Skip to content

Commit 7e5606c

Browse files
xPloits3cxPloits3c
authored
Add files via upload
1 parent a917fa9 commit 7e5606c

1 file changed

Lines changed: 256 additions & 0 deletions

File tree

‎.github/workflows/dorkeye-agent.yml‎

Lines changed: 256 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,256 @@
1+
# ─────────────────────────────────────────────────────────────────────────────
2+
# 🦅 DorkEye — Claude Code Agent Workflow
3+
# Powered by Anthropic Claude Code Action v1 | DorkEye Project
4+
#
5+
# TRIGGERS:
6+
# • Every opened/updated PR → automatic review with bug + security analysis
7+
# • @claude in comments/issues → interactive assistant
8+
# • Every Monday at 09:00 UTC → full weekly repo audit
9+
# • workflow_dispatch → manual audit execution
10+
# ─────────────────────────────────────────────────────────────────────────────
11+
12+
name: 🦅 DorkEye AI Agent
13+
14+
on:
15+
pull_request:
16+
types: [opened, synchronize, reopened, ready_for_review]
17+
18+
issue_comment:
19+
types: [created]
20+
21+
pull_request_review_comment:
22+
types: [created]
23+
24+
issues:
25+
types: [assigned]
26+
27+
schedule:
28+
- cron: "0 9 * * 1" # Every Monday at 09:00 UTC
29+
30+
workflow_dispatch: # Manual trigger from the GitHub interface
31+
32+
concurrency:
33+
group: dorkeye-ai-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
34+
cancel-in-progress: true
35+
36+
# ─────────────────────────────────────────────────────────────────────────────
37+
# JOB 1 — Automatic PR Review
38+
# Full analysis of every PR: bugs, vulns, security, code quality
39+
# ─────────────────────────────────────────────────────────────────────────────
40+
jobs:
41+
pr-review:
42+
name: 🔍 PR Review & Security Analysis
43+
if: github.event_name == 'pull_request'
44+
runs-on: ubuntu-latest
45+
permissions:
46+
contents: read
47+
pull-requests: write
48+
issues: write
49+
id-token: write
50+
51+
steps:
52+
- uses: actions/checkout@v4
53+
with:
54+
fetch-depth: 1
55+
56+
- uses: anthropics/claude-code-action@v1
57+
with:
58+
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
59+
track_progress: true
60+
prompt: |
61+
REPO: ${{ github.repository }}
62+
PR NUMBER: ${{ github.event.pull_request.number }}
63+
AUTHOR: ${{ github.event.pull_request.user.login }}
64+
65+
You are a senior security engineer and Python expert reviewing a PR for DorkEye,
66+
an advanced OSINT and Google Dorking tool written in Python by xPloits3c.
67+
68+
PROJECT ARCHITECTURE:
69+
- dorkeye.py: main script (Google/DuckDuckGo dorking, WAF detection, SQLi)
70+
- Tools/dorkeye_analyze.py: SQLi analyzer with confidence scoring
71+
- Tools/dorkeye_report.py: HTML report generator (watch for XSS)
72+
- config/: YAML templates and dork configurations
73+
- requirements.txt: requests, urllib3, PyYAML, rich, ddgs>=4.0.0,<5.0.0
74+
NOTE: ddgs is deliberately pinned to v4.x — v5 introduces breaking changes
75+
to the API (from standalone functions to DDGS class). DO NOT suggest upgrading to v5.
76+
77+
ANALYZE THIS PR WITH THE FOLLOWING PRIORITIES:
78+
79+
🔴 CRITICAL (blocks merge):
80+
- XSS in HTML report: unsanitized content inserted into the DOM
81+
- SQL injection in payload or query construction
82+
- Command injection via subprocess/os.system with user input
83+
- Hardcoded secrets, API keys or credentials
84+
- Path traversal vulnerabilities
85+
- Python 3.8 incompatibilities (walrus :=, match/case, typing union |, etc.)
86+
- Security functions defined but never called (e.g. test_path_based_sqli)
87+
88+
🟡 SECURITY (report as warning):
89+
- yaml.load() without Loader=yaml.SafeLoader
90+
- pickle or unsafe deserializations
91+
- SSL/TLS verification disabled (verify=False)
92+
- Sensitive data leakage in logs or error messages
93+
- External input used without validation
94+
95+
🔵 CODE QUALITY:
96+
- Gap in SQLiConfidence.CRITICAL assignment
97+
- baseline_status == None bug in SQLi analyzer
98+
- Incomplete cross-database payloads for time-based SQLi
99+
- Stub or placeholder implementations never completed
100+
- Missing error handling in network calls
101+
- Inconsistencies in rich console output
102+
103+
🟢 IMPROVEMENTS:
104+
- PEP 8 and Python best practices
105+
- Performance optimizations
106+
- Missing documentation for new functions
107+
- Test coverage suggestions
108+
109+
RESPONSE FORMAT:
110+
Use inline comments for code-specific issues.
111+
Post a summary comment with an evaluation table using emojis and
112+
severity levels (🔴 CRITICAL / 🟡 HIGH / 🔵 MEDIUM / 🟢 LOW).
113+
Be precise, technical and constructive.
114+
claude_args: |
115+
--max-turns 15
116+
--allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Read,GlobTool,GrepTool"
117+
--append-system-prompt "You are integrated into DorkEye, a Python OSINT/security tool. Be rigorous about vulnerabilities but constructive in tone. Absolute priority on security and stability."
118+
119+
# ─────────────────────────────────────────────────────────────────────────────
120+
# JOB 2 — Interactive Assistant
121+
# Responds to @claude mentions in PR comments and issues
122+
# ─────────────────────────────────────────────────────────────────────────────
123+
interactive:
124+
name: 💬 Claude Interactive Assistant
125+
if: |
126+
github.event_name == 'issue_comment' ||
127+
github.event_name == 'pull_request_review_comment' ||
128+
github.event_name == 'issues'
129+
runs-on: ubuntu-latest
130+
permissions:
131+
contents: write
132+
pull-requests: write
133+
issues: write
134+
id-token: write
135+
136+
steps:
137+
- uses: actions/checkout@v4
138+
139+
- uses: anthropics/claude-code-action@v1
140+
with:
141+
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
142+
claude_args: |
143+
--max-turns 10
144+
--append-system-prompt "You are Claude, an AI assistant integrated into the GitHub repository of DorkEye — an advanced Python OSINT and Google Dorking tool created by xPloits3c (handle: xPloits3c). You know the full architecture: dorkeye.py (main), Tools/dorkeye_analyze.py (SQLi analyzer with confidence scoring), Tools/dorkeye_report.py (HTML report), config/ (YAML templates). Stack: Python 3.8+, rich, requests, urllib3, ddgs>=4.0.0<5.0.0 (pinned to v4 — v5 breaks the API), PyYAML. Optional plugins: llama-cpp-python (local LLM), playwright (screenshots). Help with bug reports, feature requests, code questions and security analysis. Be technical, precise and concise."
145+
146+
# ─────────────────────────────────────────────────────────────────────────────
147+
# JOB 3 — Automatic Weekly Audit
148+
# Every Monday: security scan, bug hunt, dep review, repo health
149+
# Creates a GitHub issue with the full report
150+
# ─────────────────────────────────────────────────────────────────────────────
151+
weekly-audit:
152+
name: 🔐 Weekly Security Audit & Repo Maintenance
153+
if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
154+
runs-on: ubuntu-latest
155+
permissions:
156+
contents: read
157+
issues: write
158+
pull-requests: read
159+
id-token: write
160+
161+
steps:
162+
- uses: actions/checkout@v4
163+
with:
164+
fetch-depth: 0 # Full history for in-depth analysis
165+
166+
- name: Set up Python 3.11
167+
uses: actions/setup-python@v5
168+
with:
169+
python-version: "3.11"
170+
171+
- name: Install DorkEye dependencies + audit tools
172+
run: |
173+
pip install --upgrade pip
174+
pip install -r requirements.txt
175+
pip install bandit pip-audit 2>/dev/null || true
176+
177+
- name: Run Bandit static security scan
178+
run: |
179+
bandit -r . -f json -o bandit-report.json \
180+
--exclude ./.git,./venv,./.venv,./node_modules \
181+
-ll 2>/dev/null || true
182+
echo "✅ Bandit scan completed"
183+
184+
- name: Run pip-audit dependency check
185+
run: |
186+
pip-audit --format=json --output=pip-audit-report.json || true
187+
echo "✅ pip-audit check completed"
188+
189+
- uses: anthropics/claude-code-action@v1
190+
with:
191+
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
192+
prompt: |
193+
REPO: ${{ github.repository }}
194+
AUDIT DATE: ${{ github.run_started_at }}
195+
196+
You are running the weekly automated audit of DorkEye —
197+
an advanced Python OSINT and Google Dorking tool created by xPloits3c.
198+
199+
ARCHITECTURE:
200+
- dorkeye.py: main script
201+
- Tools/dorkeye_analyze.py: SQLi analyzer (check CRITICAL gap and baseline_status)
202+
- Tools/dorkeye_report.py: HTML report (XSS-sensitive, uses escaping)
203+
- config/: YAML templates and dork configurations
204+
- requirements.txt: requests, urllib3, PyYAML, rich, ddgs>=4.0.0,<5.0.0
205+
- .github/: workflows, SECURITY.md, CONTRIBUTING.md, issue templates
206+
207+
EXECUTE THESE TASKS IN ORDER:
208+
209+
━━━ 1. SECURITY AUDIT ━━━
210+
- Read all .py files and identify security vulnerabilities
211+
- Read bandit-report.json (if it exists) for automated results
212+
- Read pip-audit-report.json (if it exists) for vulnerable dependencies
213+
- Look for: XSS in HTML output, injection flaws, unsafe yaml.load(),
214+
hardcoded secrets, security-critical functions never called
215+
- Verify that ddgs is still pinned to >=4.0.0,<5.0.0
216+
⚠️ DO NOT suggest upgrading to v5 — breaking API changes are intentional
217+
218+
━━━ 2. BUG HUNT ━━━
219+
- Identify logic errors, None dereferences, unhandled exceptions
220+
- Check for SQLiConfidence.CRITICAL gap in the analyzer
221+
- Verify handling of baseline_status == None
222+
- Look for incomplete cross-database time-based SQLi payloads
223+
- Functions defined but never called (e.g. test_path_based_sqli)
224+
225+
━━━ 3. DEPENDENCY REVIEW ━━━
226+
- Check requirements.txt for outdated or vulnerable packages
227+
- Check for dependencies imported directly but only transitive in the file
228+
- Report version ranges that could be widened or tightened
229+
230+
━━━ 4. REPOSITORY HEALTH ━━━
231+
- Is README.md up to date with current features?
232+
- Does SECURITY.md have correct disclosure information?
233+
- Look for TODO/FIXME/HACK in the code
234+
- Are .github/ workflows using deprecated action versions?
235+
- Are issue templates and PR templates up to date?
236+
237+
━━━ 5. IMPROVEMENTS ━━━
238+
- High-impact architectural suggestions
239+
- Features missing relative to open issues
240+
- Documentation gaps
241+
242+
AFTER THE ANALYSIS:
243+
Create a GitHub issue with the title:
244+
"🦅 DorkEye Weekly Audit — $(date +"%Y-W%V")"
245+
246+
Structure the report with:
247+
- Summary table with counts per severity
248+
- Separate sections for each analysis area
249+
- Severity: 🔴 CRITICAL / 🟡 HIGH / 🔵 MEDIUM / 🟢 LOW / ℹ️ INFO
250+
- Each finding with: description, file:line, recommendation
251+
- "Quick Wins" section with the easiest and most impactful fixes
252+
- Add the "maintenance" label if it exists in the repo
253+
claude_args: |
254+
--max-turns 20
255+
--allowedTools "Read,GlobTool,GrepTool,Bash(cat:*),Bash(find:*),Bash(grep:*),Bash(date:*),Bash(gh issue create:*),Bash(gh issue list:*),Bash(gh label list:*)"
256+
--append-system-prompt "Be rigorous and methodical. Prioritize real security findings over style suggestions. The issue report must be in clean, readable and actionable Markdown. Do not create duplicate issues — first check whether an audit for the current week already exists."

0 commit comments

Comments
 (0)