mirror of
https://github.com/KeygraphHQ/shannon.git
synced 2026-09-19 16:32:22 +02:00
ajmallesh
c3864c9785
Give every exploit agent the same status, confidence, severity-reasoning, report-writing, credential-handling, and scope contract. Apply the same task-formation and SAST-enrichment procedure to the Miscellaneous lane.
20 lines
1.3 KiB
Plaintext
20 lines
1.3 KiB
Plaintext
@include(shared/_filesystem.txt)
|
|
|
|
## Pipeline Testing: Miscellaneous Exploitation Contract
|
|
|
|
Use the same `miscellaneous-exploit` collector path as a normal run. Do not create a separate deliverable or bypass the queue.
|
|
|
|
1. Read `.shannon/deliverables/miscellaneous_exploitation_queue.json`.
|
|
2. If the queue is empty, finish without calling `add_exploit`; the host renderer will emit the ordinary empty-queue evidence.
|
|
3. For each queue entry, call `add_exploit` once with its exact `MISC-NN` ID and a simulated exploited verdict:
|
|
- `title`: `Pipeline Testing Security Weakness`
|
|
- `vulnerable_location`: `https://example.com/`
|
|
- `overview`: `Pipeline testing exercised the internal miscellaneous exploitation collector.`
|
|
- `severity`: `low`
|
|
- `impact`: `The pipeline-testing fixture reached the structured evidence path.`
|
|
- `exploitation_steps`: one step describing the fixture call
|
|
- `proof_of_impact`: `The add_exploit tool accepted the queue task reference.`
|
|
- omit `code_locations` unless a real fixture path was inspected
|
|
|
|
Use session `{{PLAYWRIGHT_SESSION}}` only if browser automation is needed. The host must render `.shannon/deliverables/miscellaneous_exploitation_evidence.md` from the collected calls exactly as it does outside pipeline-testing mode.
|