Week of 26 October to 2 November 2026

28 of the 83 tools shipped changes last week, across 717 commits and 123 releases. 1 joined: vestjoe/trove-skill. None left.

Last Week's Highlights

SpecterOps/skills: Skills adds a Cobalt Strike operations skill, giving the tool guidance it did not have for running Cobalt Strike engagements.
trailofbits/fickling: Fickling now analyzes PyTorch ZIP records with a dedicated PyTorch reader, letting you scan PyTorch checkpoint files for pickle vulnerabilities.
microsoft/PyRIT: A new context_wrap attack technique and a tool role-play converter add two new ways to probe targets, and UnicodeConfusableConverter gains a cyrillic_homoglyph option.

AIPentest/CyberStrikeAI

25 commits

CyberStrikeAI lets you configure custom HTTP headers per AI channel. Vulnerability findings can now be exported as Markdown or Word report downloads. Header credentials are isolated across audits, redirects and probes, and private header names are masked in the audit configuration. The WebShell batch probe now completes its full run. Agent task timeout is now configurable.

Armur-Ai/Pentest-Swarm-AI

v0.3.3 to v0.3.7, 28 commits

Pentest Swarm AI now runs multiple targets in one batch, accepting a comma separated list through the --targets flag. A context-folder parser lets you import background material to warm-start the recon blackboard and steer the scan with a context brief. Every run writes to a unified, append-only audit trail per campaign, and cross-campaign memory now persists and recalls findings between runs instead of stubbing it out. The authorization gate now covers poc, playbook, and chain runs, not just scans, and new IP and port-range guardrails enforce rate limits during exploitation. The dashboard no longer clips attack-chain steps out of view.

Azure/counterfit

0 commits

The project is archived. Nothing changed in the tool.

KeygraphHQ/shannon

v3.5.0, 3 commits

The CLI gains an experimental probe, run with --exp-php2shell, that verifies PHP upgrade changes before you apply them. Examples for running it now use the npx command form, and the docs clarify a caveat around backporting. Shannon stop has been repaired and now exits orphan or empty stop cases faster. The PDF report cover has been reworked to match the Keygraph report design, with a pinned title spacing and a linked Keygraph wordmark replacing the previous cover art.

Lab700xOrg/aisbom

4 commits

Two dependency security bumps, a build fix to exclude brotli from the standalone binary, and a dev dependency update. Nothing changed in the tool.

NVIDIA/SkillSpector

v2.13.2 to v2.13.3, 71 commits

SkillSpector inspects locked npm dependency contents for supply-chain checks, matches MCP config files across Claude Desktop, Claude Code, Cline and Roo Code, and accepts custom OpenAI-compatible HTTP headers from a provider. The tool now validates that AI responses actually finished and contain required fields, reporting refusals, truncated output and invalid tool results as incomplete inspection rather than as a finished result. Findings now survive a grader timeout and gap-fill findings in other languages contribute to scores and exit status instead of a stale safe verdict. The scanner rejects report outputs that would overwrite a baseline or recursive child input, flags unavailable custom YARA rule directories as incomplete, and keeps multiline walk-encrypt-overwrite ransomware detection and PowerShell SC3 and P2 coverage intact. Static analysis stops misreading backticks and apostrophes in comments as parser-limit violations and no longer merges shell lines across Markdown code fences. The tool-description batch limit is now configurable with SKILLSPECTOR_TP4_MAX_BATCHES, default 256, and the workflow deadline is raised to 1,080 seconds, configurable with SKILLSPECTOR_MAX_WORKFLOW_SECONDS.

NVIDIA/garak

1 commit

One internal refactor to the CAS probes, extracting probe intents into reusable stubs. Nothing changed in how you run garak or what it tests for.

PortSwigger/mcp-server

1 commit

Pending approvals tied to an MCP call are now cancelled when that call ends, instead of staying open after the call finishes.

PurpleAILAB/Decepticon

v2.2.0 to v2.2.2, 76 commits

Decepticon's shared model catalog now includes GPT-6.1 Terra. A discoverable CLI-first wrapper skill exposes Decepticon's own commands as a skill, and ships inside the release manifests' skills directory. Engagement runs started asynchronously, including the MCP decepticon_start_engagement call and the Desktop and serve paths, no longer crash with a NotImplementedError: StepBudgetMiddleware now implements awrap_model_call for async model calls. OPPLANs that declare no edge into a prerequisite stage are now rejected at commit time instead of locking every objective transition and specialist dispatch once the engagement is running. RoE wildcard scope is now restricted to a single DNS label. Installing the blue extra pulls in the bs-autobot KG scan tool now that it is live on PyPI, while red-only installs import cleanly.

SpecterOps/skills

1 commit

Skills adds a Cobalt Strike operations skill, giving the tool guidance it did not have for running Cobalt Strike engagements.

Tencent/AI-Infra-Guard

v4.6.8, 11 commits

Agent-scan adds a CloudGPU provider preset and a Runcrate provider preset, drops its third-party provider presets, and moves the Hugging Face preset to router.huggingface.co/hf-inference. Agent-scan now accepts null content deltas and usage-only chunks in SSE replies. MCP-scan normalizes mixed-case MCP SARIF rule IDs and preserves complete MCP tool results. Skill-scan now returns a deterministic result for non-standard skill packages. Each scanner can now be installed independently via pip.

berylliumsec/nebula

nebula-v3.0.36 to nebula-v3.0.39, 8 commits

Workbench chats support bulk actions, letting you select and act on multiple chats at once. Butler nests archives and surfaces pinned and flagged chats first, so prioritized conversations sort to the top. Agent Work results are now paged to fit within the model's delivery bound. Core preserves oversized tool results and resumes long artifact reads instead of losing them partway through. Core no longer stalls on high-cardinality entity reads. MCP chat setup no longer blocks Core's page responsiveness. Workbench refreshes its harness choices automatically after you change Settings.

briiirussell/cybersecurity-skills

v1.4.0 to v1.70.0, 117 commits

This week's releases add new coverage rather than new skills for the most part. breach-patterns gains Pattern 11 for compromised third-party scripts acting inside logged-in sessions, with checks for pinning, step-up on sensitive actions, and CSP allowlists as an exfil channel, paired with a new business-logic-testing step that replays sensitive actions using only the existing session. agent-supply-chain-audit now audits IDE extensions (EX1–EX6) and launch-directory trust (LD1–LD4) for planted AGENTS.md files and untrusted config servers. incident-triage and threat-hunting ship a dev-tool compromise playbook with dated IOCs and a read-only sweep for attacker SSH keys and reverse tunnels. dependency-audit and container-audit now flag runtime defaults, such as Go's MPTCP setting, that widen a kernel CVE's reach, and patch-sweep adds a Linux host and kernel CVE track with distro-tracker lookups. secrets-audit switches its main scanner to Betterleaks, scans beyond the repo into issues, PRs, CI logs and container layers, and scanner-pipeline ships a converter for Betterleaks v2 reports into findings.json.

cisco-ai-defense/mcp-scanner

3 commits

Three dependency and example fixes. Nothing changed in the tool.

cisco-ai-defense/skill-scanner

2.3.2, 2 commits

Skill Scanner now sends the same LLM prompt for a given skill on every scan, regardless of preset, so a stricter preset no longer rates an issue lower than a less strict one. The untrusted-content delimiter is derived from the wrapped content instead of chosen at random, keeping prompts identical across scans while still preventing content from closing its own delimiter. Strict and permissive now use the same default LLM context budgets as low-noise and quiet, so preset choice changes which findings get reported rather than how much of the skill the LLM reads. Static findings are unchanged, but LLM severities and titles can differ from before on some skills. With GPT-4.1 at temperature 0 across the eval set, the number of skills where a stricter preset scored a lower LLM severity dropped from 6 to 0. Models that ignore temperature still vary run to run with an identical prompt, so use llm-consensus-runs or a temperature-0 model when severity must be repeatable.

dreadnode/ares

4 commits

Four dependency bumps. Nothing changed in the tool.

elementalsouls/Claude-BugHunter

7 commits

Nothing changed in the tool last week. All seven commits refreshed a star history chart asset.

h5i-dev/h5i

v0.5.2, 10 commits

h5i-app-pg now verifies TLS when connecting to PostgreSQL, behind the tls feature flag. The with_schema call now refuses mixed-case schema names instead of accepting them. HmacAuth saturates token expiry rather than overflowing it, and the authenticator now has a test covering that behavior. Top-level help now describes each installed plugin, so running h5i help shows what websec, recon, and test actually do.

microsoft/PyRIT

90 commits

PyRIT's GUI now lets you browse a Scenario's result parents and children, and it preserves chat drafts when exploring datasets. Operation findings export to Word and Markdown. A new context_wrap attack technique and a tool role-play converter add two new ways to probe targets, and UnicodeConfusableConverter gains a cyrillic_homoglyph option. The ScenarioSuite registry gives you a one-click launch for scenario suites. CredentialLeakScorer now detects postgresql, mongodb, rediss and amqps connection strings along with Slack bot and user tokens. OpenRedirectOutputScorer detects double-encoded slashes and backslash bypasses, and MarkdownInjectionScorer detects images that span lines and HTML img tags. LDAPInjectionOutputScorer detects percent-encoded filters and hex-escaped wildcards.

mpgn/NetExec-mcp

1 commit

The SMB module now exposes reauth_swap as a standalone tool you can call directly, rather than only as an internal helper. This lets you invoke the SMB reauthentication swap technique on its own during a test run.

msoedov/agentic_security

2 commits

Agentic Security adds a Runcrate preset to its LLM specs, letting you target Runcrate-hosted models directly when running attacks.

promptfoo/promptfoo

52 commits

Promptfoo now fails JavaScript assertions that throw on file:// and package: imports instead of silently erroring the row, so those rows report an actual failure. Promptfoo no longer counts tool calls as refusals. Provider embedding errors from Mistral and Cohere now surface instead of being swallowed. Snowflake and Cloudera provider endpoints are now scoped correctly. Buffered HTTP responses from providers now enforce deadlines, so a hung response can no longer stall an eval. CLI evals now end on SIGTERM only after provider drain and OTel flush complete. OTLP trace receivers now keep their configured startup options. Dataset loading now reads just the eval config instead of the full results file.

samugit83/redamon

151 commits

Recon's TruffleHog engine now runs alongside Redamon's own secret rules on new projects, merging their keys; Travis CI tokens need its confirmation. Route exposure is a new recon scan module that classifies exposed routes, holds leads out of reports until confirmed, and surfaces them in the Red Zone tab and Node Inspector. The agent now confirms route exposure leads via access_control, path_traversal and rce checks, proving browser leads like CORS, cache and client-side gating. CVE lookup now links a CVE only when NVD lists the detected version, and the noisiest JS secret rules no longer fire on library code. The webapp now shows why a scan, plugin action or skill failed to load, instead of idling silently.

snyk/agent-scan

v0.6.10, 1 commit

One dependency bump. Nothing changed in the tool.

trailofbits/fickling

16 commits

Fickling now analyzes PyTorch ZIP records with a dedicated PyTorch reader, letting you scan PyTorch checkpoint files for pickle vulnerabilities. The scanner flags private stdlib attributes referenced in pickle globals as a new gadget class. UNSAFE_IMPORTS now blocks argparse, smtpd, traceback, mailbox, lzma, compression, io.open_code, readline, dataclasses, mailcap and tracemalloc, closing off more modules that attackers could use as gadgets. Recursive discovery inside ZIP archives now includes members that lack file type bits set, so pickle files inside those archives no longer get skipped.

trailofbits/skills

3 commits

Workflow skills now resolve their own plugin directly instead of searching for it.

usestrix/strix

11 commits

The runner can now replace the root agent's scan prompt entirely through root_instructions_override, with replacement off by default so overrides append unless you turn it on. LLM cost tracking now reads manual prices from settings and applies them only to STRIX_LLM, and prices usage from the model config instead of a flat rate. The sandbox now runs a patched brotli decoder, closing CVE-2026-111497, on image tag 1.3.1. Requests to Vercel AI Gateway now carry app attribution headers, and the README documents setup for both Vercel AI Gateway and OpenRouter with updated recommended model ids.

vestjoe/trove-skill

v0.2.0, 15 commits

Trove reads naabu output, including json lines and its oX and oG forms through the nmap parsers. Trove reads masscan output across oL, oJ, oD and screen formats, pulling banners onto their port. Trove turns nuclei JSONL, je and screen text into confirmed findings on their host and port, keeping nuclei's severity in ext. Every text parser now splits lines the same way, so NetExec citations come out correct after non-ASCII text. Credential ids now end in a plus sign followed by eight hex characters instead of a hyphen, so the password fingerprint no longer reads as part of the username, and find shows the account first. Existing engagements keep working, and an old id moves to the new form the next time that password is imported from a new file.

xalgorix/xalgorix

v4.6.173 to v4.6.174, 3 commits

When a chat completions gateway returns HTTP 200 with no text and no tool call, Xalgorix now surfaces an error the gateway placed inside the completion body, reporting the provider's actual message instead of a generic empty response. For empty completions without an embedded error, Xalgorix logs the finish_reason, native_finish_reason, whether the reply held a refusal or reasoning-only output, and the completion token count, making truncated and reasoning-only replies distinguishable in the logs. The tool-call parser now recognizes DSML-namespaced markup such as invoke and parameter tags, dispatching those calls like any other tool call instead of treating them as plain text that could trip the no-tool-call stop limit.

What is a highlight?

Each week an AI model reads every entry and picks up to three changes that matter most to the people running these tools. It looks for these, most important first. Each highlight quotes the sentence from the tool's entry that shows the change, with the sentence before it when it needs one.

1	The tool can run a test, technique or attack it could not before, or reach a new kind of target.
2	The tool produces a new kind of output a tester can hand on, such as an attack map, a report or verified proof of a finding.
3	The tool's results can be trusted where they could not before: findings are now verified, or a fix corrected results that were wrong.
4	The tool tests more of a target than before: more vulnerability classes, more hosts or roots, more of a methodology.
5	The tool keeps a test inside its scope or rules of engagement in a way it could not before.