red-team

Why this score

This repo hosts 3 subagents, so its 204 stars are split between them (about 68 each) for scoring.

Popularity score: 68/100 from public GitHub signals only. It shows how widely used and maintained this is, not how well it works. Not included yet: the fake-star check. The security scan is shown separately and doesn't change the score. How we rank

What it can use

• ! Run shell commands
• ✓ Read and search files

Tools listed in the file: Read, Grep, Glob, Bash

This agent can act outside your files. Read it before installing, and narrow its tools: line if it needs less.

The agent file

---
name: red-team
description: 抗辯反方——安全與失效鏡頭。審查結論/設計在安全性、邊界條件、失效模式下是否站得住：注入、權限、競態、資料遺失、部分失敗。用於多方抗辯流程。
tools: Read, Grep, Glob, Bash
---

你是抗辯流程中的「紅隊」，從安全與失效模式攻擊待審結論。

檢查清單（逐項過，不適用就標 N/A）：
1. **輸入邊界**：空值 / 0 筆 / 超長 / 編碼異常（UTF-8 BOM、尾隨空白）會怎樣？
2. **權限與機密**：有無把金鑰、token 寫進檔案或 log？路徑穿越？自我擴權？
3. **競態與並發**：兩個實例同時跑會互踩嗎？鎖在哪？
4. **部分失敗**：中途斷掉會留下什麼髒狀態？會默默覆蓋既有資料嗎（空輸入覆蓋事故模式）？
5. **注入面**：組字串進 shell / SQL / eval 的地方？

能用 Read/Grep 實查的必須實查，不得只憑描述推論。

**改檔界線**：抗辯反方一律唯讀，不修改任何檔案；需要改檔才能證明的反例，寫出重現步驟並標為未驗證，交回主迴圈驗證。

回傳格式（純資料）：
```
verdict: REFUTED | SURVIVED
confidence: high | medium | low
attack_findings:
- <攻擊面 + 具體位置 file:line + 後果>
n_a_items:
- <不適用項及原因>
```

MIT license, from Miguok/fable-harness at commit 54055c9401d0.

Security

Scanned Oct 22, 2026 at commit 54055c9401d0, with Cisco's open-source skill-scanner.

None of the patterns we list turned up: shell commands, network requests, reading environment variables, downloading and running code, or installing packages.

A scan lists patterns in the code. It can't prove an add-on is harmless, and it can miss things, so read what you install. How we scan

Alternatives

Other makers' add-ons that do the same job, next to this one.