メニュー
Use when expanding NSS attack hypotheses via Hermes delegate_task before a pipeline run. Writes hermes_proposals JSON for external provider ingestion.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Practitioner-elevated asset tracing patterns from SlowMist Crypto-Asset-Tracing-Handbook. Provides canonical property tables for obfuscation patterns (peel chains, mixers, bridge hops), address behavior clustering/risk profiling, cross-chain reconstruction workflows. Hard-first on behavioral + flow invariants. Integrates with codegraph-x-ray, deep-dive-handoff, and bounty forensics. Includes reference implementation for mixer deposit/withdrawal clustering. Trigger: alpha-miner on tracing handbook or similar.
Drop-in skill adapted from Glider query engine for static analysis, taint tracking, CFG/DFG traversal in bug bounty. Supports lazy reference loading, creativity layer for audited targets, integrates with bounty-loop. EVM priority with Solana compatibility.
Use for mining validator/runtime/cache/storage-key coherence bugs in blockchain clients, VMs, program loaders, bridge runtimes, and execution harnesses. Hard-first on stale cache, recycled identifier, partial flush, epoch/generation drift, mempool/order-dependent runtime state, and storage-key confusion. Trigger on runtime cache invariant, stale cache bug, VM storage confusion, client cache coherence, Aptos-style hijack, validator-local state, epoch-boundary bug, or when alpha-miner extracts runtime/client exploit engineering.
Cross-references a graphified target codebase (codegraph-x-ray output) against the local AuditVault corpus to surface structurally analogous historical vulnerabilities. Run after codegraph-x-ray has completed and produced invariants.md and property_candidates.md. Produces ranked pattern-match hits with per-finding graph anchor evidence. Pattern matches are advisory signals only — never evidence of exploitability and never a substitute for live reproduction or submission-gate validation.
Combines structured codegraph intelligence with rigorous invariant synthesis. Enforces high-quality usage of codegraph to identify the Primary Target Subsystem, then applies ordered structural invariant discovery with strict verification gates. Produces categorized invariants and high-quality property candidates ready for ultrafuzz-discovery. Trigger on codegraph-x-ray, x-ray with codegraph, invariant synthesis, primary subsystem invariants.
Optional accelerator and scaffolder for ultrafuzz-discovery. Brings parallel specialized invariant discovery agents, automated harness/handler scaffolding, coverage-driven refinement loops, property tagging, and reproducible test generation helpers from high-quality EVM fuzz patterns. Designed to speed up property fan-in and executable attempts phases while preserving NSS rigor, fresh-context pass@k, adjudication, and Crucible usage. Trigger on fuzz-scaffolder, accelerate invariant discovery, generate fuzz harness, scaffold handlers.
| name | hypothesis-expansion |
| description | Use when expanding NSS attack hypotheses via Hermes delegate_task before a pipeline run. Writes hermes_proposals JSON for external provider ingestion. |
Generate untrusted attack parameter proposals via delegate_task subagents (Grok OAuth). Output feeds the NSS pipeline as llm_expansion.provider: external.
kamino_shoestring.json or caller-specified)sources/kamino/recon.json when target is Kaminodata/security_results/semantic/<slug>/code_map.json and candidate_seeds.jsonl when presentfindings.json / grid seeds from prior pipeline stage metadatarun_id (e.g. kamino-immunefi-2026-06-YYYYMMDD)templates array, build delegate context:
parameter_spaces.py or sample one seed via CLI)delegate_task(
goal="Propose 2 diverse attack parameter variants for template <TEMPLATE>. Output JSON array of parameter objects only.",
context="Night Shift Security researcher. Template: <TEMPLATE>. Seed: <SEED_PARAMS>. Parameter space: <SPACE>. Catalog analogue: <ANALOGUE>. Recon: <RECON_SUMMARY>. Untrusted — must be valid JSON array.",
model="grok-4.3",
provider="xai-oauth"
)
data/security_results/hermes_proposals/<run_id>.json:{
"run_id": "...",
"campaign_id": "kamino-immunefi-2026-06",
"target_slug": "kamino",
"required_config": "src/night_shift_security/config/kamino_klend.json",
"allowed_templates": ["flash_loan_oracle", "composability_risk"],
"source_artifacts": ["data/security_results/semantic/kamino/code_map.json"],
"force_target": true,
"proposals": [
{
"template": "flash_loan_oracle",
"seed_id": "<optional seed hypothesis_id>",
"parameters": { "loan_fraction_of_ceiling": 0.3, "price_skew_severity": 0.6, "oracle_dependency_score": 0.8 },
"lineage": ["<seed_id>"],
"delegate_note": "composability angle vs mango analogue"
}
]
}
Symlink: ln -sf <run_id>.json data/security_results/hermes_proposals/latest.json
Run with explicit target pin:
.venv/bin/python -m night_shift_security.cli.main \
--proposals data/security_results/hermes_proposals/latest.json \
bounty loop --target <target_slug> --iterations 1
parameter_spaces.py exactly — wrong keys fail validate_hypothesis() silently (dropped proposals).seed_id must match actual seed hypothesis_id from sampled vectors or delegate proposals won't attach to seeds.--proposals is passed.target_slug / required_config now fails fast for forced proposals; that is intentional.