ExaAiAgent

分类: 测试与安全 | 上传者: hleliofficiel | 下载: 0 | 版本: v1.0（最新）

AI-powered penetration testing framework (v2.2.2). Features Multi-Agent Swarm orchestration, autonomous 100% awareness, advanced K8s/Cloud auditing, and automated owner reporting.

更新日志: Source: GitHub https://github.com/hleliofficiel/ExaAiAgent

目录结构

当前层级: 根目录

📁 .github/
- 📁 ISSUE_TEMPLATE/
  - 📄 bug_report.md 645 B
  - 📄 feature_request.md 613 B
- 📁 workflows/
  - 📄 publish.yml 909 B
- 📄 logo.png 208.2 KB
- 📄 screenshot.png 399.7 KB
📁 containers/
- 📄 BUILD.md 1.4 KB
- 📄 build_and_push.sh 1.5 KB
- 📄 docker-entrypoint.sh 3.9 KB
- 📄 Dockerfile 10.7 KB
📁 exaaiagnt/
- 📁 agents/
  - 📁 ExaaiAgent/
    
    📄 __init__.py 63 B
    
    📄 exaai_agent.py 3.9 KB
    
    📄 system_prompt.jinja 24.2 KB
  - 📄 __init__.py 1018 B
  - 📄 agent_supervisor.py 16.9 KB
  - 📄 base_agent.py 21.2 KB
  - 📄 scan_modes.py 8.2 KB
  - 📄 shared_memory.py 10.2 KB
  - 📄 state.py 5.7 KB
- 📁 dashboard/
  - 📁 static/
    
    📄 Readme.md 1 B
  - 📁 templates/
    
    📄 index.html 11.5 KB
  - 📄 server.py 3.2 KB
- 📁 interface/
  - 📁 assets/
    
    📄 tui_styles.tcss 11.8 KB
  - 📁 tool_components/
    
    📄 __init__.py 935 B
    
    📄 agents_graph_renderer.py 4.3 KB
    
    📄 base_renderer.py 1.9 KB
    
    📄 browser_renderer.py 4.4 KB
    
    📄 file_edit_renderer.py 3.5 KB
    
    📄 finish_renderer.py 984 B
    
    📄 notes_renderer.py 3.6 KB
    
    📄 proxy_renderer.py 10.0 KB
    
    📄 python_renderer.py 1.2 KB
    
    📄 registry.py 2.3 KB
    
    📄 reporting_renderer.py 1.7 KB
    
    📄 scan_info_renderer.py 2.2 KB
    
    📄 terminal_renderer.py 3.3 KB
    
    📄 thinking_renderer.py 927 B
    
    📄 user_message_renderer.py 1.4 KB
    
    📄 web_search_renderer.py 911 B
  - 📄 __init__.py 44 B
  - 📄 cli.py 9.5 KB
  - 📄 main.py 19.6 KB
  - 📄 tui.py 48.8 KB
  - 📄 utils.py 19.7 KB
- 📁 llm/
  - 📄 __init__.py 1.1 KB
  - 📄 config.py 3.2 KB
  - 📄 fallback.py 10.8 KB
  - 📄 llm.py 19.3 KB
  - 📄 llm_traffic_controller.py 11.6 KB
  - 📄 memory_compressor.py 6.9 KB
  - 📄 output_processor.py 12.7 KB
  - 📄 request_queue.py 8.8 KB
  - 📄 utils.py 2.5 KB
- 📁 prompts/
  - 📁 cloud/
    
    📄 .gitkeep 0 B
    
    📄 aws_cloud_security.jinja 6.6 KB
    
    📄 azure_cloud_security.jinja 5.1 KB
    
    📄 gcp_cloud_security.jinja 6.5 KB
    
    📄 kubernetes_security.jinja 4.0 KB
  - 📁 coordination/
    
    📄 root_agent.jinja 1.9 KB
  - 📁 custom/
    
    📄 .gitkeep 0 B
  - 📁 frameworks/
    
    📄 fastapi.jinja 10.0 KB
    
    📄 modern_js_frameworks.jinja 5.6 KB
    
    📄 nextjs.jinja 8.0 KB
  - 📁 protocols/
    
    📄 graphql.jinja 10.2 KB
  - 📁 reconnaissance/
    
    📄 .gitkeep 0 B
    
    📄 port_scanning.jinja 1003 B
    
    📄 subdomain_enumeration.jinja 952 B
    
    📄 technology_fingerprinting.jinja 1000 B
  - 📁 technologies/
    
    📄 firebase_firestore.jinja 11.1 KB
    
    📄 supabase.jinja 11.5 KB
  - 📁 vulnerabilities/
    
    📄 advanced_recon.jinja 8.8 KB
    
    📄 api_security.jinja 9.2 KB
    
    📄 authentication_jwt.jinja 8.2 KB
    
    📄 broken_function_level_authorization.jinja 7.0 KB
    
    📄 business_logic.jinja 9.6 KB
    
    📄 cache_poisoning.jinja 7.3 KB
    
    📄 cloud_security.jinja 5.1 KB
    
    📄 csrf.jinja 8.5 KB
    
    📄 deserialization.jinja 9.1 KB
    
    📄 graphql_security.jinja 5.9 KB
    
    📄 grpc_security.jinja 1.7 KB
    
    📄 high_impact_bugs.jinja 8.6 KB
    
    📄 http_smuggling.jinja 8.3 KB
    
    📄 idor.jinja 10.5 KB
    
    📄 information_disclosure.jinja 12.1 KB
    
    📄 insecure_file_uploads.jinja 10.7 KB
    
    📄 mass_assignment.jinja 7.0 KB
    
    📄 oauth_oidc.jinja 9.1 KB
    
    📄 open_redirect.jinja 9.2 KB
    
    📄 path_traversal_lfi_rfi.jinja 7.7 KB
    
    📄 post_exploitation.jinja 8.2 KB
    
    📄 privilege_escalation.jinja 6.6 KB
    
    📄 prompt_injection.jinja 9.2 KB
    
    📄 prototype_pollution.jinja 6.3 KB
    
    📄 race_conditions.jinja 8.2 KB
    
    📄 rce.jinja 8.2 KB
    
    📄 react2shell.jinja 6.7 KB
    
    📄 reconnaissance_osint.jinja 5.4 KB
    
    📄 rest_api_security.jinja 1.6 KB
    
    📄 sql_injection.jinja 8.2 KB
    
    📄 ssrf.jinja 7.7 KB
    
    📄 ssti.jinja 7.8 KB
    
    📄 subdomain_takeover.jinja 9.5 KB
    
    📄 waf_bypass.jinja 8.7 KB
    
    📄 websocket_security.jinja 6.9 KB
    
    📄 xss.jinja 8.5 KB
    
    📄 xxe.jinja 7.7 KB
  - 📄 __init__.py 4.9 KB
  - 📄 auto_loader.py 13.6 KB
  - 📄 README.md 3.9 KB
- 📁 runtime/
  - 📄 __init__.py 760 B
  - 📄 docker_runtime.py 16.3 KB
  - 📄 runtime.py 730 B
  - 📄 tool_manager.py 13.9 KB
  - 📄 tool_server.py 6.7 KB
- 📁 telemetry/
  - 📄 __init__.py 130 B
  - 📄 tracer.py 14.3 KB
- 📁 tools/
  - 📁 agents_graph/
    
    📄 __init__.py 278 B
    
    📄 agents_graph_actions.py 20.6 KB
    
    📄 agents_graph_actions_schema.xml 12.3 KB
  - 📁 browser/
    
    📄 __init__.py 75 B
    
    📄 browser_actions.py 6.9 KB
    
    📄 browser_actions_schema.xml 9.3 KB
    
    📄 browser_instance.py 18.2 KB
    
    📄 tab_manager.py 12.7 KB
  - 📁 file_edit/
    
    📄 __init__.py 141 B
    
    📄 file_edit_actions.py 3.9 KB
    
    📄 file_edit_actions_schema.xml 5.3 KB
  - 📁 finish/
    
    📄 __init__.py 68 B
    
    📄 finish_actions.py 5.6 KB
    
    📄 finish_actions_schema.xml 2.2 KB
  - 📁 k8s_scanner/
    
    📄 __init__.py 558 B
    
    📄 k8s_actions.py 15.2 KB
    
    📄 k8s_actions_schema.xml 1.2 KB
  - 📁 notes/
    
    📄 __init__.py 189 B
    
    📄 notes_actions.py 5.6 KB
    
    📄 notes_actions_schema.xml 6.1 KB
  - 📁 prompt_injection/
    
    📄 __init__.py 646 B
    
    📄 prompt_injection_actions.py 26.7 KB
    
    📄 prompt_injection_actions_schema.xml 1.3 KB
  - 📁 proxy/
    
    📄 __init__.py 329 B
    
    📄 proxy_actions.py 2.5 KB
    
    📄 proxy_actions_schema.xml 11.3 KB
    
    📄 proxy_manager.py 28.3 KB
  - 📁 python/
    
    📄 __init__.py 72 B
    
    📄 python_actions.py 1.4 KB
    
    📄 python_actions_schema.xml 7.0 KB
    
    📄 python_instance.py 6.1 KB
    
    📄 python_manager.py 4.1 KB
  - 📁 reporting/
    
    📄 __init__.py 110 B
    
    📄 reporting_actions.py 3.0 KB
    
    📄 reporting_actions_schema.xml 1.6 KB
  - 📁 terminal/
    
    📄 __init__.py 80 B
    
    📄 terminal_actions.py 892 B
    
    📄 terminal_actions_schema.xml 7.1 KB
    
    📄 terminal_manager.py 4.7 KB
    
    📄 terminal_session.py 16.1 KB
  - 📁 thinking/
    
    📄 __init__.py 58 B
    
    📄 thinking_actions.py 568 B
    
    📄 thinking_actions_schema.xml 2.7 KB
  - 📁 web_search/
    
    📄 __init__.py 70 B
    
    📄 web_search_actions.py 3.2 KB
    
    📄 web_search_actions_schema.xml 4.7 KB
  - 📄 __init__.py 3.9 KB
  - 📄 argument_parser.py 3.8 KB
  - 📄 executor.py 11.2 KB
  - 📄 registry.py 5.9 KB
  - 📄 response_analyzer.py 10.3 KB
  - 📄 smart_fuzzer.py 11.9 KB
  - 📄 tool_prompts.py 5.6 KB
  - 📄 vuln_validator.py 13.5 KB
  - 📄 waf_bypass.py 11.5 KB
- 📄 __init__.py 22 B
📁 tests/
- 📁 agents/
  - 📄 __init__.py 37 B
- 📁 interface/
  - 📄 __init__.py 40 B
- 📁 llm/
  - 📄 __init__.py 34 B
- 📁 prompts/
  - 📄 test_auto_loader.py 1.3 KB
- 📁 runtime/
  - 📄 __init__.py 38 B
- 📁 telemetry/
  - 📄 __init__.py 40 B
- 📁 tools/
  - 📄 __init__.py 36 B
  - 📄 conftest.py 753 B
  - 📄 test_argument_parser.py 9.9 KB
  - 📄 test_k8s_scanner.py 2.3 KB
- 📄 __init__.py 19 B
- 📄 conftest.py 69 B
📄 .gitignore 893 B
📄 .pre-commit-config.yaml 1.6 KB
📄 AUDIT_REPORT.md 7.5 KB
📄 CONTRIBUTING.md 2.9 KB
📄 IMPROVEMENTS.md 1.9 KB
📄 install.sh 2.2 KB
📄 LICENSE 11.2 KB
📄 Makefile 3.0 KB
📄 poetry.lock 549.0 KB
📄 pyproject.toml 9.5 KB
📄 README.md 12.3 KB
📄 SKILL.md 3.9 KB

SKILL.md

---
name: ExaAiAgent
description: "AI-powered penetration testing framework (v2.2.2). Features Multi-Agent Swarm orchestration, autonomous 100% awareness, advanced K8s/Cloud auditing, and automated owner reporting."
homepage: https://github.com/hleliofficiel/ExaAiAgent
metadata:
  {
    "openclaw":
      {
        "emoji": "🛡️",
        "requires": { "bins": ["exaai", "docker"] },
        "install":
          [
            {
              "id": "pipx",
              "kind": "shell",
              "command": "pipx install exaai-agent",
              "bins": ["exaai"],
              "label": "Install ExaAiAgent (pipx)",
            },
            {
              "id": "pip",
              "kind": "shell",
              "command": "pip install exaai-agent",
              "bins": ["exaai"],
              "label": "Install ExaAiAgent (pip)",
            },
          ],
      },
  }
---

# ExaAiAgent Skill (v2.2.2) 🛡️

ExaAiAgent is an elite AI-powered cybersecurity agent designed to function as an autonomous penetration tester. Version 2.2.2 introduces the **Swarm Intelligence** engine, allowing multiple specialized agents to collaborate in real-time with 100% autonomy.

---

## 🚀 Key Features in v2.2.2
- **Multi-Agent Swarm**: Intelligent orchestration of RECON, ATTACK, and AUDITOR agents.
- **100% Autonomous Awareness**: Enhanced system prompts for zero-input operation and self-critique.
- **Automated Owner Reporting**: Built-in protocol to broadcast findings directly to the system owner.
- **Reconnaissance Engine**: Automated subdomain discovery and technology fingerprinting.
- **Advanced Kubernetes Audit**: Deep scanning for RBAC issues and PSS compliance.

---

## 🐝 Swarm Roles & 100% Awareness Protocol

### 1. Autonomous Decisions
The agent operates with **100% awareness** of its environment. It will no longer ask for "how to proceed" or seek user confirmation. It analyzes tool outputs, selects the next logical step (e.g., pivot from recon to SQLi), and only notifies the user upon finding critical issues or finishing the task.

### 2. Self-Critique Loop
Before every report, the agent performs a validation check:
- Is the evidence (HTTP requests/responses) attached?
- Is the severity correctly assessed based on business impact?
- Are the remediation steps actionable and technical?

### 3. Swarm Roles
- **RECON**: Focused on mapping attack surfaces and asset discovery.
- **ATTACK**: Specialized in exploitation, fuzzing, and WAF bypass.
- **AUDITOR**: Validates findings, performs config audits, and generates final reports.
- **SUPERVISOR**: Manages the swarm, delegates tasks, and communicates with the owner.

---

## 📋 Reporting to Owner

### Automatic Notification Protocol
ExaAiAgent is configured to automatically send the current findings and progress report directly to the system owner. This is triggered:
- When a **CRITICAL** or **HIGH** severity vulnerability is confirmed.
- Upon completion of a specific task by any swarm member.
- As a final summary after the `finish_scan` tool is called.

The report includes:
- **📊 Stats**: Vulnerability count and severity breakdown.
- **🚨 Alerts**: Quick preview of the most dangerous findings.
- **📝 Summary**: A high-level overview for the system owner.

---

## 🛠️ Commands & Usage

### Launching an Autonomous Swarm Scan
```bash
# Launch a full autonomous swarm-based scan (100% Awareness Mode)
exaai -n --target https://api.example.com --instruction "Perform a full swarm audit and report findings"
```

### New Reconnaissance Commands
```bash
# Automated Subdomain & Asset Discovery
exaai -n --target example.com --prompt-modules subdomain_enumeration

# Full Tech Stack & Port Audit
exaai -n --target https://api.example.com --prompt-modules technology_fingerprinting,port_scanning
```

---

## 🔗 Resources
- **GitHub:** https://github.com/hleliofficiel/ExaAiAgent
- **Changelog:** See `IMPROVEMENTS.md` for v2.2.2 details.

登录后下载/点赞/收藏 ❤ 5 | ★ 0

ExaAiAgent

目录结构

SKILL.md

举报内容

提示