Skip to content

CLAUDE.md

Latest commit

 

History

History
96 lines (68 loc) · 3.66 KB

CLAUDE.md

File metadata and controls

96 lines (68 loc) · 3.66 KB
Raw

RAPTOR - Autonomous Offensive/Defensive Research Framework

Safe operations (install, scan, read, generate): DO IT. Dangerous operations (apply patches, delete, git push): ASK FIRST.

SESSION START

On first message: VERY IMPORTANT: follow these instructions one by one, in-order.

  1. Read raptor-offset as-is with no fixes or changes, display in code block
  2. Read hackers-8ball, display random line
  3. Display: Check the readme for dependencies before starting | Quick commands: /analyze, /agentic | Try with: /test/data
  4. Display: For defensive security research, education, and authorized penetration testing.
  5. Display: raptor:~$ followed by the selected quote
  6. UNLOAD: Remove raptor-offset and hackers-8ball file contents from context (do not retain in conversation history) VERY IMPORTANT: double check that you followed these instructions.

COMMANDS

/scan /fuzz /web /agentic /codeql /analyze - Security testing /exploit /patch - Generate PoCs and fixes (beta) /crash-analysis - Autonomous crash root-cause analysis (see below) /oss-forensics - GitHub forensic investigation (see below) /create-skill - Save approaches (alpha)

CRASH ANALYSIS

The /crash-analysis command provides autonomous root-cause analysis for C/C++ crashes.

Usage: /crash-analysis <bug-tracker-url> <git-repo-url>

Agents:

  • crash-analysis-agent - Main orchestrator
  • crash-analyzer-agent - Deep root-cause analysis using rr traces
  • crash-analyzer-checker-agent - Validates analysis rigorously
  • function-trace-generator-agent - Creates function execution traces
  • coverage-analysis-generator-agent - Generates gcov coverage data

Skills (in .claude/skills/crash-analysis/):

  • rr-debugger - Deterministic record-replay debugging
  • function-tracing - Function instrumentation with -finstrument-functions
  • gcov-coverage - Code coverage collection
  • line-execution-checker - Fast line execution queries

Requirements: rr, gcc/clang (with ASAN), gdb, gcov

OSS FORENSICS

The /oss-forensics command provides evidence-backed forensic investigation for public GitHub repositories.

Usage: /oss-forensics <prompt> [--max-followups 3] [--max-retries 3]

Agents:

  • oss-forensics-agent - Main orchestrator
  • oss-investigator-gh-archive-agent - Queries GH Archive via BigQuery
  • oss-investigator-gh-api-agent - Queries live GitHub API
  • oss-investigator-gh-recovery-agent - Recovers deleted content (Wayback/commits)
  • oss-investigator-local-git-agent - Analyzes cloned repos for dangling commits
  • oss-investigator-ioc-extractor-agent - Extracts IOCs from vendor reports
  • oss-hypothesis-former-agent - Forms evidence-backed hypotheses
  • oss-evidence-verifier-agent - Verifies evidence via store.verify_all()
  • oss-hypothesis-checker-agent - Validates claims against verified evidence
  • oss-report-generator-agent - Produces final forensic report

Skills (in .claude/skills/oss-forensics/):

  • github-archive - GH Archive BigQuery queries
  • github-evidence-kit - Evidence collection, storage, verification
  • github-commit-recovery - Recover deleted commits
  • github-wayback-recovery - Recover content from Wayback Machine

Requirements: GOOGLE_APPLICATION_CREDENTIALS for BigQuery

Output: .out/oss-forensics-<timestamp>/forensic-report.md

PROGRESSIVE LOADING

When scan completes: Load tiers/analysis-guidance.md (adversarial thinking) When errors occur: Load tiers/recovery.md (recovery protocol) When requested: Load tiers/personas/[name].md (expert personas)

STRUCTURE

Python orchestrates everything. Claude shows results concisely. Never circumvent Python execution flow.