Agent harness for high-volume open-source vulnerability research + responsible disclosure.
Pattern borrowed from auto-reverse-engineer: bootstrap a per-target workspace, then loop a runtime agent. Retargeted for find → triage → private report → credit. No exploit PoCs, no attack procedures, no offensive tradecraft.
bootstrap.md— create a hunt workspace for one targetprogram.md— runtime loop inside that workspacetemplates/report.md— non-weaponized private disclosure draftSTARTER.md— ops loop, defensive tool stack, first target batch
- Run an agent with
bootstrap.md. - It creates
hunts/<slug>/for one public OSS target. - It writes
goal.md,context.md,progress.md,attempts.*,paths.md,inbox/,wiki/, copiesprogram.md+ report template. - It starts the runtime agent in a tmux session (optional).
claude "run bootstrap.md"
# or: codex / hermes / whatever harness you useAttach with tmux attach -t <slug> if bootstrap launched a session.
In: public open source only; Semgrep/CodeQL/Trivy/osv-scanner/gitleaks-style defensive analysis; manual review notes with file/function refs; private GHSA/PVR or SECURITY.md email; credit tracking.
Out: exploit code, weaponized PoCs, payloads, unauthorized access playbooks, public issues before coordinated disclosure.
| Path | Role |
|---|---|
artifacts/ |
Immutable evidence (clone metadata, scanner raw output) |
derived/ |
Triaged findings, sanitized notes |
scripts/ |
Helper scan wrappers |
logs/ |
Agent / tool logs |
wiki/ |
Compounding target knowledge |
inbox/ |
Human drops resources / answers |
reports/ |
Private disclosure drafts (never public until allowed) |
See STARTER.md for the ops loop, tool stack, and week-1 targets.