Helps security researchers find real vulnerabilities in open source packages by coordinating several agents to scan code, mine past advisories for incomplete fixes, and triage false positives. Each candidate issue comes with the evidence needed to judge whether it is a genuine CVE.
@byamb4Mine GitHub Security Advisories and CVE databases for incomplete fixes, finding variant vulnerabilities in patched code or…
@byamb4Detect authentication and authorization bypass vulnerabilities including missing auth middleware, JWT algorithm confusion, IDOR,…
@byamb4Detect code injection vulnerabilities in packages that dynamically generate or evaluate code via new Function(), eval(), vm.run*,…
@byamb4Detect OS command injection via shell execution sinks where user-controlled input reaches system commands without proper…
@byamb4Cross-pollination multiplier technique: find a vulnerability in one package, then search for the same pattern across all similar…
@byamb4Detect decompression bomb vulnerabilities where compressed input can expand to exhaust memory, targeting buffer-based…
@byamb4Detect XML/SVG/YAML entity expansion (Billion Laughs) vulnerabilities in parsers that allow unbounded entity definitions.
@byamb4Systematic false positive elimination for security findings. 6-gate verification, 13-item checklist, devil's advocate…
@byamb4Detect JWT implementation vulnerabilities including algorithm confusion, none algorithm acceptance, weak secrets, and JWK…
@byamb4Detect method clobbering via user-controlled object keys that overwrite built-in methods like toString, valueOf, or…
@byamb4Detect path traversal and Zip Slip vulnerabilities where user-controlled path components can escape intended directories.
@byamb4Detect prototype pollution via object merge/clone/assign operations where __proto__ or constructor.prototype keys can modify…
@byamb4PoC builder and exploit chainer. Takes Hunter findings and builds working proof-of-concept exploits. Always seeks to escalate…
@byamb4Code review specialist. Performs deep source code analysis to find security vulnerabilities by tracing data flows from untrusted…
@byamb4Target discovery agent. Finds promising open source packages for security review by analyzing npm/PyPI/GitHub registries,…
@byamb4Research tracking agent. Maintains REGISTRY.md as the single source of truth. Prevents duplicate work, records all outcomes, and…
@byamb4False positive elimination specialist. Runs 6-gate verification process on every finding. Only CONFIRMED findings proceed to…
@byamb4Query NVD and OSV.dev for existing CVEs. Usage: /check-nvd <package-name>. Shows CVE count, severity breakdown, and recent fixes.
@byamb4Take a confirmed vulnerability pattern and find the same bug in similar packages. Usage: /cross-pollinate (run after confirming a…
@byamb4Run the 6-gate false positive elimination process on the current finding. Usage: /fp-check (run from a target directory with…
@byamb4Full CVE hunting pipeline. Usage: /hunt <package-name>. Orchestrates all agents: registry check, clone, code review, PoC build,…
@byamb4Find targets in a category. Usage: /recon <category>. Examples: /recon csv-parsers, /recon template-engines, /recon archive-libs.
@byamb4Query or update the research registry. Usage: /registry [query]. Examples: /registry stats, /registry check lodash, /registry…
@byamb4Generate a disclosure report from the current finding. Auto-detects the best submission channel. Usage: /report (run from target…
@byamb4Is this you? Claim your profilePut a plugin at the top of Plugins, from $9
