harness-kit

Maps target codebase structure, enumerates entry points and trust boundaries, mines git history for security-relevant changes, and identifies risk surfaces for audits. Triggers on 'recon', 'reconnaissance', 'map codebase', 'enumerate entry points', 'trust boundaries'.

Investigates a single narrowly-scoped vulnerability hypothesis from the recon queue. Designed to run concurrently, one agent per task. Triggers on 'hunt', 'investigate', 'confirm vulnerability', 'proof of concept'.

Adversarial review of hunt findings. No bash access. Read-only. Default to rejection. Triggers on 'validate', 'review', 'adversarial', 'confirm finding'.

Performs taint analysis to prove attacker-controlled input reaches the vulnerable sink. No bash access. Read-only. Triggers on 'trace', 'taint analysis', 'data flow', 'input reaches sink'.

Assembles trace-confirmed findings into a final report. Only findings with TRACE_CONFIRMED status reach this stage. Triggers on 'report', 'assemble findings', 'final report', 'security report'.