菜单
Install/vendor the analysis tooling for this repo's detected languages — LSP servers (rust-analyzer, clangd, jdtls) and MCP backend CLIs. Pass a tool name to install a specific one, including the heavy ones (e.g. /install codeql, /install joern). Use when /doctor shows tools missing.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Interprocedural, hypothesis-driven hunt — finds the multi-file source→sink bugs that pattern-gating and same-file taint miss. Ranks trace anchors (entry points + dangerous sinks), then the deep-hunter agent walks each flow ACROSS files (forward/backward call-graph CLIs) over multiple rounds, confirming propagation and defeating guards, and promotes confirmed cross-file flows into findings.json with the path stored as evidenceGraph. Token-expensive, budget-bounded. Part of the HUNT phase (run via /sweep --deep, or ask for it); leads flow to /verify (panel).
Whole-file deep reader — finds bugs by READING risk-ranked files in full and reasoning from first principles, not by grepping for known patterns. Catches the long tail (project-specific wrappers, business logic, cross-function flaws) that pattern-gated producers structurally miss. Token-expensive; budget-bounded and risk-ranked. Promotes leads into .kuzushi/findings.json (source "deep-scan").
IRIS-style source→sink taint hunt. Ranks a typed CWE catalog for the repo, then drives subagents to label dangerous sinks, label sources of user input, run Joern/CodeQL dataflow queries (or same-file linking) to connect them, and triage each flow as finding/candidate/rejected. Promotes verdicts into .kuzushi/findings.json. Benefits from a prebuilt CodeQL DB / Joern CPG but degrades gracefully.
Adversarial per-threat review (Carlini doctrine). For each threat in .kuzushi/threat-model.json, state attacker capabilities, walk source→sink, attempt to bypass every guard, and assign a verdict with evidence. Promotes findings into .kuzushi/findings.json. Requires /threat-model first.
Split the attack surface into parallel-discovery partitions so fan-out hunters explore different subsystems instead of converging on the same shallow bug. Deterministic grouping of /x-ray entry points by component → .kuzushi/partitions.json, which a hunt coordinator hands to one subagent per partition. Run /x-ray first.
Empirical proof-of-concept for the PoC-ready findings. For each finding /verify marked confirmed-exploitable or inconclusive, synthesize a minimal harness that triggers the bug; a host script then runs it in a sandbox (Docker --network none when present, else a gated local run) and classifies the crash into a proof verdict. Attaches a poc block onto each finding. Requires /verify first.
| name | install |
| user-invocable | false |
| description | Install/vendor the analysis tooling for this repo's detected languages — LSP servers (rust-analyzer, clangd, jdtls) and MCP backend CLIs. Pass a tool name to install a specific one, including the heavy ones (e.g. /install codeql, /install joern). Use when /doctor shows tools missing. |
| argument-hint | [tool|all] |
| allowed-tools | Bash |
Install the language-relevant tooling for the current repository (vendors prebuilt binaries
into the plugin where possible, runs native installers otherwise). Choose the command based
on the argument the user passed ($ARGUMENTS); use the project working directory as <cwd>:
codeql, joern, clangd) — installs just that one, including
heavy ones:
node "${CLAUDE_PLUGIN_ROOT}/scripts/cmd/install-tooling.mjs" --target "<cwd>" --only $ARGUMENTS --approvedall — everything relevant including the heavy codeql/joern (~1–3 GB):
node "${CLAUDE_PLUGIN_ROOT}/scripts/cmd/install-tooling.mjs" --target "<cwd>" --include-heavy --approvednode "${CLAUDE_PLUGIN_ROOT}/scripts/cmd/install-tooling.mjs" --target "<cwd>" --approvedThen relay the JSON result: what was installed, what failed (show the reason / install
hint), and what needsConfirm (heavy tools you can install by name). Warn that heavy
downloads (codeql ~1 GB, joern ~2 GB) take a while, and that jdtls/joern need system Java,
gopls needs Go, and semgrep needs Python. Suggest /doctor to confirm the final status.
/install; building the indexes is
/build-databases./doctor (don't reinstall blindly).