pruizCommunity·16 Agent Skills Included

CodeCome

Structured source code vulnerability research and exploit validation

Audits source code through six repeatable phases: reconnaissance, hypothesis generation, counter-analysis, sandbox validation, exploit development, and reporting. Eliminates vague scanner output by requiring evidence-backed findings stored as reviewable Markdown files on disk. Includes language-specific security skills for C/C++, PHP, .NET, Erlang, web apps, SQL injection, and infrastructure-as-code targets.

39|4

↗

npx skills add pruiz/CodeCome --all -g -y

Available:

Instructs the agent to run a six-phase vulnerability research workflow, write durable findings and evidence to the itemdb directory, and follow strict sandbox and quality rules.

All Skills in This Repository (16)

Pure Emerald Level Indicators

📦 In Repo

pruiz

juliet-benchmark

Evaluate Juliet C/C++ test cases for vulnerability detection and validation.

Exploit Recording Skill

Generate audiovisual recordings of security exploits using asciinema, ffmpeg, and Xvfb.

finding-format

Generate structured security finding reports with YAML frontmatter for CodeCome.

exploit-validation

Validate vulnerability findings with structured evidence collection and sandbox testing.

report-writing

Convert vulnerability assessment data and evidence into Markdown reports.

Counter-Analysis

Guides structured validation of vulnerability findings through critical disproof and deduplication.

IaC Security

Analyze infrastructure-as-code repositories for security misconfigurations and vulnerabilities.

c-cpp-security

...

sandbox-bootstrap

Automate creation and validation of sandbox environments for vulnerability research targets.

exploit-development

Guides security researchers in designing, executing, and documenting exploit proofs-of-concept.

sandbox-validation

Build, run, and validate software in an isolated sandbox environment.

source-recon

Analyze repository files to detect target types, technologies, and attack surfaces.

Community

Intermediate

Frequently Asked Questions

FAQPage Schema

How to install CodeCome?▼

Run `npx skills add pruiz/CodeCome --all -g -y` in your terminal to install all skills in this suite globally.

What does CodeCome do?▼

It guides an agent through a six-phase security audit: recon, hypothesis, counter-analysis, sandbox validation, exploit development, and reporting. Every finding is stored as a reviewable Markdown file with evidence.

Which languages does CodeCome support?▼

It ships dedicated security skills for C/C++, PHP, .NET, Erlang, web applications, SQL injection, RabbitMQ, and infrastructure-as-code, plus a generic workflow for any target.

Does CodeCome validate vulnerabilities automatically?▼

Yes. It builds and runs the target inside a Docker sandbox, reproduces each finding, and only marks it confirmed when reproducible evidence exists.

Do I need security expertise to use CodeCome?▼

No. You drop a source tree into the src folder, set the project name, and run the phase commands; the agent handles the audit methodology.