菜单
Interpret and triage Agent Smith scan findings. Use when reading scan results, understanding severity ratings, or deciding what to fix first.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Run Agent Smith in CTF mode for Capture The Flag challenges. Use when doing CTF, finding flags, hunting exploitable vulnerabilities, or analyzing challenge code for quick wins.
Add new static analysis rules to Agent Smith's rule engine. Use when creating detection rules, adding regex patterns for vulnerabilities, or extending the static scanner.
Start, configure, and use the Agent Smith MCP server from Cursor. Use when setting up the MCP server, running scans via MCP tools, or integrating Agent Smith into Cursor IDE workflows.
Choose and combine AI analysis profiles for Agent Smith scans. Use when selecting profiles, combining multiple profiles, or understanding which profile fits a target codebase.
Run Agent Smith security scans with the right mode, preset, and flags. Use when scanning code for vulnerabilities, running security audits, or when the user mentions agentsmith, security scan, or vulnerability analysis.
| name | agentsmith-interpret |
| description | Interpret and triage Agent Smith scan findings. Use when reading scan results, understanding severity ratings, or deciding what to fix first. |
User has scan results and needs help understanding or triaging them.
Every finding has:
--generate-payloads)--annotate-code)| Severity | What it means | Action |
|---|---|---|
| CRITICAL | Actively exploitable, high impact | Fix immediately |
| HIGH | Exploitable with some conditions | Fix before release |
| MEDIUM | Potential risk, needs context | Review and assess |
| LOW | Minor concern, defense-in-depth | Fix when convenient |
| INFO | Informational, no direct risk | Note for awareness |
--show-chains) → multi-step exploitsWhen --show-chains is used, taint flows show data paths:
Source: user_input (line 42, api/handler.py)
→ sink: db.execute(query) (line 67, db/queries.py)
→ Impact: SQL Injection
This means user-controlled data reaches a dangerous function without sanitization.
Findings print to console with Rich formatting.
mcp> summary # severity counts + cost
mcp> findings 20 # top 20 findings
mcp> annotations # annotated source files
mcp> payloads # exploit payloads
mcp> everything # all of the above
--output-dir ./reports # JSON, CSV, Markdown, HTML in reports/
"Too many findings" → Use --severity HIGH to filter, or --top 5 for payloads on the worst ones only.
"Are these false positives?" → Static findings (rule_id present) have ~20% FP rate. AI findings are more precise. Cross-reference both.
"Which findings matter most?" → Look for CRITICAL + payload, or any finding in auth, payment, or data handling code.