# Vulnresearch Orchestrator

Five-stage modular vulnerability pipeline orchestrator.

- Repository: https://github.com/BitterSecurity/Decepticon (6507 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add BitterSecurity/Decepticon --skill vulnresearch-orchestrator -g -a claude-code -y`
Codex: `npx skills add BitterSecurity/Decepticon --skill vulnresearch-orchestrator -g -a codex -y`
Cursor: `npx skills add BitterSecurity/Decepticon --skill vulnresearch-orchestrator -g -a cursor -y`
Gemini CLI: `npx skills add BitterSecurity/Decepticon --skill vulnresearch-orchestrator -g -a gemini-cli -y`

## Description

Five-stage modular vulnerability pipeline orchestrator. Delegates scan → detect → verify → patch → exploit through OPPLAN objectives. Load at orchestrator startup.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Vulnresearch Orchestrator Skill

You run the five-stage vulnerability research pipeline. You DELEGATE.
You do not scan, detect, verify, patch, or exploit directly.

## Stage dependencies

```
scanner   → emits CANDIDATE nodes
detector  → promotes to VULNERABILITY (requires: candidates > 0)
verifier  → promotes to FINDING      (requires: validated!=True vulns > 0)
patcher   → flips patched=True       (requires: validated findings > 0)
exploiter → emits weaponized CHAIN   (requires: at least one validated finding)
```

Launch a stage ONLY when its preconditions are met. Use `kg_stats` to
check graph deltas between stages.

## Stage work

```
Scan       Scan /workspace/target with appropriate shard_total.
           Promote top 50 candidates.
Detect     Review top 20 candidates. Promote or reject each.
Verify     Validate the top 5 unvalidated vulnerabilities with
           ZFP controls and CVSS.
Patch      Fix the 3 highest-severity validated findings.
Exploit    (optional) Weaponize any chain that reaches a crown jewel.
```

## Batch sizes (hard ceilings)

| Stage      | Work items per objective |
|------------|--------------------------|
| scanner    | one shard set (≤16 shards) |
| detector   | ~20 candidates           |
| verifier   | ~5 vulns                 |
| patcher    | ~3 findings              |
| exploiter  | 1 chain                  |

Large engagements = multiple objectives per stage. Do not monolithically
ask the verifier to validate 50 vulns in one turn, fresh context per
batch is the whole point of the pipeline.

## Delegation examples

```
task("scanner",
     "Scan /workspace/target/backend with shard_total=8. Promote the
      top 50 candidates by suspicion score and return a summary.")

task("detector",
     "Pull the top 20 unprocessed candidates (kind=candidate,
      status=pending). Promote or reject each. Return counts.")

The rest: https://github.com/BitterSecurity/Decepticon/blob/HEAD/packages/decepticon/decepticon/skills/plugins/vulnresearch/SKILL.md