A Pi-native extension for thorough, agentic security audits
This repository also configures its own agents. See what piolium tells them →
Agent Claude Code
Phase 1 intelligence gathering agent that collects security advisories (CVE, GHSA, OSV) with adaptive time expansion, builds architecture inventory, compiles a general component inventory (SBOM) of every software component the target relies on, and synthesizes vulnerability pattern analysis (recurring components, bug…
Agent Claude Code
Phase 10 Review Chamber creative attack hypothesis generator that thinks like a hacker, chains low-severity issues into high-severity exploit paths, generates unconventional attack scenarios from threat model slices using 8 creative attack modes, and produces hypotheses a single auditor would miss.
Agent Claude Code
Phase 6 authorization and access-control audit agent that enumerates every route/handler/consumer across the codebase, extracts declared guards and in-body authz logic, builds an authorization matrix, then systematically hunts for IDOR/BOLA, vertical privilege escalation, tenant-isolation bypass, mass assignment, and…
Agent Claude Code
Backward Reasoner — Deep Probe Phase 5 hypothesis generator applying Pre-Mortem Analysis and Abductive Reasoning. Reasons backward from imagined catastrophic outcomes and from anomalous defensive code to discover attack hypotheses. Does NOT trace code paths or issue verdicts.
Agent Claude Code
Phase 10 Review Chamber coordinator and judge that orchestrates the debate lifecycle between Ideator, Tracer, and Advocate, resolves disputes using evidence from both sides, assigns calibrated severity, writes finding drafts for confirmed vulnerabilities, and manages the cross-chamber attack pattern registry.
Agent Claude Code
Phase 10 Review Chamber technical analyst that takes attack hypotheses and traces them through actual code paths, proving or disproving reachability using CodeQL structural artifacts, on-demand QL queries, and line-by-line source analysis to produce evidence-backed assessments.
Agent Claude Code
Phase 11 cold verification agent that independently re-verifies CRITICAL and HIGH findings with zero prior context, following the adversarial review protocol to break residual confirmation bias from chamber debates.
Agent Claude Code
Phase 1 intelligence gathering agent that proactively mines git history for security-relevant commits with no CVE/GHSA label — dangerous pattern introductions, security control weakening, silent security fixes, reverted fixes, secret archaeology, CI/CD pipeline weakening, and suspicious commit patterns.
Agent Claude Code
Confirmation phase V6 reporting agent that aggregates all confirmation results from poc-executor and test-mapper into a structured confirmation report with per-finding verdicts, evidence links, and summary statistics.
Agent Claude Code
Contradiction Reasoner — Deep Probe Phase 5 hypothesis generator applying TRIZ Contradiction Analysis and Game Theory adversarial modeling. Finds vulnerabilities created by engineering trade-offs and by systems that leak information to adaptive attackers across multiple interactions. Does NOT trace code paths or issue…
Agent Claude Code
Phase 8 cross-service taint-propagation agent that stitches inter-component data flows (HTTP/gRPC/queues/IPC/shared-DB writes) into a single call graph, then propagates taint across service boundaries that Semgrep Pro and CodeQL cannot follow within a single-process analysis. Catches sanitization-at-boundary gaps…
Agent Claude Code
Phase 10 Review Chamber adversarial challenger that reviews Code Tracer evidence for each attack hypothesis and actively searches for framework protections, middleware defenses, configuration guards, and documented intended behavior at all 5 protection layers to construct the strongest possible defense against each…
Agent Claude Code
Confirmation phase V2 environment discovery agent that scans the target repository for application startup methods (Docker Compose, Dockerfile, Makefile, package scripts), test infrastructure, database dependencies, and required environment variables, producing a ranked strategy list for env-provisioner.
Agent Claude Code needs its repo
Confirmation phase V3 environment provisioning agent that starts the target application using strategies discovered by env-detective, walks the strategy list top-to-bottom with fallback, runs healthchecks, and outputs connection details and cleanup commands.
Agent Claude Code
Evidence Harvester — rapid code tracer for the Deep Probe phase. Traces each hypothesis through actual code paths, applies Pearl-style causal challenge to any apparent blocking protection (intervention / counterfactual / confounder), issues VALIDATED / INVALIDATED / NEEDS-DEEPER verdicts, and assigns a Fragility Score…
Agent Claude Code
Phase 14 per-finding report authoring agent. Reads a single finding directory (draft.md, debate.md, adversarial-review.md, poc script, evidence/) and writes the disclosure-ready report.md via the vuln-report skill. Runs cold-context per finding so the heavyweight PoC-building workload cannot starve the report-writing…
Agent Claude Code
Cheap-tier triage agent that classifies a single finding draft as P0/P1/P2/skip without re-investigating the underlying code. Reads only the draft frontmatter, title, and body — does not Read source files. Designed to run on a cheaper model so the orchestrator can prioritize PoC building and prune low-signal noise…
Agent Claude Code
Scans repo-local security documentation (SECURITY.md, README, docs/, threat-model files, inline pragmas) and produces a structured intent corpus of behaviors the project declares intentional and risks it explicitly acknowledges. Used by confirm mode (per-finding cross-check) and revisit mode (priority signal for…
Agent Claude Code
Phase 3 project model construction agent that classifies project type, maps attacker-controlled inputs and trust boundaries, builds DFD/CFD slices, runs domain attack research (including protocol-specific attack playbooks), and produces the threat model that drives all subsequent audit phases.
Agent Claude Code
Phase KB0 intake agent that converts staged, untrusted application documentation into a cited, security-oriented knowledge-base seed for later audit phases — without treating repository prose as agent instructions or as proof of implementation.
Agent Claude Code
Phase 3 aggregator for /piolium-longshot. Reads every per-file draft produced by the longshot-hunter swarm, deduplicates overlapping findings, ranks by severity and confidence, and writes a curated summary plus per-finding curated drafts. Does not re-run hunting.
Agent Claude Code
Hail-mary vulnerability hunter for /piolium-longshot Phase 2. Anchored on a single source file, follows imports/callers across the repo, and produces evidence-anchored draft findings. Does not build CodeQL/Semgrep databases, does not execute the application, and does not fabricate.
Agent Claude Code
Phase 2 per-patch bypass analysis agent that receives a security patch diff and tests bypass hypotheses including alternate entry points, config-gated checks, default-state gaps, parser differentials, and missing normalization.
Agent Claude Code
Phase 11a per-finding PoC construction agent that builds realistic, minimized exploit scripts for confirmed vulnerabilities, provisions real environments for Critical and High findings, captures execution evidence, and writes PoC metadata back to the finding draft. Does NOT author the disclosure-ready report.md — that…
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: