Autonomous Hacking Agent for Red Team
This report summarizes scanner evidence for BitterSecurity/Decepticon, a Python project with 5,928 GitHub stars. SynthScan examined 337,011 lines of code across 2081 source files, recording 7351 pattern matches distributed across 21 syntactic categories. The legacy adjusted pattern signal is 31.5 (High pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 4650 finding(s).
Are imports declared and package/API names verified? 1185 finding(s).
Are wrappers, guards, and repeated structures necessary? 5589 finding(s).
Which changes need focused human review? 7351 finding(s).
Run additional scans to build a history of the legacy pattern signal. Score changes are not a measure of AI adoption or code quality.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 7351 distinct pattern matches across 21 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | benchmark/harness.py | 237 | async def _cancel_and_verify_terminal( | CODE |
| LOW | benchmark/harness.py | 387 | async def _recover_postmortem_state( | CODE |
| LOW | benchmark/harness.py | 953 | def _scan_workspace_for_output(self, workspace: Path) -> str: | CODE |
| LOW | benchmark/reporter.py | 189 | def _write_challenge_evidence( | CODE |
| LOW | benchmark/provenance.py | 31 | def capture_declared_model_assignments() -> tuple[str, dict[str, list[str]]]: | CODE |
| LOW | benchmark/dreadgoad/reporter.py | 190 | def _copy_workspace_artifacts(run_dir: Path, scenario_name: str) -> None: | CODE |
| LOW⚡ | benchmark/providers/exploitbench.py | 635 | def _read_container_grade_log(self, container_id: str) -> dict[str, bool]: | CODE |
| LOW⚡ | benchmark/providers/exploitbench.py | 751 | def _iter_balanced_json_objects(text: str) -> Iterable[str]: | CODE |
| LOW | benchmark/providers/mhbench.py | 184 | def _load_generated_topologies(submodule_dir: Path) -> dict[str, TopologySpec]: | CODE |
| LOW | benchmark/providers/mhbench.py | 1161 | def _resolve_external_topology(config_abs: Path) -> ExternalTopology | None: | CODE |
| LOW | benchmark/terminal_bench/sandbox.py | 19 | def _command_with_exit_marker(command: str, marker: str) -> str: | CODE |
| LOW | clients/web/src/lib/prisma.ts | 24 | function getOrCreatePrisma(): PrismaClient { | CODE |
| LOW | …/src/components/messages/BackgroundCompleteMessage.tsx | 24 | function BackgroundCompleteMessage({ | CODE |
| LOW | clients/cli/src/commands/blue.ts | 186 | function receivedDuringCollectorRun(receivedAt: string | null | undefined, startedAt: number | null | undefined): boolea | CODE |
| LOW | config/codex_chatgpt_handler.py | 488 | async def _araise_for_stream_status(resp: httpx.Response, model: str) -> None: | CODE |
| LOW | config/perplexity_handler.py | 68 | def _exchange_session_for_access(session_token: str) -> dict[str, Any]: | CODE |
| LOW | config/perplexity_handler.py | 124 | def get_perplexity_access_token(force_refresh: bool = False) -> str: | CODE |
| LOW | config/litellm_startup.py | 113 | def _probe_ollama_if_configured() -> None: | CODE |
| LOW | config/grok_handler.py | 71 | def _exchange_session_for_access(session_token: str) -> dict[str, Any]: | CODE |
| LOW | config/litellm_dynamic_config.py | 355 | def _looks_like_model_env_var(name: str) -> bool: | CODE |
| LOW | config/litellm_dynamic_config.py | 965 | def _inject_subscription_routes( | CODE |
| LOW | config/claude_code_handler.py | 94 | def _load_credentials_from_disk(path: Path) -> dict[str, Any] | None: | CODE |
| LOW | config/claude_code_handler.py | 329 | def _resolve_anthropic_api_base(api_base: str | None) -> str: | CODE |
| LOW | config/claude_code_handler.py | 366 | def _add_conversation_cache_control( | CODE |
| LOW | config/claude_code_handler.py | 1044 | async def _araise_for_stream_status(resp: httpx.Response, model: str) -> None: | CODE |
| LOW | config/copilot_handler.py | 110 | def _read_plugin_source_token() -> str: | CODE |
| LOW | config/ollama_probe.py | 158 | def _classify_transport_error(base_url: str, err: BaseException) -> str: | CODE |
| LOW | tests/test_compose_network_isolation.py | 177 | def test_operational_services_never_on_management_network(): | CODE |
| LOW | tests/test_compose_network_isolation.py | 206 | def test_no_service_uses_host_networking(): | CODE |
| LOW | tests/test_compose_network_isolation.py | 217 | def test_only_allowlisted_services_mount_docker_socket(): | CODE |
| LOW | tests/test_compose_network_isolation.py | 249 | def test_cli_exposes_host_install_path_separately_from_container_path(monkeypatch): | CODE |
| LOW | tests/test_compose_network_isolation.py | 256 | def test_published_ports_bind_to_loopback(): | CODE |
| LOW | tests/test_compose_network_isolation.py | 300 | def test_dual_homed_services_are_allowlisted(): | CODE |
| LOW⚡ | tests/test_cve_bench_scorer.py | 13 | def test_empty_evidence_fails_all_conditions() -> None: | CODE |
| LOW⚡ | tests/test_cve_bench_scorer.py | 19 | def test_dos_requires_duration_threshold() -> None: | CODE |
| LOW⚡ | tests/test_cve_bench_scorer.py | 28 | def test_file_access_requires_secret_path_match() -> None: | CODE |
| LOW⚡ | tests/test_cve_bench_scorer.py | 42 | def test_rce_requires_exact_pwn_path() -> None: | CODE |
| LOW⚡ | tests/test_cve_bench_scorer.py | 50 | def test_db_modification_any_nonzero() -> None: | CODE |
| LOW⚡ | tests/test_cve_bench_scorer.py | 55 | def test_db_access_checks_secret_table() -> None: | CODE |
| LOW⚡ | tests/test_cve_bench_scorer.py | 63 | def test_admin_login_checks_username_match() -> None: | CODE |
| LOW⚡ | tests/test_cve_bench_scorer.py | 71 | def test_privilege_escalation_requires_strict_increase() -> None: | CODE |
| LOW⚡ | tests/test_cve_bench_scorer.py | 79 | def test_outbound_service_substring_match() -> None: | CODE |
| LOW⚡ | tests/test_cve_bench_scorer.py | 89 | def test_malformed_evidence_does_not_crash() -> None: | CODE |
| LOW⚡ | tests/test_cve_bench_scorer.py | 95 | def test_verdict_serializable_to_dict() -> None: | CODE |
| LOW⚡ | tests/test_cve_bench_scorer.py | 104 | def test_summarize_counts_per_condition() -> None: | CODE |
| LOW | tests/test_compose_langgraph_command.py | 61 | def test_default_command_includes_allow_blocking(): | CODE |
| LOW | tests/test_compose_langgraph_command.py | 69 | def test_strict_async_removes_allow_blocking(): | CODE |
| LOW | tests/test_cve_bench_loader.py | 20 | def test_win_conditions_match_upstream_readme() -> None: | CODE |
| LOW⚡ | tests/test_cve_bench_loader.py | 34 | def test_default_fixtures_present() -> None: | CODE |
| LOW⚡ | tests/test_cve_bench_loader.py | 39 | def test_load_all_default_variants() -> None: | CODE |
| LOW⚡ | tests/test_cve_bench_loader.py | 47 | def test_load_all_single_variant() -> None: | CODE |
| LOW⚡ | tests/test_cve_bench_loader.py | 53 | def test_load_one_zabbix_dual_host() -> None: | CODE |
| LOW | tests/test_cve_bench_loader.py | 64 | def test_load_one_single_host() -> None: | CODE |
| LOW | tests/test_cve_bench_loader.py | 70 | def test_challenge_id_is_stable() -> None: | CODE |
| LOW | tests/test_cve_bench_loader.py | 89 | def test_missing_required_key_raises(tmp_path: Path) -> None: | CODE |
| LOW | tests/test_cve_bench_loader.py | 96 | def test_missing_fixture_raises() -> None: | CODE |
| LOW | docs/library-usage.md | 159 | def create_decepticon_pro_agent(**kwargs): | CODE |
| LOW | docs/QUALITY_BAR.md | 328 | def test_kerberoast_skill_rejects_realm_outside_roe(): | CODE |
| LOW | docs/plugin-author-guide.md | 212 | def test_my_middleware_records_audit(): | CODE |
| LOW | …s/superpowers/plans/2026-07-10-attck-group-registry.md | 184 | def test_emit_mitre_records_emits_threat_actor_contract(tmp_path: Path) -> None: | CODE |
| 3964 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .pre-commit-config.yaml | 90 | # ── Python ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .pre-commit-config.yaml | 100 | # ── Shell ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .pre-commit-config.yaml | 115 | # ── Dockerfiles ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | .pre-commit-config.yaml | 134 | # ── Typo checker ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | .pre-commit-config.yaml | 143 | # ── Secrets scan ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | pyproject.toml | 71 | # ───────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | pyproject.toml | 76 | # ───────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | docker-compose.yml | 131 | # ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | docker-compose.yml | 210 | # ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | docker-compose.yml | 518 | # ── C2 Infrastructure (profile-based, default: c2-sliver) ─────────── | COMMENT |
| MEDIUM | docker-compose.yml | 546 | # ─── Optional: OpenTelemetry collector for self-hosted traces ────────── | COMMENT |
| MEDIUM | docker-compose.yml | 605 | # ── BloodHound Community Edition (BHCE) sidecar ──────────────────── | COMMENT |
| MEDIUM | benchmark/dreadgoad/reporter.py | 332 | # ── Per-agent grid summary ────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | benchmark/providers/exploitbench.py | 485 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | benchmark/providers/exploitbench.py | 487 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | benchmark/providers/exploitbench.py | 500 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | benchmark/providers/exploitbench.py | 502 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | benchmark/providers/exploitbench.py | 631 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | benchmark/providers/exploitbench.py | 633 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | benchmark/providers/exploitbench.py | 746 | # ---------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | benchmark/providers/exploitbench.py | 748 | # ---------------------------------------------------------------------- | COMMENT |
| MEDIUM | benchmark/providers/exploitbench.py | 209 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | benchmark/providers/exploitbench.py | 211 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | benchmark/providers/exploitbench.py | 235 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | benchmark/providers/exploitbench.py | 237 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | benchmark/providers/exploitbench.py | 307 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | benchmark/providers/exploitbench.py | 309 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | benchmark/providers/exploitbench.py | 423 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | benchmark/providers/exploitbench.py | 425 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | benchmark/providers/exploitbench.py | 728 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | benchmark/providers/exploitbench.py | 730 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | benchmark/providers/mhbench.py | 20 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | benchmark/providers/mhbench.py | 22 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | benchmark/providers/mhbench.py | 273 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | benchmark/providers/mhbench.py | 275 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | benchmark/providers/mhbench.py | 678 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | benchmark/providers/mhbench.py | 680 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | benchmark/providers/mhbench.py | 1078 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | benchmark/providers/mhbench.py | 1080 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | clients/launcher/internal/starprompt/starprompt_test.go | 78 | // ── Stage 0: ack already present ──────────────────────────────────── | COMMENT |
| MEDIUM | clients/launcher/internal/starprompt/starprompt_test.go | 95 | // ── Stage 1: non-interactive ──────────────────────────────────────── | COMMENT |
| MEDIUM | clients/launcher/internal/starprompt/starprompt_test.go | 112 | // ── Stage 2a: gh present, already starred ─────────────────────────── | COMMENT |
| MEDIUM | clients/launcher/internal/starprompt/starprompt_test.go | 129 | // ── Stage 2b: gh present, not starred, user picks Yes ─────────────── | COMMENT |
| MEDIUM | clients/launcher/internal/starprompt/starprompt_test.go | 154 | // ── Stage 2c: gh present, not starred, user picks Skip ────────────── | COMMENT |
| MEDIUM | clients/launcher/internal/starprompt/starprompt_test.go | 176 | // ── Stage 2d: gh PUT fails → browser fallback + ack ───────────────── | COMMENT |
| MEDIUM | clients/launcher/internal/starprompt/starprompt_test.go | 202 | // ── Stage 2e: gh present, status unknown → browser ────────────────── | COMMENT |
| MEDIUM | clients/launcher/internal/starprompt/starprompt_test.go | 227 | // ── Stage 3: gh absent, user picks Yes → browser ──────────────────── | COMMENT |
| MEDIUM | clients/launcher/internal/starprompt/starprompt_test.go | 251 | // ── Stage 3b: gh absent, user picks Skip ──────────────────────────── | COMMENT |
| MEDIUM | clients/launcher/internal/starprompt/starprompt_test.go | 272 | // ── Stage 3c: browser open fails → URL hint, ack still written ────── | COMMENT |
| MEDIUM | clients/launcher/internal/starprompt/starprompt_test.go | 294 | // ── Prompt routing — title matches the path ───────────────────────── | COMMENT |
| MEDIUM | clients/launcher/internal/starprompt/starprompt_test.go | 313 | // ── starStatus enum sanity ────────────────────────────────────────── | COMMENT |
| MEDIUM | clients/launcher/internal/engagement/picker.go | 167 | // ─── Bubble Tea picker ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | clients/web/server/terminal-server.ts | 53 | // ── Session Pool ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | clients/web/server/terminal-server.ts | 94 | // ── Helpers ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | clients/web/server/terminal-server.ts | 131 | // ── Connection Handler ─────────────────────────────────────────── | COMMENT |
| MEDIUM | clients/web/server/terminal-server.ts | 285 | // ── Wire a WebSocket to a Session ──────────────────────────────── | COMMENT |
| MEDIUM | clients/web/server/terminal-server.ts | 335 | // ── Server lifecycle ───────────────────────────────────────────── | COMMENT |
| MEDIUM | …web/src/app/(dashboard)/engagements/[id]/plan/page.tsx | 20 | // ── Document metadata ────────────────────────────────────────────── | COMMENT |
| MEDIUM | …web/src/app/(dashboard)/engagements/[id]/plan/page.tsx | 29 | // ── Status helpers ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | …web/src/app/(dashboard)/engagements/[id]/plan/page.tsx | 47 | // ── Section component ────────────────────────────────────────────── | COMMENT |
| 897 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | decepticon_tbench_agent.py | 5 | CODE | |
| LOW | benchmark/runner.py | 1 | CODE | |
| LOW | benchmark/harness.py | 1 | CODE | |
| LOW | benchmark/config.py | 1 | CODE | |
| LOW | benchmark/reporter.py | 1 | CODE | |
| LOW | benchmark/__init__.py | 1 | CODE | |
| LOW | benchmark/__init__.py | 3 | CODE | |
| LOW | benchmark/__init__.py | 4 | CODE | |
| LOW | benchmark/__init__.py | 4 | CODE | |
| LOW | benchmark/__init__.py | 4 | CODE | |
| LOW | benchmark/__init__.py | 4 | CODE | |
| LOW | benchmark/__init__.py | 4 | CODE | |
| LOW | benchmark/schemas.py | 1 | CODE | |
| LOW | benchmark/provenance.py | 1 | CODE | |
| LOW | benchmark/state.py | 1 | CODE | |
| LOW | benchmark/scorer.py | 1 | CODE | |
| LOW | benchmark/cve_bench/dry_run.py | 12 | CODE | |
| LOW | benchmark/cve_bench/runner.py | 9 | CODE | |
| LOW | benchmark/cve_bench/loader.py | 9 | CODE | |
| LOW | benchmark/cve_bench/live.py | 8 | CODE | |
| LOW | benchmark/cve_bench/scorer.py | 9 | CODE | |
| LOW | benchmark/dreadgoad/runner.py | 10 | CODE | |
| LOW | benchmark/dreadgoad/harness.py | 16 | CODE | |
| LOW | benchmark/dreadgoad/config.py | 16 | CODE | |
| LOW | benchmark/dreadgoad/reporter.py | 30 | CODE | |
| LOW | benchmark/dreadgoad/schemas.py | 9 | CODE | |
| LOW | benchmark/dreadgoad/__main__.py | 15 | CODE | |
| LOW | benchmark/dreadgoad/state.py | 9 | CODE | |
| LOW | benchmark/dreadgoad/providers/dreadgoad.py | 14 | CODE | |
| LOW | benchmark/dreadgoad/providers/base.py | 17 | CODE | |
| LOW | benchmark/dreadgoad/lab/dreadgoad_cli.py | 13 | CODE | |
| LOW | benchmark/providers/exploitbench.py | 54 | CODE | |
| LOW | benchmark/providers/exploitbench_capabilities.py | 35 | CODE | |
| LOW | benchmark/providers/__init__.py | 1 | CODE | |
| LOW | benchmark/providers/__init__.py | 3 | CODE | |
| LOW | benchmark/providers/__init__.py | 4 | CODE | |
| LOW | benchmark/providers/__init__.py | 5 | CODE | |
| LOW | benchmark/providers/__init__.py | 6 | CODE | |
| LOW | benchmark/providers/cybench.py | 24 | CODE | |
| LOW | benchmark/providers/mhbench.py | 1 | CODE | |
| LOW | benchmark/providers/cybergym.py | 36 | CODE | |
| LOW | benchmark/providers/xbow.py | 1 | CODE | |
| LOW | benchmark/providers/buttercup.py | 34 | CODE | |
| LOW | benchmark/providers/base.py | 1 | CODE | |
| LOW | benchmark/terminal_bench/__init__.py | 1 | CODE | |
| LOW | benchmark/terminal_bench/trajectory.py | 1 | CODE | |
| LOW | benchmark/terminal_bench/sandbox.py | 1 | CODE | |
| LOW | benchmark/terminal_bench/agent.py | 1 | CODE | |
| LOW | config/oauth_token_store.py | 26 | CODE | |
| LOW | config/auth_handler.py | 26 | CODE | |
| LOW | config/codex_chatgpt_handler.py | 23 | CODE | |
| LOW | config/perplexity_handler.py | 14 | CODE | |
| LOW | config/http_client.py | 26 | CODE | |
| LOW | config/litellm_startup.py | 11 | CODE | |
| LOW | config/grok_handler.py | 16 | CODE | |
| LOW | config/litellm_dynamic_config.py | 17 | CODE | |
| LOW | config/gemini_handler.py | 14 | CODE | |
| LOW | config/claude_code_handler.py | 24 | CODE | |
| LOW | config/copilot_handler.py | 44 | CODE | |
| LOW | config/ollama_probe.py | 14 | CODE | |
| 1093 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | benchmark/harness.py | 468 | except Exception: | CODE |
| HIGH | benchmark/harness.py | 287 | except asyncio.TimeoutError: | CODE |
| HIGH | benchmark/harness.py | 357 | except Exception: | CODE |
| HIGH | benchmark/harness.py | 455 | except Exception: | CODE |
| HIGH | benchmark/harness.py | 484 | except Exception: | CODE |
| HIGH | benchmark/harness.py | 858 | except asyncio.TimeoutError: | CODE |
| HIGH | benchmark/dreadgoad/harness.py | 307 | except (TypeError, ValueError): | CODE |
| HIGH | benchmark/dreadgoad/state.py | 64 | except OSError: | CODE |
| HIGH | benchmark/providers/xbow.py | 276 | except subprocess.CalledProcessError: | CODE |
| HIGH | config/oauth_token_store.py | 135 | except OSError: | CODE |
| HIGH | config/oauth_token_store.py | 140 | except OSError: | CODE |
| HIGH | config/oauth_token_store.py | 152 | except OSError: | CODE |
| HIGH | config/claude_code_handler.py | 682 | except ValueError: | CODE |
| HIGH | examples/blue-local-sensor/smoke_test.py | 80 | except OSError: | CODE |
| HIGH | examples/blue-local-sensor/blue_receiver.py | 739 | except (BrokenPipeError, ConnectionResetError, TimeoutError): | CODE |
| HIGH | examples/blue-local-sensor/capture_process.py | 33 | except ProcessLookupError: | CODE |
| HIGH | examples/blue-local-sensor/blue_monitor.py | 737 | except (KeyError, TypeError, ValueError): | CODE |
| HIGH | examples/blue-local-sensor/watch_smoke_test.py | 91 | except OSError: | CODE |
| HIGH | …ages/decepticon-sdk/tests/test_compat_shim_identity.py | 68 | except AttributeError: | CODE |
| HIGH | packages/decepticon-core/decepticon_core/types/roe.py | 280 | except ValueError: | CODE |
| HIGH | packages/decepticon-core/decepticon_core/types/roe.py | 88 | except ValueError: | CODE |
| HIGH | packages/decepticon-core/decepticon_core/types/roe.py | 96 | except ValueError: | CODE |
| HIGH | …ckages/decepticon/decepticon/middleware/_audit_sink.py | 146 | except OSError: | CODE |
| HIGH | …s/decepticon/decepticon/middleware/_command_targets.py | 153 | except ValueError: | CODE |
| HIGH | …s/decepticon/decepticon/middleware/_command_targets.py | 428 | except Exception: | CODE |
| HIGH | …s/decepticon/decepticon/middleware/_command_targets.py | 210 | except OSError: | CODE |
| HIGH | packages/decepticon/decepticon/middleware/filesystem.py | 93 | except Exception: | CODE |
| HIGH | …ecepticon/decepticon/middleware/context_engineering.py | 44 | except json.JSONDecodeError: | CODE |
| HIGH | …ckages/decepticon/decepticon/middleware/scan_resume.py | 86 | except Exception: | CODE |
| HIGH | packages/decepticon/decepticon/middleware/engagement.py | 201 | except ValueError: | CODE |
| HIGH | packages/decepticon/decepticon/blue_cell/tap.py | 102 | except (ValueError, AttributeError): | CODE |
| HIGH | packages/decepticon/decepticon/tools/opplan.py | 145 | except ValueError: | CODE |
| HIGH | packages/decepticon/decepticon/tools/opplan.py | 1285 | except Exception: # noqa: BLE001 — telemetry must never break the tool | CODE |
| HIGH | …pticon/decepticon/tools/research/subdomain_takeover.py | 256 | except OSError: | CODE |
| HIGH | …s/decepticon/decepticon/tools/research/shared_notes.py | 52 | except (OSError, json.JSONDecodeError): | CODE |
| HIGH | …/decepticon/decepticon/tools/research/exploit_intel.py | 161 | except Exception: | CODE |
| HIGH | …ges/decepticon/decepticon/tools/research/agent_todo.py | 41 | except (OSError, json.JSONDecodeError): | CODE |
| HIGH | …/decepticon/decepticon/tools/research/scanner_tools.py | 460 | except json.JSONDecodeError: | CODE |
| HIGH | …ecepticon/decepticon/tools/research/coverage_ledger.py | 61 | except (OSError, json.JSONDecodeError): | CODE |
| HIGH | packages/decepticon/decepticon/tools/research/sarif.py | 72 | except (TypeError, ValueError): | CODE |
| HIGH | …s/decepticon/decepticon/tools/research/sarif_export.py | 91 | except (TypeError, ValueError): | CODE |
| HIGH | …s/decepticon/decepticon/tools/research/sarif_export.py | 96 | except (TypeError, ValueError): | CODE |
| HIGH | packages/decepticon/decepticon/tools/research/bounty.py | 341 | except Exception: # noqa: BLE001 — telemetry must never break the tool | CODE |
| HIGH | packages/decepticon/decepticon/tools/research/poc.py | 368 | except Exception: # noqa: BLE001 — telemetry must never break the tool | CODE |
| HIGH | packages/decepticon/decepticon/tools/research/poc.py | 427 | except ValueError: | CODE |
| HIGH | …ticon/decepticon/tools/reporting/finding_epistemics.py | 127 | except Exception: | CODE |
| HIGH | …ecepticon/decepticon/tools/reporting/finding_dedupe.py | 39 | except Exception: | CODE |
| HIGH | …ckages/decepticon/decepticon/tools/reporting/viewer.py | 202 | except Exception: | CODE |
| HIGH | …ckages/decepticon/decepticon/tools/reporting/viewer.py | 118 | except Exception: | CODE |
| HIGH | …ckages/decepticon/decepticon/tools/reporting/viewer.py | 131 | except Exception: | CODE |
| HIGH | …ckages/decepticon/decepticon/tools/reporting/viewer.py | 140 | except Exception: | CODE |
| HIGH | …ckages/decepticon/decepticon/tools/reporting/viewer.py | 149 | except Exception: | CODE |
| HIGH | …ckages/decepticon/decepticon/tools/reporting/viewer.py | 158 | except Exception: | CODE |
| HIGH | …ckages/decepticon/decepticon/tools/reporting/viewer.py | 170 | except Exception: | CODE |
| HIGH | …ckages/decepticon/decepticon/tools/reporting/export.py | 212 | except Exception: | CODE |
| HIGH | …ckages/decepticon/decepticon/tools/reporting/export.py | 110 | except Exception: | CODE |
| HIGH | …ckages/decepticon/decepticon/tools/reporting/export.py | 259 | except (OSError, json.JSONDecodeError): | CODE |
| HIGH | …ckages/decepticon/decepticon/tools/reporting/export.py | 172 | except (OSError, json.JSONDecodeError): | CODE |
| HIGH | packages/decepticon/decepticon/tools/reporting/sarif.py | 189 | except (TypeError, ValueError): | CODE |
| HIGH | …kages/decepticon/decepticon/tools/reporting/ci_gate.py | 50 | except Exception: | CODE |
| 49 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | benchmark/harness.py | 179 | except Exception as exc: | CODE |
| LOW | benchmark/harness.py | 187 | except Exception as exc: | CODE |
| LOW | benchmark/harness.py | 229 | except Exception as exc: | CODE |
| LOW | benchmark/harness.py | 289 | except Exception as exc: | CODE |
| LOW | benchmark/harness.py | 357 | except Exception: | CODE |
| LOW | benchmark/harness.py | 420 | except Exception as exc: | CODE |
| LOW | benchmark/harness.py | 455 | except Exception: | CODE |
| LOW | benchmark/harness.py | 468 | except Exception: | CODE |
| LOW | benchmark/harness.py | 484 | except Exception: | CODE |
| LOW | benchmark/harness.py | 688 | except Exception as exc: | CODE |
| LOW | benchmark/harness.py | 810 | except Exception as exc: | CODE |
| LOW | benchmark/harness.py | 878 | except Exception as exc: | CODE |
| LOW | benchmark/harness.py | 899 | except Exception as exc: | CODE |
| LOW | benchmark/cve_bench/runner.py | 48 | except Exception as exc: # pragma: no cover — surfaced via Verdict.error | CODE |
| LOW | benchmark/cve_bench/live.py | 158 | except Exception: | CODE |
| LOW | benchmark/dreadgoad/runner.py | 141 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW⚡ | benchmark/dreadgoad/harness.py | 428 | except Exception as cancel_exc: # noqa: BLE001 | CODE |
| LOW | benchmark/dreadgoad/harness.py | 460 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | benchmark/dreadgoad/__main__.py | 82 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | benchmark/providers/cybench.py | 201 | except Exception: | CODE |
| LOW | benchmark/providers/xbow.py | 192 | except Exception: | CODE |
| LOW | config/litellm_startup.py | 140 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | docs/QUALITY_BAR.md | 210 | except Exception: | CODE |
| LOW | docs/QUALITY_BAR.md | 222 | except Exception: | CODE |
| LOW | docs/design/opplan-middleware.md | 226 | except Exception as e: | CODE |
| LOW | scripts/install.sh | 165 | except Exception: | CODE |
| LOW | scripts/install.sh | 183 | except Exception: | CODE |
| LOW⚡ | …kages/decepticon-core/decepticon_core/plugin_loader.py | 392 | except Exception: # pragma: no cover — importlib quirks across versions | CODE |
| LOW⚡ | …kages/decepticon-core/decepticon_core/plugin_loader.py | 399 | except Exception: | CODE |
| LOW⚡ | …kages/decepticon-core/decepticon_core/plugin_loader.py | 408 | except Exception: | CODE |
| LOW⚡ | …kages/decepticon-core/decepticon_core/plugin_loader.py | 485 | except Exception: # pragma: no cover — importlib quirks | CODE |
| LOW⚡ | …kages/decepticon-core/decepticon_core/plugin_loader.py | 492 | except Exception: # noqa: BLE001 | CODE |
| LOW⚡ | …kages/decepticon-core/decepticon_core/plugin_loader.py | 502 | except Exception: # noqa: BLE001 | CODE |
| LOW⚡ | …kages/decepticon-core/decepticon_core/plugin_loader.py | 540 | except Exception: # pragma: no cover | CODE |
| LOW⚡ | …kages/decepticon-core/decepticon_core/plugin_loader.py | 547 | except Exception: # noqa: BLE001 | CODE |
| LOW⚡ | …kages/decepticon-core/decepticon_core/plugin_loader.py | 554 | except Exception: # noqa: BLE001 | CODE |
| LOW | …kages/decepticon-core/decepticon_core/plugin_loader.py | 122 | except Exception: | CODE |
| LOW | …kages/decepticon-core/decepticon_core/plugin_loader.py | 134 | except Exception: | CODE |
| LOW | …kages/decepticon-core/decepticon_core/plugin_loader.py | 575 | except Exception: # pragma: no cover | CODE |
| LOW | …kages/decepticon-core/decepticon_core/plugin_loader.py | 582 | except Exception: | CODE |
| LOW | …kages/decepticon-core/decepticon_core/plugin_loader.py | 607 | except Exception: | CODE |
| LOW | …kages/decepticon-core/decepticon_core/plugin_loader.py | 673 | except Exception: # pragma: no cover | CODE |
| LOW | …es/decepticon-core/decepticon_core/registry/plugins.py | 125 | except Exception: # pragma: no cover — importlib quirks | CODE |
| LOW | …ages/decepticon/decepticon/middleware/event_logging.py | 380 | except Exception: # noqa: BLE001 — never break the agent on a bad path | CODE |
| LOW | …ages/decepticon/decepticon/middleware/event_logging.py | 410 | except Exception: # noqa: BLE001 — logging must never break the run | CODE |
| LOW | …ages/decepticon/decepticon/middleware/event_logging.py | 511 | except Exception: # noqa: BLE001 — never break the run on a bad RoE file | CODE |
| LOW | …ages/decepticon/decepticon/middleware/event_logging.py | 519 | except Exception: # noqa: BLE001 — never break the run on a bad RoE file | CODE |
| LOW | …ages/decepticon/decepticon/middleware/event_logging.py | 581 | except Exception: # noqa: BLE001 — telemetry must never break the run | CODE |
| LOW | …ages/decepticon/decepticon/middleware/event_logging.py | 612 | except Exception: # noqa: BLE001 — telemetry must never break the run | CODE |
| LOW | …ticon/decepticon/middleware/prompt_injection_shield.py | 249 | except Exception: # noqa: BLE001 | CODE |
| LOW | …ticon/decepticon/middleware/prompt_injection_shield.py | 261 | except Exception as e: # noqa: BLE001 | CODE |
| LOW | …ticon/decepticon/middleware/prompt_injection_shield.py | 341 | except Exception as e: # noqa: BLE001 - registry optional; fall back below | CODE |
| LOW | …ticon/decepticon/middleware/prompt_injection_shield.py | 352 | except Exception as e: # noqa: BLE001 - skillogy optional; fall back below | CODE |
| LOW | …icon/decepticon/middleware/opscontrol_notifications.py | 122 | except Exception as exc: # noqa: BLE001 — defensive | CODE |
| LOW | …s/decepticon/decepticon/middleware/_command_targets.py | 428 | except Exception: | CODE |
| LOW | packages/decepticon/decepticon/middleware/skillogy.py | 283 | except Exception as exc: # noqa: BLE001 — surface as ToolMessage payload | STRING |
| LOW | packages/decepticon/decepticon/middleware/skillogy.py | 353 | except Exception as exc: # noqa: BLE001 | STRING |
| LOW | packages/decepticon/decepticon/middleware/skillogy.py | 387 | except Exception as exc: # noqa: BLE001 | STRING |
| LOW | packages/decepticon/decepticon/middleware/skillogy.py | 573 | except Exception as exc: # noqa: BLE001 | STRING |
| LOW | packages/decepticon/decepticon/middleware/skillogy.py | 579 | except Exception as exc: # noqa: BLE001 | STRING |
| 265 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | clients/launcher/cmd/onboard.go | 290 | // Step 0: system check. | COMMENT |
| LOW⚡ | clients/launcher/cmd/onboard.go | 300 | // Step 1: Auth methods (multi-select) | COMMENT |
| LOW | clients/launcher/cmd/onboard.go | 793 | // Step 3: Model profile | COMMENT |
| LOW | clients/launcher/cmd/onboard.go | 806 | // Step 4: Language | COMMENT |
| LOW | docs/setup-guide.md | 764 | ### Step 1: Install the CLI | COMMENT |
| LOW | docs/setup-guide.md | 782 | ### Step 2: Run the Setup Wizard | COMMENT |
| LOW | docs/setup-guide.md | 801 | ### Step 3: Launch the Platform | COMMENT |
| LOW | docs/setup-guide.md | 817 | ### Step 4: Service Architecture | COMMENT |
| LOW | docs/setup-guide.md | 831 | ### Step 5: Create Your First Engagement | COMMENT |
| LOW | docs/setup-guide.md | 847 | ### Step 6: The Soundwave Interview | COMMENT |
| LOW | docs/setup-guide.md | 878 | ### Step 7: Autonomous Execution | COMMENT |
| LOW | docs/setup-guide.md | 899 | ### Step 8: Monitor in Real Time | COMMENT |
| LOW | docs/setup-guide.md | 913 | ### Step 9: Post-Engagement | COMMENT |
| LOW | packages/decepticon/decepticon/tools/research/patch.py | 210 | # Step 1: optional test suite. | COMMENT |
| LOW | packages/decepticon/decepticon/tools/research/patch.py | 229 | # Step 2: re-run the PoC. | COMMENT |
| LOW | packages/decepticon/decepticon/tools/research/patch.py | 241 | # Step 3: crash-vs-fix detection. | COMMENT |
| LOW⚡ | packages/decepticon/decepticon/tools/bash/bash.py | 233 | # Step 1: surrogate safety | COMMENT |
| LOW⚡ | packages/decepticon/decepticon/tools/bash/bash.py | 235 | # Step 2: strip ANSI | COMMENT |
| LOW⚡ | packages/decepticon/decepticon/tools/bash/bash.py | 237 | # Step 3: compress repetition | COMMENT |
| LOW | …ges/decepticon/decepticon/skills/shared/opsec/SKILL.md | 77 | # Step 1: Get a current, real User-Agent from your own browser or a live source | COMMENT |
| LOW | …ges/decepticon/decepticon/skills/shared/opsec/SKILL.md | 81 | # Step 2: Build a rotation list with CURRENT versions | COMMENT |
| LOW | …n/decepticon/skills/standard/exploit/web/sqli/SKILL.md | 185 | # Step 1: try common trivial passwords in-process (covers ~60% of CTF hashes) | COMMENT |
| LOW⚡ | …n/decepticon/skills/standard/exploit/web/sqli/SKILL.md | 196 | # Step 2: wordlist crack with hashcat (if installed) | COMMENT |
| LOW⚡ | …n/decepticon/skills/standard/exploit/web/sqli/SKILL.md | 200 | # Step 3: john fallback | COMMENT |
| LOW⚡ | …n/decepticon/skills/standard/exploit/web/sqli/SKILL.md | 205 | # Step 4: application-context variants (username, app name as base) | COMMENT |
| LOW | …n/decepticon/skills/standard/exploit/web/sqli/SKILL.md | 219 | # Step 1: probe string length first (binary search) | COMMENT |
| LOW | …n/decepticon/skills/standard/exploit/web/sqli/SKILL.md | 231 | # Step 2: parallel character extraction (10-20 concurrent jobs) | COMMENT |
| LOW | …n/decepticon/skills/standard/exploit/web/sqli/SKILL.md | 251 | # Step 3: reconstruct string from per-position files | COMMENT |
| LOW⚡ | …n/skills/standard/exploit/web/mass-assignment/SKILL.md | 99 | # Step 1: Register normal account | COMMENT |
| LOW⚡ | …n/skills/standard/exploit/web/mass-assignment/SKILL.md | 107 | # Step 2: Login + check | COMMENT |
| LOW⚡ | …n/skills/standard/exploit/web/mass-assignment/SKILL.md | 113 | # Step 3: Use admin powers | COMMENT |
| LOW | …n/decepticon/skills/standard/exploit/web/bfla/SKILL.md | 80 | ### Step 1: Baseline with Admin Token | COMMENT |
| LOW | …n/decepticon/skills/standard/exploit/web/bfla/SKILL.md | 91 | ### Step 2: Replay with Lower-Privilege Token | COMMENT |
| LOW | …n/decepticon/skills/standard/exploit/web/bfla/SKILL.md | 106 | ### Step 3: Method Alternation | COMMENT |
| LOW | …n/decepticon/skills/standard/exploit/web/bfla/SKILL.md | 123 | ### Step 4: Transport / Encoding Alternation | COMMENT |
| LOW | …n/decepticon/skills/standard/exploit/web/bfla/SKILL.md | 135 | ### Step 5: GraphQL Mutations | COMMENT |
| LOW | …n/decepticon/skills/standard/exploit/web/bfla/SKILL.md | 153 | ### Step 6: Background Jobs and Webhooks | COMMENT |
| LOW | …n/decepticon/skills/standard/exploit/web/bfla/SKILL.md | 168 | ### Step 7: Header Trust Bypass | COMMENT |
| LOW | …n/skills/standard/exploit/web/cache-deception/SKILL.md | 31 | # Step 1: visit authenticated page w/ a fake .css path | COMMENT |
| LOW | …n/skills/standard/exploit/web/cache-deception/SKILL.md | 39 | # Step 2: from unauth session | COMMENT |
| LOW | …n/decepticon/skills/standard/exploit/web/ssti/SKILL.md | 212 | # Step 1: exfiltrate target file to /tmp/out via RCE (replace /.env with discovered path) | COMMENT |
| LOW | …n/decepticon/skills/standard/exploit/web/ssti/SKILL.md | 214 | # Step 2: read via LFI or a file-serving endpoint if available | COMMENT |
| LOW | …n/decepticon/skills/standard/exploit/web/ssti/SKILL.md | 234 | # Step 1: enumerate all subclasses (save to file — output can be large) | COMMENT |
| LOW | …n/decepticon/skills/standard/exploit/web/ssti/SKILL.md | 248 | # Step 2: use the index to call Popen (common indices: 200-280 in py3.10+, 132-200 in py3.8) | COMMENT |
| LOW | …epticon/skills/standard/exploit/web/smuggling/SKILL.md | 433 | # Step 1: smuggle an inner GET /admin_panel with a Cache-Control hint | COMMENT |
| LOW | …epticon/skills/standard/exploit/web/smuggling/SKILL.md | 434 | # Step 2: from a different connection, GET / (or the public path the cache keys on) | COMMENT |
| LOW | …/skills/standard/exploit/web/header-injection/SKILL.md | 111 | # Step 1: Poison the cache with a malicious host | COMMENT |
| LOW | …/skills/standard/exploit/web/header-injection/SKILL.md | 115 | # Step 2: Verify the cached response serves the poisoned content to a clean client | COMMENT |
| LOW⚡ | …lls/standard/exploit/edge-device-exploitation/SKILL.md | 84 | # Step 1: Verify web UI is accessible | COMMENT |
| LOW⚡ | …lls/standard/exploit/edge-device-exploitation/SKILL.md | 87 | # Step 2: Create implant account (the exploit request) | COMMENT |
| LOW⚡ | …lls/standard/exploit/edge-device-exploitation/SKILL.md | 92 | # Step 3: Access via SSH with implant account | COMMENT |
| LOW⚡ | …lls/standard/exploit/edge-device-exploitation/SKILL.md | 95 | # Step 4: Check for existing implant (IOC detection) | COMMENT |
| LOW⚡ | …lls/standard/exploit/edge-device-exploitation/SKILL.md | 106 | # Step 1: Auth bypass (CVE-2023-46805) — path traversal | COMMENT |
| LOW⚡ | …lls/standard/exploit/edge-device-exploitation/SKILL.md | 110 | # Step 2: Command injection via REST API | COMMENT |
| LOW⚡ | …lls/standard/exploit/edge-device-exploitation/SKILL.md | 115 | # Step 3: Read output | COMMENT |
| LOW⚡ | …lls/standard/exploit/edge-device-exploitation/SKILL.md | 128 | # Step 1: Confirm GlobalProtect is exposed | COMMENT |
| LOW⚡ | …lls/standard/exploit/edge-device-exploitation/SKILL.md | 131 | # Step 2: Exploit — inject via SESSID cookie | COMMENT |
| LOW⚡ | …lls/standard/exploit/edge-device-exploitation/SKILL.md | 136 | # Step 3: Retrieve command output | COMMENT |
| LOW⚡ | …lls/standard/exploit/edge-device-exploitation/SKILL.md | 139 | # Step 4: Reverse shell | COMMENT |
| LOW | …lls/standard/exploit/edge-device-exploitation/SKILL.md | 150 | # Step 1: Confirm FortiManager FGFM service (port 541) | COMMENT |
| 73 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .pre-commit-config.yaml | 1 | # Pre-commit hooks — install with: uvx pre-commit install | COMMENT |
| LOW | .pre-commit-config.yaml | 21 | # noisier "auto-fix everything" hooks. These hooks still apply to new | COMMENT |
| LOW | docker-compose.dev.yml | 1 | # Docker Compose override for development workflows. | COMMENT |
| LOW | docker-compose.dev.yml | 21 | # `docker-compose.override.yml` into `~/.decepticon/`. | COMMENT |
| LOW | docker-compose.watch.yml | 1 | # docker-compose.watch.yml — hot-reload overrides for development | COMMENT |
| LOW | docker-compose.yml | 121 | # heap_max 256m + pagecache 64m + JVM/APOC off-heap ≈ <1g nominal. | COMMENT |
| LOW | docker-compose.yml | 141 | # the sandbox. Allowing arbitrary APOC procedures - especially the | COMMENT |
| LOW | docker-compose.yml | 201 | # Linux arm64 hosts pull the native manifest; no Rosetta needed. | COMMENT |
| LOW | docker-compose.yml | 221 | # frida/gdb in the Reverser path, SETUID/SETGID for tools like | COMMENT |
| LOW | docker-compose.yml | 261 | # Bind is engagement-scoped. The launcher sets DECEPTICON_ENGAGEMENT_WORKSPACE | COMMENT |
| LOW | docker-compose.yml | 301 | restart: unless-stopped | COMMENT |
| LOW | docker-compose.yml | 361 | - BLUE_SENSOR_URL=http://blue-receiver:8082 | COMMENT |
| LOW | docker-compose.yml | 541 | restart: unless-stopped | COMMENT |
| LOW | docker-compose.yml | 601 | - decepticon-net | COMMENT |
| LOW | .typos.toml | 21 | # is correct (mis-fire, mis-split, mis-configure, mis-allocation). | COMMENT |
| LOW | benchmark/harness.py | 641 | # not still hitting the target when we tear it down (the | COMMENT |
| LOW | benchmark/config.py | 41 | # ``exploitbench_bridge_runtime`` selects the stdio→TCP bridge binary | COMMENT |
| LOW | benchmark/schemas.py | 41 | # default; Cybench carries the competition-native format per task | COMMENT |
| LOW | benchmark/schemas.py | 101 | # trace tree without needing thread_id-based metadata filtering. | COMMENT |
| LOW | benchmark/schemas.py | 121 | # only for sequential runs (parallel=1) — concurrent challenges | COMMENT |
| LOW | benchmark/dreadgoad/harness.py | 41 | # ``DECEPTICON_SANDBOX_CONTAINER`` when running outside the standard stack. | COMMENT |
| LOW | benchmark/dreadgoad/schemas.py | 21 | rounds: int | COMMENT |
| LOW | benchmark/dreadgoad/configs/apt-shared-lab-grid.yaml | 1 | name: apt-shared-lab-grid | COMMENT |
| LOW | benchmark/providers/mhbench.py | 21 | # Topology metadata model | COMMENT |
| LOW | benchmark/providers/mhbench.py | 101 | # e.g. Chain2Hosts ``host_1`` > ``host_0`` | COMMENT |
| LOW | benchmark/providers/mhbench.py | 1221 | if matches: | COMMENT |
| LOW | benchmark/configs/cybergym-subset.yaml | 1 | # Decepticon CyberGym adapter — 10-task subset cohort. | COMMENT |
| LOW | benchmark/configs/exploitbench-smoke.yaml | 1 | # Decepticon ExploitBench adapter — one-bug smoke. | COMMENT |
| LOW | benchmark/configs/exploitbench-v8-small.yaml | 1 | # Decepticon ExploitBench adapter — 14-bug baseline cohort. | COMMENT |
| LOW | clients/launcher/cmd/onboard.go | 81 | defaultLMStudioModel = "qwen2.5-coder-7b-instruct" | COMMENT |
| LOW | clients/launcher/cmd/start.go | 41 | COMMENT | |
| LOW | clients/launcher/cmd/start.go | 241 | // false → skip entirely (air-gapped / version-pinned deploys) | COMMENT |
| LOW | clients/launcher/cmd/start.go | 341 | } | COMMENT |
| LOW | clients/launcher/cmd/start.go | 421 | } | COMMENT |
| LOW | clients/launcher/cmd/remove.go | 141 | COMMENT | |
| LOW | clients/launcher/cmd/opscontrol/opscontrol.go | 1 | // Package opscontrol exposes the `decepticon opscontrol` Cobra | COMMENT |
| LOW | clients/launcher/cmd/opscontrol/supervisor.go | 21 | // it embedded in the launcher binary collapses the previous | COMMENT |
| LOW | clients/launcher/cmd/opscontrol/supervisor.go | 41 | COMMENT | |
| LOW | clients/launcher/cmd/opscontrol/supervisor.go | 61 | // daemon lifecycle is owned by the init system — survives | COMMENT |
| LOW | clients/launcher/cmd/opscontrol/daemon.go | 41 | backend := internal.NewDockerComposeBackend() | COMMENT |
| LOW | clients/launcher/cmd/opscontrol/install.go | 81 | // systemd's `enable --now` returns as soon as the unit transitions | COMMENT |
| LOW | clients/launcher/internal/starprompt/starprompt.go | 1 | // Package starprompt presents a one-time GitHub star ask at the natural | COMMENT |
| LOW | clients/launcher/internal/opscontrol/paths.go | 61 | // $DECEPTICON_HOME so rootless / WSL2 / Mac users do not need write | COMMENT |
| LOW | clients/launcher/internal/opscontrol/paths.go | 101 | } | COMMENT |
| LOW | clients/launcher/internal/opscontrol/paths.go | 121 | // up its own decepticon-* containers). | COMMENT |
| LOW | clients/launcher/internal/opscontrol/paths.go | 141 | } | COMMENT |
| LOW | clients/launcher/internal/opscontrol/paths.go | 181 | // silently bleed into every up/stop/config call -- if it does, | COMMENT |
| LOW | clients/launcher/internal/opscontrol/backend.go | 41 | // workloads. ADR-0006 §5' lists DockerComposeBackend, KubernetesBackend, | COMMENT |
| LOW | clients/launcher/internal/opscontrol/server.go | 201 | workload := r.PathValue("workload") | COMMENT |
| LOW | clients/launcher/internal/opscontrol/service.go | 1 | package opscontrol | COMMENT |
| LOW | clients/launcher/internal/opscontrol/service.go | 21 | // systemd, Linux without per-user systemd) | COMMENT |
| LOW | clients/launcher/internal/opscontrol/service.go | 61 | } | COMMENT |
| LOW | clients/launcher/internal/opscontrol/systemd.go | 21 | UnitName string // e.g. "decepticon-opscontrol" or "decepticon-opscontrol-stack2" | COMMENT |
| LOW | clients/launcher/internal/opscontrol/systemd.go | 241 | // | COMMENT |
| LOW | clients/launcher/internal/opscontrol/systemd.go | 261 | // when enabled. Socket activation is a future-Sprint reduction. | COMMENT |
| LOW | …launcher/internal/opscontrol/docker_compose_backend.go | 21 | // so profile resolution (depends_on chains, healthchecks, wait | COMMENT |
| LOW | …launcher/internal/opscontrol/docker_compose_backend.go | 141 | // caller (server.go) has already taken the per-workload mutex, so | COMMENT |
| LOW | …launcher/internal/opscontrol/docker_compose_backend.go | 201 | // | COMMENT |
| LOW | …launcher/internal/opscontrol/docker_compose_backend.go | 301 | // List delegates to the in-memory registry. ADR-0006 §5' allows the | COMMENT |
| LOW | clients/launcher/internal/config/config.go | 221 | // credential signal so an empty path doesn't pass startup gating. | COMMENT |
| 133 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | benchmark/harness.py | 373 | "pkill -9 -f python3 2>/dev/null || true; " | CODE |
| HIGH⚡ | benchmark/harness.py | 374 | "pkill -9 -f curl 2>/dev/null || true; " | CODE |
| HIGH⚡ | benchmark/harness.py | 375 | "tmux kill-server 2>/dev/null || true; " | CODE |
| HIGH⚡ | benchmark/harness.py | 376 | "tmux new-session -d -s main 2>/dev/null || true", | CODE |
| HIGH | benchmark/dreadgoad/reporter.py | 258 | f"cd /workspace && tar czf {sandbox_tar} {scenario_name}/", | CODE |
| HIGH | benchmark/providers/exploitbench.py | 179 | 4. ``teardown`` — ``docker stop && docker rm`` plus bridge cleanup. | STRING |
| HIGH | config/codex_chatgpt_handler.py | 887 | yield from accumulator.push(line) | CODE |
| HIGH | config/codex_chatgpt_handler.py | 927 | for chunk in accumulator.push(line): | CODE |
| HIGH | config/claude_code_handler.py | 1028 | for chunk in feed.push(line): | CODE |
| HIGH | config/claude_code_handler.py | 1245 | yield from accumulator.push(line) | CODE |
| HIGH | tests/test_compose_network_isolation.py | 150 | (``{a: null, b: {aliases: ...}}``). Both shapes mean | STRING |
| HIGH | packages/decepticon/decepticon/tools/research/patch.py | 172 | ``"cd /workspace/target && pytest -q tests/security/"``). | STRING |
| HIGH | packages/decepticon/decepticon/tools/research/patch.py | 177 | ``poc_still_fires`` (bool), ``tests_passed`` (bool or null), | STRING |
| HIGH | packages/decepticon/decepticon/tools/research/fuzz.py | 193 | // Create with: cargo fuzz init && cargo fuzz add {entry} | COMMENT |
| HIGH | packages/decepticon/decepticon/tools/ad/bhce_client.py | 16 | OperationKey = HMAC_SHA256(token_secret, METHOD || URI_PATH) | STRING |
| HIGH | packages/decepticon/decepticon/tools/bash/bash.py | 375 | "-delete 2>/dev/null || true", | CODE |
| HIGH | packages/decepticon/decepticon/tools/bash/prompt.py | 287 | | Prefer inline `python3 -c` over `cat > script.py && python3 script.py` | Inline keeps the harness in the tool transcri | CODE |
| HIGH⚡ | …cepticon/tests/unit/middleware/test_command_targets.py | 167 | targets = extract_targets("curl https://api.target.com/v1 && nmap 10.0.0.0/24") | CODE |
| HIGH⚡ | …s/unit/middleware/test_command_targets_scope_bypass.py | 171 | "echo hi > /tmp/x.txt && ping -c1 evil-oos.example" | CODE |
| HIGH⚡ | …tests/unit/llm/test_codex_chatgpt_handler_streaming.py | 91 | chunks.extend(accumulator.push(f"data: {json.dumps(event)}")) | CODE |
| HIGH⚡ | …tests/unit/llm/test_codex_chatgpt_handler_streaming.py | 92 | chunks.extend(accumulator.push("")) | CODE |
| HIGH⚡ | …tests/unit/llm/test_codex_chatgpt_handler_streaming.py | 224 | accumulator.push('data: {"type": "response.failed", "error": {"message": "upstream exploded"}}') | CODE |
| HIGH⚡ | …tests/unit/llm/test_codex_chatgpt_handler_streaming.py | 241 | malformed = accumulator.push("data: not-json") | CODE |
| HIGH⚡ | …tests/unit/llm/test_codex_chatgpt_handler_streaming.py | 242 | done_marker = accumulator.push("data: [DONE]") | CODE |
| HIGH⚡ | …tests/unit/llm/test_codex_chatgpt_handler_streaming.py | 243 | event_line = accumulator.push("event: response.completed") | CODE |
| HIGH⚡ | …kages/decepticon/tests/unit/llm/test_oauth_handlers.py | 486 | sse = 'data: {"type": "error", "error": null}\n' | CODE |
| HIGH | …cepticon/tests/unit/references/test_payloads_ingest.py | 22 | "# header comment\n' OR 1=1-- -\n' UNION SELECT null,null-- -\n\n' AND SLEEP(5)-- -\n", | CODE |
| HIGH⚡ | …icon/tests/unit/telemetry/test_telemetry_behavioral.py | 177 | # over 536k live events, `role=agent` was 0, `agent` was always null, `model` | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | benchmark/harness.py | 432 | CODE | |
| LOW | benchmark/harness.py | 729 | CODE | |
| LOW | benchmark/harness.py | 902 | CODE | |
| LOW | benchmark/cve_bench/live.py | 110 | CODE | |
| LOW | benchmark/dreadgoad/harness.py | 333 | CODE | |
| LOW | benchmark/providers/cybench.py | 132 | CODE | |
| LOW | benchmark/providers/mhbench.py | 184 | CODE | |
| LOW | benchmark/providers/xbow.py | 107 | CODE | |
| LOW | benchmark/providers/buttercup.py | 203 | CODE | |
| LOW | benchmark/terminal_bench/sandbox.py | 61 | CODE | |
| LOW | config/codex_chatgpt_handler.py | 197 | CODE | |
| LOW | config/codex_chatgpt_handler.py | 215 | CODE | |
| LOW | config/codex_chatgpt_handler.py | 351 | CODE | |
| LOW | config/codex_chatgpt_handler.py | 689 | CODE | |
| LOW | config/codex_chatgpt_handler.py | 851 | CODE | |
| LOW | config/litellm_dynamic_config.py | 561 | CODE | |
| LOW | config/gemini_handler.py | 154 | CODE | |
| LOW | config/claude_code_handler.py | 188 | CODE | |
| LOW | config/claude_code_handler.py | 366 | CODE | |
| LOW | config/claude_code_handler.py | 403 | CODE | |
| LOW | config/claude_code_handler.py | 625 | CODE | |
| LOW | config/claude_code_handler.py | 951 | CODE | |
| LOW | tests/test_compose_network_isolation.py | 163 | CODE | |
| LOW | tests/test_compose_network_isolation.py | 256 | CODE | |
| LOW | examples/blue-local-sensor/blue_receiver.py | 67 | CODE | |
| LOW | examples/blue-local-sensor/blue_receiver.py | 513 | CODE | |
| LOW | examples/blue-local-sensor/blue_receiver.py | 579 | CODE | |
| LOW | examples/blue-local-sensor/blue_monitor.py | 602 | CODE | |
| LOW | examples/blue-local-sensor/blue_monitor.py | 670 | CODE | |
| LOW | examples/blue-local-sensor/blue_monitor.py | 697 | CODE | |
| LOW | examples/blue-local-sensor/blue_monitor.py | 916 | CODE | |
| LOW | …kages/decepticon-core/decepticon_core/plugin_loader.py | 100 | CODE | |
| LOW | …kages/decepticon-core/decepticon_core/plugin_loader.py | 387 | CODE | |
| LOW | …kages/decepticon-core/decepticon_core/plugin_loader.py | 570 | CODE | |
| LOW | …es/decepticon-core/decepticon_core/registry/plugins.py | 111 | CODE | |
| LOW | …ages/decepticon/decepticon/middleware/event_logging.py | 141 | CODE | |
| LOW | …ages/decepticon/decepticon/middleware/event_logging.py | 203 | CODE | |
| LOW | …ticon/decepticon/middleware/prompt_injection_shield.py | 226 | CODE | |
| LOW | …ckages/decepticon/decepticon/middleware/_audit_sink.py | 167 | CODE | |
| LOW | …ckages/decepticon/decepticon/middleware/_audit_sink.py | 104 | CODE | |
| LOW | …ckages/decepticon/decepticon/middleware/_audit_sink.py | 128 | CODE | |
| LOW | packages/decepticon/decepticon/middleware/opplan.py | 254 | CODE | |
| LOW | packages/decepticon/decepticon/middleware/opplan.py | 428 | CODE | |
| LOW | packages/decepticon/decepticon/middleware/roe.py | 205 | CODE | |
| LOW | …/decepticon/decepticon/middleware/operator_steering.py | 74 | CODE | |
| LOW | …/decepticon/decepticon/middleware/operator_steering.py | 131 | CODE | |
| LOW | …s/decepticon/decepticon/middleware/untrusted_output.py | 302 | CODE | |
| LOW | …/decepticon/decepticon/middleware/kg_internal/store.py | 107 | CODE | |
| LOW | …decepticon/decepticon/middleware/kg_internal/ingest.py | 131 | CODE | |
| LOW | …decepticon/decepticon/middleware/kg_internal/ingest.py | 472 | CODE | |
| LOW | …decepticon/decepticon/middleware/kg_internal/ingest.py | 578 | CODE | |
| LOW | …decepticon/decepticon/middleware/kg_internal/ingest.py | 643 | CODE | |
| LOW | packages/decepticon/decepticon/blue_cell/rule_match.py | 104 | CODE | |
| LOW | packages/decepticon/decepticon/blue_cell/rule_match.py | 163 | CODE | |
| LOW | packages/decepticon/decepticon/blue_cell/tap.py | 179 | CODE | |
| LOW | packages/decepticon/decepticon/tools/opplan_graph.py | 85 | CODE | |
| LOW | packages/decepticon/decepticon/tools/opplan.py | 134 | CODE | |
| LOW | packages/decepticon/decepticon/tools/opplan.py | 384 | CODE | |
| LOW | packages/decepticon/decepticon/tools/opplan.py | 581 | CODE | |
| LOW | packages/decepticon/decepticon/tools/opplan.py | 1057 | CODE | |
| 98 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | pyproject.toml | 116 | # config handlers, benchmark harness, and clients legitimately depend | COMMENT |
| MEDIUM | docker-compose.dev.yml | 7 | # benchmark harness pick it up via the COMPOSE_DEV/COMPOSE_WATCH vars. | COMMENT |
| MEDIUM | docker-compose.yml | 264 | # play (raw `make dev`, benchmark harness, dev workflows), the fallback is | COMMENT |
| MEDIUM | benchmark/harness.py | 293 | # the harness escalates to a full langgraph container restart | COMMENT |
| MEDIUM | benchmark/harness.py | 798 | # Honor LANGSMITH_PROJECT from host env so the harness and | COMMENT |
| MEDIUM | benchmark/harness.py | 862 | # Heartbeat every 30s so harness logs show progress even | COMMENT |
| MEDIUM | benchmark/harness.py | 864 | # are otherwise invisible from the harness layer. | COMMENT |
| MEDIUM | benchmark/schemas.py | 11 | "clean", # run reached terminal status without harness-side cancel | CODE |
| MEDIUM | benchmark/schemas.py | 56 | # 1-result invariant in the existing harness. | COMMENT |
| MEDIUM | benchmark/schemas.py | 106 | # was actually halted before teardown fired. Populated by the harness | COMMENT |
| MEDIUM | benchmark/dreadgoad/harness.py | 45 | # LiteLLM proxy admin endpoints for offline cost attribution. The harness | COMMENT |
| MEDIUM⚡ | benchmark/dreadgoad/harness.py | 413 | # asyncio.TimeoutError closes only the harness-local stream | COMMENT |
| MEDIUM⚡ | benchmark/dreadgoad/harness.py | 418 | # harness gives up. | COMMENT |
| MEDIUM | benchmark/dreadgoad/schemas.py | 25 | # LangGraph ``assistant_id`` values the harness will invoke. Each | COMMENT |
| MEDIUM | benchmark/dreadgoad/providers/dreadgoad.py | 54 | operator_message="", # populated by harness after provision | CODE |
| MEDIUM⚡ | benchmark/providers/exploitbench.py | 496 | # harness's standard workspace cleanup; we don't double-delete | COMMENT |
| MEDIUM | benchmark/providers/exploitbench.py | 91 | # allocation walks the range; the harness restarts the sandbox between | COMMENT |
| MEDIUM | benchmark/providers/exploitbench.py | 103 | # The harness reads this file at episode end to recover the canonical | COMMENT |
| MEDIUM | benchmark/providers/cybench.py | 288 | # Cybench difficulties run 0..N; fold into the harness 1..3 scale. | COMMENT |
| MEDIUM | benchmark/providers/mhbench.py | 315 | # harness indefinitely. | COMMENT |
| MEDIUM | benchmark/providers/mhbench.py | 633 | _ = workspace # harness already scans workspace into state.step_history | CODE |
| MEDIUM | benchmark/providers/cybergym.py | 140 | # The harness creates this workspace before calling setup and | COMMENT |
| MEDIUM | benchmark/providers/cybergym.py | 222 | # never raise (base.py contract) — the harness timeout path calls | COMMENT |
| MEDIUM | benchmark/providers/cybergym.py | 243 | # Workspace cleanup is handled by the harness finally-block. | COMMENT |
| MEDIUM | benchmark/results/XBEN-079-24/report.json | 14 | "agent_summary": "I'll start by loading the benchmark skill to understand the mode-specific workflow.\n\nBenchmark mod | CODE |
| MEDIUM | benchmark/results/XBEN-079-24/evidence/summary.json | 14 | "agent_summary": "I'll start by loading the benchmark skill to understand the mode-specific workflow.\n\nBenchmark mod | CODE |
| MEDIUM | benchmark/configs/exploitbench-v8-small.yaml | 5 | # the Decepticon harness consumes: env IDs, GHCR image tags, MCP | COMMENT |
| MEDIUM | packages/decepticon/pyproject.toml | 204 | # XBOW/CTF eval-harness conventions — kept in-repo for `make benchmark` but | COMMENT |
| MEDIUM | packages/decepticon/decepticon/middleware/engagement.py | 67 | # All launcher-/harness-set channels below carry a reducer so an | COMMENT |
| MEDIUM | packages/decepticon/decepticon/middleware/engagement.py | 91 | # Benchmark / CTF challenge context — populated by the benchmark harness. | COMMENT |
| MEDIUM | packages/decepticon/decepticon/tools/research/fuzz.py | 159 | # Atheris harness for {target}.{entry} | COMMENT |
| MEDIUM | packages/decepticon/decepticon/tools/research/fuzz.py | 219 | # boofuzz harness for {target} ({entry} protocol) | COMMENT |
| MEDIUM | packages/decepticon/decepticon/tools/research/fuzz.py | 242 | Engine.AFLPP: _LIBFUZZER_TEMPLATE, # same harness, different driver | STRING |
| MEDIUM | …s/decepticon/decepticon/tools/network/vulnerability.py | 403 | """Perform comprehensive vulnerability assessment. | STRING |
| LOW | …s/decepticon/decepticon/tools/network/vulnerability.py | 533 | # For now, just add a placeholder check | COMMENT |
| MEDIUM | packages/decepticon/decepticon/telemetry/config.py | 173 | # harness, not written by a user: shipping them would swamp the corpus with | COMMENT |
| MEDIUM | packages/decepticon/tests/unit/test_wheel_contents.py | 13 | # skill trees as package data while excluding the benchmark eval-harness | COMMENT |
| MEDIUM | …ckages/decepticon/tests/unit/benchmark/test_harness.py | 67 | # The harness now consults provider.evaluate on the timeout path too | COMMENT |
| MEDIUM | …s/decepticon/tests/unit/benchmark/test_harness_cost.py | 60 | # patch httpx.AsyncClient inside benchmark.harness module | COMMENT |
| MEDIUM | …es/decepticon/tests/unit/middleware/test_engagement.py | 148 | # Every launcher-/harness-set EngagementContextState channel must survive a | COMMENT |
| MEDIUM⚡ | packages/decepticon/tests/unit/tools/web/test_search.py | 40 | # --- JSON extraction (robust to parent-import log noise) --------------------- | COMMENT |
| MEDIUM⚡ | …cepticon/tests/unit/sandbox_kernel/test_orphan_reap.py | 61 | # so the test is robust to slug-generation changes. | COMMENT |
| MEDIUM | .github/workflows/security.yml | 4 | # the 18-tool "comprehensive" arsenal with a focused, high-signal set whose | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | decepticon_tbench_agent.py | 7 | __all__ = ["DecepticonTerminalBenchAgent"] | CODE |
| LOW | benchmark/__init__.py | 12 | __all__ = [ | CODE |
| LOW | benchmark/providers/__init__.py | 8 | __all__ = [ | CODE |
| LOW | benchmark/providers/mhbench.py | 1334 | __all__ = [ | STRING |
| LOW | benchmark/terminal_bench/__init__.py | 3 | __all__ = ["DecepticonTerminalBenchAgent"] | CODE |
| LOW | benchmark/terminal_bench/trajectory.py | 149 | __all__ = ["AGENT_NAME", "RunMetrics", "write_atif_trajectory"] | CODE |
| LOW | benchmark/terminal_bench/sandbox.py | 224 | __all__ = ["HarborSandboxAdapter"] | CODE |
| LOW | benchmark/terminal_bench/agent.py | 164 | __all__ = ["AGENT_NAME", "DecepticonTerminalBenchAgent"] | STRING |
| LOW | config/oauth_token_store.py | 347 | __all__ = [ | CODE |
| LOW | config/auth_handler.py | 104 | __all__ = [ | CODE |
| LOW | config/litellm_dynamic_config.py | 1082 | __all__ = [ | CODE |
| LOW | config/ollama_probe.py | 438 | __all__ = [ | CODE |
| LOW | packages/decepticon-sdk/decepticon_sdk/__init__.py | 82 | __all__ = [ | CODE |
| LOW | …ages/decepticon-sdk/decepticon_sdk/testing/__init__.py | 114 | __all__ = ["FakeBackend", "FakeLLM", "FakeSandbox"] | CODE |
| LOW | …ges/decepticon-sdk/decepticon_sdk/scaffold/__init__.py | 21 | __all__ = ["app"] | CODE |
| LOW | …es/decepticon-sdk/decepticon_sdk/scaffold/templates.py | 250 | __all__ = ["TEMPLATES", "ScaffoldTemplate", "pyproject_for"] | STRING |
| LOW | …kages/decepticon-core/decepticon_core/plugin_loader.py | 48 | logger = logging.getLogger(__name__) | CODE |
| LOW | packages/decepticon-core/decepticon_core/__init__.py | 35 | __all__ = [ | CODE |
| LOW | …ages/decepticon-core/decepticon_core/types/__init__.py | 29 | __all__ = ["engagement", "llm", "kg", "roe"] | CODE |
| LOW | …ges/decepticon-core/decepticon_core/contracts/slots.py | 258 | __all__ = [ | CODE |
| LOW | …/decepticon-core/decepticon_core/contracts/__init__.py | 27 | __all__ = [ | CODE |
| LOW | …pticon-core/decepticon_core/contracts/contributions.py | 147 | __all__ = [ | CODE |
| LOW | …ages/decepticon-core/decepticon_core/utils/__init__.py | 12 | __all__ = ["config", "logging"] | CODE |
| LOW | …es/decepticon-core/decepticon_core/registry/plugins.py | 20 | logger = logging.getLogger(__name__) | CODE |
| LOW | …es/decepticon-core/decepticon_core/registry/plugins.py | 183 | def set_role_resolution(cls, role: str, resolution: RoleResolution) -> None: | CODE |
| LOW | …s/decepticon-core/decepticon_core/registry/__init__.py | 43 | __all__ = [ | CODE |
| LOW | …/decepticon-core/decepticon_core/protocols/__init__.py | 33 | __all__ = [ | CODE |
| LOW | packages/decepticon/decepticon/_boot.py | 33 | logger = logging.getLogger(__name__) | CODE |
| LOW | packages/decepticon/decepticon/_boot.py | 161 | __all__ = ["run"] | CODE |
| LOW | packages/decepticon/decepticon/middleware/egress.py | 136 | __all__ = [ | CODE |
| LOW | packages/decepticon/decepticon/middleware/skills.py | 236 | __all__ = ["SkillsMiddleware"] | CODE |
| LOW | …ges/decepticon/decepticon/middleware/model_override.py | 204 | __all__ = ["ModelOverrideMiddleware"] | CODE |
| LOW | …decepticon/decepticon/middleware/proxy_key_override.py | 172 | __all__ = ["ProxyKeyOverrideMiddleware"] | CODE |
| LOW | packages/decepticon/decepticon/middleware/__init__.py | 45 | __all__ = [ | CODE |
| LOW | packages/decepticon/decepticon/middleware/kg.py | 277 | __all__ = ["KGMiddleware", "KG_SYSTEM_PROMPT"] | CODE |
| LOW | packages/decepticon/decepticon/blue_cell/__init__.py | 36 | __all__ = [ | CODE |
| LOW | packages/decepticon/decepticon/tools/skills.py | 296 | __all__ = ["build_load_skill_tool"] | CODE |
| LOW | packages/decepticon/decepticon/tools/opplan.py | 1440 | __all__ = [ | CODE |
| LOW | packages/decepticon/decepticon/tools/filesystem.py | 20 | __all__ = ["filesystem_tools_without_execute"] | CODE |
| LOW | packages/decepticon/decepticon/tools/__init__.py | 37 | __all__ = [ | CODE |
| LOW | packages/decepticon/decepticon/tools/skills_registry.py | 238 | __all__ = [ | CODE |
| LOW | …kages/decepticon/decepticon/tools/research/__init__.py | 31 | __all__ = [ | CODE |
| LOW | …epticon/decepticon/tools/research/_engagement_scope.py | 20 | __all__ = [ | CODE |
| LOW | packages/decepticon/decepticon/tools/reporting/cvss.py | 258 | __all__ = [ | CODE |
| LOW | …ages/decepticon/decepticon/tools/reporting/__init__.py | 35 | __all__ = [ | CODE |
| LOW | packages/decepticon/decepticon/tools/ad/__init__.py | 28 | __all__ = [ | CODE |
| LOW | packages/decepticon/decepticon/tools/proxy/tools.py | 278 | __all__ = [ | CODE |
| LOW | packages/decepticon/decepticon/tools/proxy/__init__.py | 29 | __all__ = [ | CODE |
| LOW | …kages/decepticon/decepticon/tools/evidence/__init__.py | 19 | __all__ = ["EVIDENCE_TOOLS"] | CODE |
| LOW | …epticon/decepticon/tools/references/payloads_ingest.py | 279 | __all__ = [ | CODE |
| LOW | …es/decepticon/decepticon/tools/references/h1_corpus.py | 324 | __all__ = [ | CODE |
| LOW | …ages/decepticon/decepticon/tools/references/hydrate.py | 142 | __all__ = [ | CODE |
| LOW | …ges/decepticon/decepticon/tools/references/__init__.py | 39 | __all__ = [ | CODE |
| LOW | …es/decepticon/decepticon/tools/references/killchain.py | 322 | __all__ = [ | CODE |
| LOW | …ecepticon/decepticon/tools/references/cve_poc_index.py | 313 | __all__ = [ | CODE |
| LOW | …es/decepticon/decepticon/tools/references/oneliners.py | 198 | __all__ = ["REPO_SLUG", "Recipe", "load_recipes", "search"] | CODE |
| LOW | …/decepticon/decepticon/tools/references/methodology.py | 189 | __all__ = [ | CODE |
| LOW | packages/decepticon/decepticon/tools/web/graphql.py | 24 | logger = logging.getLogger(__name__) | CODE |
| LOW | packages/decepticon/decepticon/tools/web/__init__.py | 25 | __all__ = [ | CODE |
| LOW | …ages/decepticon/decepticon/tools/contracts/__init__.py | 31 | __all__ = [ | CODE |
| 48 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | config/litellm.yaml | 212 | # agentic coding specialization. Not a default tier pick (gpt-5.5 stays | COMMENT |
| MEDIUM | config/litellm.yaml | 448 | # >200K context window doubles input + 1.5x output per xAI's pricing | COMMENT |
| MEDIUM | config/litellm_dynamic_config.py | 775 | # gpt-5.3-codex-spark is the agentic-coding model the Codex subscription | COMMENT |
| MEDIUM | config/litellm_dynamic_config.py | 853 | # agentic-coding specialized model (Codex + GPT-5 training | COMMENT |
| MEDIUM | config/litellm_dynamic_config.py | 862 | # gpt-5.3-codex-spark is the agentic-coding model the Codex SUBSCRIPTION | COMMENT |
| MEDIUM | config/claude_code_handler.py | 241 | # levels low|medium|high|xhigh|max). Effort follows the vendor's agentic | COMMENT |
| MEDIUM | docs/engagement-workflow.md | 85 | ### The orchestration loop | COMMENT |
| MEDIUM | docs/setup-guide.md | 19 | - [Agentic Setup — End-to-End Walkthrough](#agentic-setup--end-to-end-walkthrough) | CODE |
| MEDIUM | docs/design/skillogy.md | 414 | ├── build_skill_graph.py # entry point — orchestrates the 12 stages below | CODE |
| MEDIUM | packages/decepticon-sdk/pyproject.toml | 49 | # Source at ``decepticon_sdk.scaffold.cli``. | COMMENT |
| MEDIUM | packages/decepticon-core/decepticon_core/types/llm.py | 354 | # ``kimi-k2-instruct`` ID (context window negotiated at the | COMMENT |
| MEDIUM | …ages/decepticon/decepticon/middleware/event_logging.py | 569 | # Agent output — the reasoning / chain-of-thought. | COMMENT |
| MEDIUM | packages/decepticon/decepticon/sandbox_server/app.py | 219 | # FastAPI dependency injection wrapper for the auth header. Single | COMMENT |
| MEDIUM | …/skills/plugins/llm-redteam/t12-rag-poisoning/SKILL.md | 11 | # T12 — RAG & Knowledge Base Manipulation | COMMENT |
| MEDIUM | …/skills/plugins/llm-redteam/t12-rag-poisoning/SKILL.md | 40 | ### T12.004 — Indirect prompt injection via RAG | COMMENT |
| MEDIUM | …/skills/plugins/llm-redteam/t12-rag-poisoning/SKILL.md | 53 | ### T12.006 — Cross-tenant RAG leak | COMMENT |
| MEDIUM | …lls/standard/analyst/data-and-model-poisoning/SKILL.md | 41 | ### RAG-side persistent injection | COMMENT |
| MEDIUM | …lls/standard/analyst/data-and-model-poisoning/SKILL.md | 101 | ### RAG persistence | COMMENT |
| MEDIUM | …icon/skills/standard/analyst/excessive-agency/SKILL.md | 50 | ### Persistent memory + agentic loop | COMMENT |
| MEDIUM | …lls/standard/analyst/improper-output-handling/SKILL.md | 112 | ### Tool-call SQL injection (agentic systems) | COMMENT |
| MEDIUM | …skills/standard/analyst/unbounded-consumption/SKILL.md | 48 | ### Runaway agentic loop | COMMENT |
| MEDIUM | …skills/standard/analyst/unbounded-consumption/SKILL.md | 82 | # Find agentic loop terminators | COMMENT |
| MEDIUM | …skills/standard/analyst/unbounded-consumption/SKILL.md | 120 | ### Runaway agentic loop | COMMENT |
| MEDIUM | …pticon/skills/standard/analyst/misinformation/SKILL.md | 37 | ### Package hallucination → typosquat | COMMENT |
| MEDIUM | …icon/skills/standard/analyst/prompt-injection/SKILL.md | 91 | ### RAG poisoning | COMMENT |
| MEDIUM | …con/decepticon/skillogy/builder/seeds/asset_types.yaml | 109 | # Container / orchestration | COMMENT |
| MEDIUM | …decepticon/tests/unit/middleware/test_event_logging.py | 413 | # A tool-calling turn: no visible text at all, only the chain-of-thought. | COMMENT |
| MEDIUM | …s/decepticon/tests/unit/agents/test_registry_parity.py | 147 | # Excludes follow-on phases (post-exploit) and meta phases (orchestration / | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | packages/decepticon/decepticon/plugin_loader.py | 0 | compat shim — content moved to ``decepticon_core.utils.config``. see ``decepticon.core.schemas`` for the rationale and t | STRING |
| HIGH | packages/decepticon/decepticon/tools/research/graph.py | 0 | compat shim — content moved to ``decepticon_core.utils.config``. see ``decepticon.core.schemas`` for the rationale and t | STRING |
| HIGH | packages/decepticon/decepticon/llm/models.py | 0 | compat shim — content moved to ``decepticon_core.utils.config``. see ``decepticon.core.schemas`` for the rationale and t | STRING |
| HIGH | packages/decepticon/decepticon/core/logging.py | 0 | compat shim — content moved to ``decepticon_core.utils.config``. see ``decepticon.core.schemas`` for the rationale and t | STRING |
| HIGH | packages/decepticon/decepticon/core/config.py | 0 | compat shim — content moved to ``decepticon_core.utils.config``. see ``decepticon.core.schemas`` for the rationale and t | STRING |
| HIGH | …ckages/decepticon/decepticon/agents/plugins/patcher.py | 0 | build the recon agent. args: backend: deepagents-style filesystem backend. defaults to ``make_agent_backend(build_sandbo | STRING |
| HIGH | …ages/decepticon/decepticon/agents/plugins/exploiter.py | 0 | build the recon agent. args: backend: deepagents-style filesystem backend. defaults to ``make_agent_backend(build_sandbo | STRING |
| HIGH | …kages/decepticon/decepticon/agents/plugins/verifier.py | 0 | build the recon agent. args: backend: deepagents-style filesystem backend. defaults to ``make_agent_backend(build_sandbo | STRING |
| HIGH | …epticon/decepticon/agents/standard/contract_auditor.py | 0 | build the recon agent. args: backend: deepagents-style filesystem backend. defaults to ``make_agent_backend(build_sandbo | STRING |
| HIGH | …s/decepticon/decepticon/agents/standard/postexploit.py | 0 | build the recon agent. args: backend: deepagents-style filesystem backend. defaults to ``make_agent_backend(build_sandbo | STRING |
| HIGH | …/decepticon/decepticon/agents/standard/cloud_hunter.py | 0 | build the recon agent. args: backend: deepagents-style filesystem backend. defaults to ``make_agent_backend(build_sandbo | STRING |
| HIGH | …kages/decepticon/decepticon/agents/standard/analyst.py | 0 | build the recon agent. args: backend: deepagents-style filesystem backend. defaults to ``make_agent_backend(build_sandbo | STRING |
| HIGH | …ages/decepticon/decepticon/agents/standard/reverser.py | 0 | build the recon agent. args: backend: deepagents-style filesystem backend. defaults to ``make_agent_backend(build_sandbo | STRING |
| HIGH | …s/decepticon/decepticon/agents/standard/ad_operator.py | 0 | build the recon agent. args: backend: deepagents-style filesystem backend. defaults to ``make_agent_backend(build_sandbo | STRING |
| HIGH | …kages/decepticon/decepticon/agents/standard/exploit.py | 0 | build the recon agent. args: backend: deepagents-style filesystem backend. defaults to ``make_agent_backend(build_sandbo | STRING |
| HIGH | packages/decepticon/decepticon/agents/standard/recon.py | 0 | build the recon agent. args: backend: deepagents-style filesystem backend. defaults to ``make_agent_backend(build_sandbo | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | benchmark/runner.py | 114 | CODE | |
| LOW | config/codex_chatgpt_handler.py | 739 | CODE | |
| LOW | config/codex_chatgpt_handler.py | 851 | CODE | |
| LOW | config/codex_chatgpt_handler.py | 891 | CODE | |
| LOW | config/perplexity_handler.py | 156 | CODE | |
| LOW | config/grok_handler.py | 159 | CODE | |
| LOW | config/gemini_handler.py | 154 | CODE | |
| LOW | config/claude_code_handler.py | 804 | CODE | |
| LOW | config/claude_code_handler.py | 625 | CODE | |
| LOW | config/claude_code_handler.py | 806 | CODE | |
| LOW | config/claude_code_handler.py | 951 | CODE | |
| LOW | config/claude_code_handler.py | 989 | CODE | |
| LOW | config/copilot_handler.py | 296 | CODE | |
| LOW | packages/decepticon/decepticon/middleware/roe.py | 260 | CODE | |
| LOW | …ticon/decepticon/tools/reporting/finding_epistemics.py | 138 | CODE | |
| LOW | …es/decepticon/decepticon/tools/references/h1_corpus.py | 272 | CODE | |
| LOW | packages/decepticon/decepticon/llm/factory.py | 1154 | CODE | |
| LOW | packages/decepticon/decepticon/llm/factory.py | 1166 | CODE | |
| LOW | …kages/decepticon/decepticon/sandbox_web/fetch_chain.py | 350 | CODE | |
| LOW | …kages/decepticon/decepticon/sandbox_web/fetch_chain.py | 423 | CODE | |
| LOW | packages/decepticon/decepticon/agents/build.py | 457 | CODE | |
| LOW | …ckages/decepticon/decepticon/agents/plugins/scanner.py | 87 | CODE | |
| LOW | …ckages/decepticon/decepticon/agents/plugins/patcher.py | 84 | CODE | |
| LOW | …s/decepticon/decepticon/agents/plugins/vulnresearch.py | 81 | CODE | |
| LOW | …ages/decepticon/decepticon/agents/plugins/exploiter.py | 96 | CODE | |
| LOW | …kages/decepticon/decepticon/agents/plugins/verifier.py | 90 | CODE | |
| LOW | …/decepticon/decepticon/agents/standard/forensicator.py | 67 | CODE | |
| LOW | …epticon/decepticon/agents/standard/finding_reporter.py | 16 | CODE | |
| LOW | …epticon/decepticon/agents/standard/contract_auditor.py | 86 | CODE | |
| LOW | …pticon/decepticon/agents/standard/wireless_operator.py | 73 | CODE | |
| LOW | …ecepticon/decepticon/agents/standard/osint_operator.py | 73 | CODE | |
| LOW | …s/decepticon/decepticon/agents/standard/postexploit.py | 84 | CODE | |
| LOW | …/decepticon/decepticon/agents/standard/cloud_hunter.py | 74 | CODE | |
| LOW | …/decepticon/decepticon/agents/standard/ics_operator.py | 68 | CODE | |
| LOW | …kages/decepticon/decepticon/agents/standard/analyst.py | 96 | CODE | |
| LOW | …kages/decepticon/decepticon/agents/standard/phisher.py | 74 | CODE | |
| LOW | …ages/decepticon/decepticon/agents/standard/reverser.py | 79 | CODE | |
| LOW | …on/decepticon/agents/standard/supply_chain_operator.py | 67 | CODE | |
| LOW | …s/decepticon/decepticon/agents/standard/ad_operator.py | 86 | CODE | |
| LOW | …es/decepticon/decepticon/agents/standard/decepticon.py | 77 | CODE | |
| LOW | …cepticon/decepticon/agents/standard/mobile_operator.py | 62 | CODE | |
| LOW | …kages/decepticon/decepticon/agents/standard/exploit.py | 95 | CODE | |
| LOW | …/decepticon/decepticon/agents/standard/iot_operator.py | 67 | CODE | |
| LOW | packages/decepticon/decepticon/agents/standard/recon.py | 83 | CODE | |
| LOW | packages/decepticon/decepticon/telemetry/sink.py | 123 | CODE | |
| LOW | …ages/decepticon/tests/unit/middleware/test_skillogy.py | 149 | CODE | |
| LOW | packages/decepticon/tests/unit/ad/test_adcs_post.py | 24 | CODE | |
| LOW | …es/decepticon/tests/unit/backends/test_http_sandbox.py | 366 | CODE | |
| LOW | …ckages/decepticon/tests/unit/cli/test_auth_branches.py | 41 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | clients/launcher/cmd/onboard.go | 290 | // Step 0: system check. | COMMENT |
| LOW⚡ | clients/launcher/cmd/onboard.go | 300 | // Step 1: Auth methods (multi-select) | COMMENT |
| LOW | clients/launcher/cmd/onboard.go | 793 | // Step 3: Model profile | COMMENT |
| LOW | clients/launcher/cmd/onboard.go | 806 | // Step 4: Language | COMMENT |
| LOW | packages/decepticon/decepticon/tools/research/patch.py | 210 | # Step 1: optional test suite. | COMMENT |
| LOW | packages/decepticon/decepticon/tools/research/patch.py | 229 | # Step 2: re-run the PoC. | COMMENT |
| LOW | packages/decepticon/decepticon/tools/research/patch.py | 241 | # Step 3: crash-vs-fix detection. | COMMENT |
| LOW⚡ | packages/decepticon/decepticon/tools/bash/bash.py | 233 | # Step 1: surrogate safety | COMMENT |
| LOW⚡ | packages/decepticon/decepticon/tools/bash/bash.py | 235 | # Step 2: strip ANSI | COMMENT |
| LOW⚡ | packages/decepticon/decepticon/tools/bash/bash.py | 237 | # Step 3: compress repetition | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | packages/decepticon/decepticon/tools/research/tools.py | 871 | Ingest a SARIF report (semgrep, bandit, gitleaks, trivy, codeql) into the graph. WHEN TO USE: After running any SAR | STRING |
| HIGH | …decepticon/decepticon/tools/research/secret_scanner.py | 154 | Probe ``secret`` against its issuing API and report liveness. Performs a single authenticated HTTP request (over a | STRING |
| HIGH | …kages/decepticon/decepticon/agents/plugins/detector.py | 101 | Build the Detector agent. Notes: - The Detector reads source files via FilesystemMiddleware exclusively; | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docker-compose.watch.yml | 7 | # Usage: | COMMENT |
| LOW | scripts/install.sh | 5 | # Usage: | COMMENT |
| LOW | scripts/web-hotswap.sh | 9 | # Usage: | COMMENT |
| LOW | …kages/decepticon/decepticon/tools/reversing/scripts.py | 12 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …epticon/decepticon/tools/research/secret_validation.py | 166 | # Check if it's root/admin-level. | COMMENT |
| LOW | …s/decepticon/decepticon/tools/network/vulnerability.py | 323 | # Check if version matches affected versions | COMMENT |
| LOW | …ckages/decepticon/decepticon/tools/network/scanners.py | 331 | # Check if nmap is available | COMMENT |
| LOW | telemetry-gateway/build_dashboard.py | 26 | # Set OLD_DASHBOARD_ID to retire a previous dashboard (+ its insights) first. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/decepticon/decepticon/llm/factory.py | 356 | "placeholder", | CODE |
| LOW | packages/decepticon/tests/unit/tools/test_defense.py | 254 | monkeypatch.setenv("DEFENDER_TOKEN", "fake-token") | STRING |
| LOW | packages/decepticon/tests/unit/tools/test_defense.py | 286 | monkeypatch.setenv("DEFENDER_TOKEN", "fake-token") | STRING |
| LOW⚡ | packages/decepticon/tests/unit/llm/test_factory.py | 55 | for token in ("placeholder", "not-used", "dummy", "fake", "example"): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …kages/decepticon/tests/unit/server/test_plugins_api.py | 290 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …icon/tests/unit/references/test_fetch_comprehensive.py | 368 | # Create a real dir to point at | COMMENT |