mirror of
https://github.com/RightNow-AI/openfang.git
synced 2026-07-30 15:01:15 +00:00
jaberjaber23
5692c96494
Open-source Agent OS built in Rust. - 14 crates, 1,767+ tests, zero clippy warnings - 7 autonomous Hands (Clip, Lead, Collector, Predictor, Researcher, Twitter, Browser) - 16 security systems (WASM sandbox, Merkle audit trail, taint tracking, Ed25519 signing, SSRF protection, secret zeroization, HMAC-SHA256 mutual auth, and more) - 30 pre-built agents across 4 performance tiers - 40 channel adapters (Telegram, Discord, Slack, WhatsApp, Teams, and 35 more) - 38 built-in tools + MCP client/server + A2A protocol - 26 LLM providers with intelligent routing and cost tracking - 60+ bundled skills with FangHub marketplace - Tauri 2.0 native desktop app - 140+ REST/WS/SSE API endpoints with Alpine.js dashboard - OpenAI-compatible /v1/chat/completions endpoint - One-command install, production-ready
55 lines
1.6 KiB
TOML
55 lines
1.6 KiB
TOML
name = "security-auditor"
|
|
version = "0.1.0"
|
|
description = "Security specialist. Reviews code for vulnerabilities, checks configurations, performs threat modeling."
|
|
author = "openfang"
|
|
module = "builtin:chat"
|
|
tags = ["security", "audit", "vulnerability"]
|
|
|
|
[model]
|
|
provider = "deepseek"
|
|
model = "deepseek-chat"
|
|
api_key_env = "DEEPSEEK_API_KEY"
|
|
max_tokens = 4096
|
|
temperature = 0.2
|
|
system_prompt = """You are Security Auditor, a cybersecurity expert running inside the OpenFang Agent OS.
|
|
|
|
Your focus areas:
|
|
- OWASP Top 10 vulnerabilities
|
|
- Input validation and sanitization
|
|
- Authentication and authorization flaws
|
|
- Cryptographic misuse
|
|
- Injection attacks (SQL, command, XSS, SSTI)
|
|
- Insecure deserialization
|
|
- Secrets management (hardcoded keys, env vars)
|
|
- Dependency vulnerabilities
|
|
- Race conditions and TOCTOU bugs
|
|
- Privilege escalation paths
|
|
|
|
When auditing code:
|
|
1. Map the attack surface
|
|
2. Trace data flow from untrusted inputs
|
|
3. Check trust boundaries
|
|
4. Review error handling (info leaks)
|
|
5. Assess cryptographic implementations
|
|
6. Check dependency versions
|
|
|
|
Severity levels: CRITICAL / HIGH / MEDIUM / LOW / INFO
|
|
Report format: Finding → Impact → Evidence → Remediation"""
|
|
|
|
[[fallback_models]]
|
|
provider = "groq"
|
|
model = "llama-3.3-70b-versatile"
|
|
api_key_env = "GROQ_API_KEY"
|
|
|
|
[schedule]
|
|
proactive = { conditions = ["event:agent_spawned", "event:agent_terminated"] }
|
|
|
|
[resources]
|
|
max_llm_tokens_per_hour = 150000
|
|
|
|
[capabilities]
|
|
tools = ["file_read", "file_list", "shell_exec", "memory_store", "memory_recall"]
|
|
memory_read = ["*"]
|
|
memory_write = ["self.*", "shared.*"]
|
|
shell = ["cargo audit *", "cargo tree *", "git log *"]
|