AI Security Matrix

A vendor's application-security skills for a coding agent: it scans source, dependencies and secrets, then confirms a finding against the running app through a proxy before it reaches the report.

Routes an agent handed an APK, a binary, obfuscated frontend JavaScript or a pentest target to the playbook that fits, then sets up the toolchain that playbook needs. Its playbooks also cover Windows identity attacks, beyond the reversing the name implies.

Pairs bug-bounty web and API hunting with smart-contract auditing across several chains, each audit backed by a reference of known vulnerability classes. It ends in a submission drafted for the bounty platform.

A broad penetration-testing skill set that also works through the OWASP LLM top ten as concrete tests. It ends in the report, with compliance formats and a risk prioritiser.

Tests an AI coding IDE or its agent, such as Cursor, Cline or Claude Code, for the ways a hostile workspace can steer it. You map the surface first, work one vulnerability class per skill, then chain what you confirmed.

Works an IoT device from three sides: its companion Android app, its hardware debug and serial interfaces, and the network it sits on. Each hardware skill ships a small Python helper instead of assuming the tool is installed.

Splits a code repository's vulnerability scan across several agents and merges what they find. A benchmark skill scores each scan against a known-vulnerable sample, so one setup can be compared with another.

A GitHub Action that has a model review only the diff of a pull request, comments the security issues inline, then filters its own findings to cut the false positives a diff-only view invites.

Reads a saved model file and reports the unsafe calls hiding in it, across pickle, HDF5 and SavedModel, so a download from a public registry can be checked before anything loads it.

Exposes an open IDA Pro database to an LLM client, so you ask about a binary in chat instead of clicking through the GUI: rename functions, read decompiled code, chase cross-references.

Takes a target and an objective in plain language, then plans and runs the whole job inside a sandbox. A second mode answers questions about a finding without acting on it.

Works on the report an engagement ends in, inside Ghostwriter: it turns a sample Word report into a Ghostwriter template, drafts an executive summary traced back to the findings, and grades whether a finding or report is ready for final delivery. It runs offline on exported report data, or reads a live Ghostwriter over its GraphQL API.

Aims at the judgement rather than the commands: trace a finding to demonstrated impact, capture memory before the box is reimaged, notice the honeypot. Offence, defence and a shared core install separately.

Holds the engagement record an agent loses when its context fills: the scope, which methodology phases have been covered, and findings with the evidence behind them. The agent tests; this remembers.

Walks an internal AD engagement technique by technique, each step naming the command to run and the telemetry it leaves behind. It ships no code of its own and drives tools you already have installed.

Keeps the tool surface deliberately small, a handful of composite calls plus reference material the model loads only when it needs it, and ships a system prompt with rules about what the graph does and does not prove. Reaches Entra as well as on-premises.

Connects to a Kali box you already run and works it from the browser, issuing the commands there and reading the output back.

Runs inside CI on a pull request and blocks the merge when it can validate a bug, rather than being driven from a terminal against a live target.

Serves a large tool catalogue over MCP and adds a layer of its own that picks which tool to run and with what flags, so the client's model chooses the goal rather than the command line.

Turns a coding CLI you already use into a five-phase lab workflow with eight specialist subagents, running every tool in Docker and keeping the run resumable.

Works a target in named stages, feeding each stage's findings to the next, and drives Claude Code or Codex to do the actual running. Built for CTF categories as much as for engagements.

Ships its own port scanner and web recon rather than wrapping the usual tools, and the model only plans the attack chain. Without a key it falls back to a fixed planner.

The reference framework behind a body of published AI offensive-security research, kept as its final source tree. Its capabilities moved on to a commercial successor.

A Flutter desktop application that can run the whole engagement against a model on your own GPU, feeding each phase's findings into the next phase's prompt.

One MCP server per security tool, each a thin wrapper over that binary's flags. Development has moved to a successor project under a different name.

A thin bridge giving a model a shell on a Linux box you already run, plus a short list of named tool wrappers. Raw command execution is the point; the wrappers are convenience.

Fuzzes a model endpoint with a catalogue of jailbreak techniques, mutating prompts until one gets past the guardrail, and works against a local model as readily as a hosted one.

Drives Metasploit over its RPC interface: search the modules, run an exploit or a post module, generate a payload, and send commands into a session that is already open.

Works the Microsoft 365 side of the problem: Power Platform flows, Copilot Studio bots left open to anonymous users, and the agents a tenant has published without noticing.

Runs a second model whose only job is to read the target's replies and rule on whether an injection actually worked. Point it at your own system prompt, or at an HTTP endpoint you know nothing about.

Reads the source of an agentic workflow, CrewAI or LangGraph or the OpenAI Agents SDK, and maps what the agents can actually reach before anything runs.

Brings the established adversarial machine-learning frameworks under one CLI and points them at a model you nominate. Its subject is classic ML, not language models.

Turns BloodHound's own Cypher query library into one MCP tool per query, so you ask for an attack path in English and the server runs a query someone already wrote and tested.

Reads a running ROADrecon instance so a model can question the Entra tenant it already collected, with prompt templates for the analyses people usually run over that data.

Reads a Python codebase and asks a model to trace user input through to dangerous sinks, reporting the call chain behind each bug it claims. It applies no rules or patterns; the model is the whole analysis.

One hardened container per tool, brought up with Compose, so a job runs only the servers it needs instead of one process holding everything.