic security audits.

vigolium/piolium

Instructions file

Instructions for vigolium/piolium, covering claude.md, project at a glance, commands, run a single test file or filter by name and or load the extension ad-hoc without touching settings.

vigolium/piolium

Agent

Phase 1 intelligence gathering agent that collects security advisories (CVE, GHSA, OSV) with adaptive time expansion, builds architecture inventory, compiles a general component inventory (SBOM) of every software component the target relies on, and synthesizes vulnerability pattern analysis (recurring components, bug…

vigolium/piolium

Agent

Phase 10 Review Chamber creative attack hypothesis generator that thinks like a hacker, chains low-severity issues into high-severity exploit paths, generates unconventional attack scenarios from threat model slices using 8 creative attack modes, and produces hypotheses a single auditor would miss.

vigolium/piolium

Agent

Phase 6 authorization and access-control audit agent that enumerates every route/handler/consumer across the codebase, extracts declared guards and in-body authz logic, builds an authorization matrix, then systematically hunts for IDOR/BOLA, vertical privilege escalation, tenant-isolation bypass, mass assignment, and…

vigolium/piolium

Agent

Backward Reasoner — Deep Probe Phase 5 hypothesis generator applying Pre-Mortem Analysis and Abductive Reasoning. Reasons backward from imagined catastrophic outcomes and from anomalous defensive code to discover attack hypotheses. Does NOT trace code paths or issue verdicts.

vigolium/piolium

Agent

Phase 10 Review Chamber coordinator and judge that orchestrates the debate lifecycle between Ideator, Tracer, and Advocate, resolves disputes using evidence from both sides, assigns calibrated severity, writes finding drafts for confirmed vulnerabilities, and manages the cross-chamber attack pattern registry.

vigolium/piolium

Agent

Phase 10 Review Chamber technical analyst that takes attack hypotheses and traces them through actual code paths, proving or disproving reachability using CodeQL structural artifacts, on-demand QL queries, and line-by-line source analysis to produce evidence-backed assessments.

vigolium/piolium

Agent

Phase 11 cold verification agent that independently re-verifies CRITICAL and HIGH findings with zero prior context, following the adversarial review protocol to break residual confirmation bias from chamber debates.

vigolium/piolium

Agent

Phase 1 intelligence gathering agent that proactively mines git history for security-relevant commits with no CVE/GHSA label — dangerous pattern introductions, security control weakening, silent security fixes, reverted fixes, secret archaeology, CI/CD pipeline weakening, and suspicious commit patterns.

vigolium/piolium

Agent

Confirmation phase V6 reporting agent that aggregates all confirmation results from poc-executor and test-mapper into a structured confirmation report with per-finding verdicts, evidence links, and summary statistics.

vigolium/piolium

Agent

Contradiction Reasoner — Deep Probe Phase 5 hypothesis generator applying TRIZ Contradiction Analysis and Game Theory adversarial modeling. Finds vulnerabilities created by engineering trade-offs and by systems that leak information to adaptive attackers across multiple interactions. Does NOT trace code paths or issue…

vigolium/piolium

Agent

Phase 8 cross-service taint-propagation agent that stitches inter-component data flows (HTTP/gRPC/queues/IPC/shared-DB writes) into a single call graph, then propagates taint across service boundaries that Semgrep Pro and CodeQL cannot follow within a single-process analysis. Catches sanitization-at-boundary gaps…

vigolium/piolium

Agent

Phase 10 Review Chamber adversarial challenger that reviews Code Tracer evidence for each attack hypothesis and actively searches for framework protections, middleware defenses, configuration guards, and documented intended behavior at all 5 protection layers to construct the strongest possible defense against each…

vigolium/piolium

Agent

Confirmation phase V2 environment discovery agent that scans the target repository for application startup methods (Docker Compose, Dockerfile, Makefile, package scripts), test infrastructure, database dependencies, and required environment variables, producing a ranked strategy list for env-provisioner.

vigolium/piolium

Agent

Confirmation phase V3 environment provisioning agent that starts the target application using strategies discovered by env-detective, walks the strategy list top-to-bottom with fallback, runs healthchecks, and outputs connection details and cleanup commands.

vigolium/piolium

Agent

Evidence Harvester — rapid code tracer for the Deep Probe phase. Traces each hypothesis through actual code paths, applies Pearl-style causal challenge to any apparent blocking protection (intervention / counterfactual / confounder), issues VALIDATED / INVALIDATED / NEEDS-DEEPER verdicts, and assigns a Fragility Score…

vigolium/piolium

Agent

Phase 14 per-finding report authoring agent. Reads a single finding directory (draft.md, debate.md, adversarial-review.md, poc script, evidence/) and writes the disclosure-ready report.md via the vuln-report skill. Runs cold-context per finding so the heavyweight PoC-building workload cannot starve the report-writing…

vigolium/piolium

Agent

Cheap-tier triage agent that classifies a single finding draft as P0/P1/P2/skip without re-investigating the underlying code. Reads only the draft frontmatter, title, and body — does not Read source files. Designed to run on a cheaper model so the orchestrator can prioritize PoC building and prune low-signal noise…

vigolium/piolium

Agent

Scans repo-local security documentation (SECURITY.md, README, docs/, threat-model files, inline pragmas) and produces a structured intent corpus of behaviors the project declares intentional and risks it explicitly acknowledges. Used by confirm mode (per-finding cross-check) and revisit mode (priority signal for…

vigolium/piolium

Agent

Phase 3 project model construction agent that classifies project type, maps attacker-controlled inputs and trust boundaries, builds DFD/CFD slices, runs domain attack research (including protocol-specific attack playbooks), and produces the threat model that drives all subsequent audit phases.

vigolium/piolium

Agent

Phase KB0 intake agent that converts staged, untrusted application documentation into a cited, security-oriented knowledge-base seed for later audit phases — without treating repository prose as agent instructions or as proof of implementation.

vigolium/piolium

Agent

Phase 3 aggregator for /piolium-longshot. Reads every per-file draft produced by the longshot-hunter swarm, deduplicates overlapping findings, ranks by severity and confidence, and writes a curated summary plus per-finding curated drafts. Does not re-run hunting.

vigolium/piolium

Agent

Hail-mary vulnerability hunter for /piolium-longshot Phase 2. Anchored on a single source file, follows imports/callers across the repo, and produces evidence-anchored draft findings. Does not build CodeQL/Semgrep databases, does not execute the application, and does not fabricate.