security research agents

transilienceai/communitytools

Agent

Business-impact gate. Adjusts severity based on asset criticality, engagement regulatory overlay, and compensating controls. Does NOT veto findings.

transilienceai/communitytools

Agent

Deterministic (not LLM). Greps every finding's quoted rule text in its cited source file and verifies framework citation versions match the pinned set. Mismatches → quarantine.

transilienceai/communitytools

Agent

20+ year offensive security reviewer. Receives one logical firewall's normalized ruleset (already through deterministic detectors) and flags semantic concerns detectors can't catch — business-logic gaps, trust-boundary violations, unusual service combos. 2-4 instances dispatched in parallel during /launch.

bx33661/oh-my-vul

Agent

Adversarial guard/bypass assessment agent for oh-my-vul. Use after dataflow-tracer has identified a candidate source→sink chain to independently assess whether an existing guard actually prevents exploitation. Biased toward finding bypasses — only concedes "guard is effective" when bypass truly cannot be constructed.

bx33661/oh-my-vul

Agent

Platform-specific advisory rendering agent for oh-my-vul. Use during omv-report to render VulDB, GHSA, OSV JSON, or Markdown advisory formats from a confirmed Evidence.v1 object. Refuses to produce submission-ready output when submissionscore < 75 and refuses entirely for blocked findings.

bx33661/oh-my-vul

Agent

Adversarial verification agent for oh-my-vul. Use after dataflow-tracer and guard-checker have produced a candidate audit conclusion, to independently refute it. The default stance is skeptical — assume the conclusion is wrong and find evidence supporting that. Only concedes agreement when refutation genuinely fails.…