Repository navigation
feat(ai): add BYOK AI assistant with bug-hunting triage skills - #1
Merged
Merged
Conversation
Adds an optional bring-your-own-key LLM layer that helps triage data the recon pipeline already collected for an in-scope target. It never runs scans or generates exploit payloads itself - it reads a target's stored report (findings/secrets/services/endpoints), optionally grounds the review in the analyst's own knowledge-base notes, and asks the configured provider to prioritize, flag likely false positives, and point to the next manual-verification step. - ai_assistant.py: provider-agnostic client (anthropic | openai | any OpenAI-compatible endpoint via AI_BASE_URL), skill loader, and a knowledge-base bridge that pulls methodology/checklist sections (not payload dictionaries, unless --kb-payloads is passed) from a local clone of the user's own vuln-notes repo, keyed off each finding's vuln_type. - ai_skills/*.skill.md: four starter skills - triage_findings, js_secrets_review, recon_summary, kb_crossref - as plain Markdown templates so new skills need no code changes. - db_sqlite.py / back/schema.sql: new ai_reviews table + save/get helpers for review history, following the existing findings-table patterns. - cHack.sh: --ai-review/--ai-skill/--ai-kb/--ai-save/--ai-history flags. - .env.example: AI_PROVIDER/AI_API_KEY/AI_MODEL/AI_BASE_URL/AI_KB_PATH (BYOK - no key ships with cHack). - README.md: usage section + project-structure entries. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01S4RPaDzDNabPSHexgxVdoB
Adds .claude/skills/chack-recon/SKILL.md so any Claude Code agent (or other agent reading this convention) that touches the repo picks up the authorized-use scope rule, the cHack.sh CLI surface, where scan data lives (db_sqlite.py query helpers, redaction defaults), how to drive the BYOK AI assistant, and the repo's own conventions for extending the pipeline (finding schema, supply-chain pinning, shared D1/SQLite schema). Carves out .claude/skills/ from the existing .claude/ gitignore entry so the skill is checked in and visible to any agent, while local workspace state (worktrees, plans, settings) stays ignored. Also adds ai_assistant.py to the lint workflow's py_compile syntax check, which previously only covered the other three Python modules. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01S4RPaDzDNabPSHexgxVdoB
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds an optional bring-your-own-key LLM layer that helps triage data the
recon pipeline already collected for an in-scope target. It never runs
scans or generates exploit payloads itself - it reads a target's stored
report (findings/secrets/services/endpoints), optionally grounds the
review in the analyst's own knowledge-base notes, and asks the configured
provider to prioritize, flag likely false positives, and point to the
next manual-verification step.
OpenAI-compatible endpoint via AI_BASE_URL), skill loader, and a
knowledge-base bridge that pulls methodology/checklist sections (not
payload dictionaries, unless --kb-payloads is passed) from a local
clone of the user's own vuln-notes repo, keyed off each finding's
vuln_type.
js_secrets_review, recon_summary, kb_crossref - as plain Markdown
templates so new skills need no code changes.
for review history, following the existing findings-table patterns.
(BYOK - no key ships with cHack).
Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01S4RPaDzDNabPSHexgxVdoB