evil-mode

/evil-mode — Attack Your Own Code

Eight red-team specialists hunt your repository the way an attacker would. Unlike a plain sweep, EVIL mode grades its own findings and then tries to disprove them — so what reaches you is what survived scrutiny, not everything anyone thought of.

Findings will be uncomfortable. That is the point. This attacks your own codebase so real attackers find nothing left.

What makes this different from a one-shot scan

	Plain sweep	EVIL mode
Output	Flat list	Scored: severity × confidence × exploitability
False positives	You triage them	Adversarially refuted before you see them
Coverage	One pass	Loops until two rounds find nothing new
Handoff	Prose	Structured findings /god-mode can consume

The crew

Core (always): prompt-injection-hunter · supply-chain-auditor · secret-hunter · backdoor-hunter

Opt-in: --license · --theft · --jailbreak · --chaos · --all

Presets: --pre-public (license + theft) · --pre-launch (jailbreak + chaos)

Usage

/evil-mode                      # core 4 on the whole repo
/evil-mode src/auth             # focus a module
/evil-mode --all                # all 8 hunters
/evil-mode --pre-public         # before open-sourcing

Preview crew and cost first:

kodelythecc evil src/auth --all

Instructions to the assistant

Stage 1 — Hunt (parallel)

Launch the selected crew simultaneously via the Task tool. Give each agent its scope and tell it:

• evidence must quote the actual offending code, not describe it.
• repro must be concrete steps or a command.
• Only claim confirmed when you have actually reproduced it.
• Do not pad. Five confirmed findings beat forty guesses.

Each finding comes back as:

{ "title", "severity": "critical|high|medium|low|info",
  "confidence": "confirmed|likely|suspected|speculative",
  "exploitability": "trivial|moderate|hard|theoretical",
  "file", "line", "evidence", "repro", "fix" }