# Performing AI Assisted Vulnerability Discovery

Using LLMs to accelerate vulnerability research and pentest workflows, generating...

- Repository: https://github.com/xalgorix/xalgorix (1285 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add xalgorix/xalgorix --skill performing-ai-assisted-vulnerability-discovery -g -a claude-code -y`
Codex: `npx skills add xalgorix/xalgorix --skill performing-ai-assisted-vulnerability-discovery -g -a codex -y`
Cursor: `npx skills add xalgorix/xalgorix --skill performing-ai-assisted-vulnerability-discovery -g -a cursor -y`
Gemini CLI: `npx skills add xalgorix/xalgorix --skill performing-ai-assisted-vulnerability-discovery -g -a gemini-cli -y`

## Description

Using LLMs to accelerate vulnerability research and pentest workflows, generating syntax-valid fuzzing seeds and evolving grammars, fine-tuned mutation dictionaries, parallel agent-based proof-of-vulnerability generation, and evidence-driven passive analysis of real HTTP traffic via the Burp MCP server. Covers concrete prompts, AFL++/ libFuzzer wiring, and Burp+Codex/Gemini/Ollama MCP setup.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Performing AI-Assisted Vulnerability Discovery

## When to Use

- During authorized vulnerability research where complex input formats (SQL, URLs, custom/binary protocols) stall a blind fuzzer
- When bootstrapping a coverage-guided fuzzer (AFL++, libFuzzer, Honggfuzz) that needs syntax-valid, security-relevant seeds
- When you have crash candidates and need to scale proof-of-vulnerability (PoV) generation across many agents/models
- When triaging large volumes of real Burp HTTP traffic and want evidence-driven passive analysis + report drafting
- When working under cost/time budgets (bug-bounty, CTF, AIxCC-style cyber reasoning systems)

## Critical: Techniques Most Often Missed

Teams either ignore LLMs entirely or paste code and hope. The high-value patterns are about
**feeding the model coverage feedback** and **keeping the human/Burp as the source of truth**.

### 1. LLM seed generation for semantic validity (deeper coverage early)

```prompt
SYSTEM: You are a helpful security engineer.
USER: Write a Python3 program that prints 200 unique SQL injection strings targeting common
anti-pattern mistakes (missing quotes, numeric context, stacked queries). Ensure length <= 256
bytes/string so they survive common length limits.
```
```bash
python3 gen_sqli_seeds.py > seeds.txt
afl-fuzz -i seeds.txt -o findings/ -- ./target @@
```
Ask for a single self-contained script and tell it to diversify encoding (UTF-8, URL-encoded, UTF-16-LE).

### 2. Coverage-feedback grammar evolution ("Grammar Guy")

```prompt
The previous grammar triggered 12 % of the program edges. Functions not reached: parse_auth,
handle_upload. Add / modify rules to cover these.
```
```python
for epoch in range(MAX_EPOCHS):
    grammar = llm.refine(grammar, feedback=coverage_stats)   # use diff+patch, not full rewrite
    save(grammar, f"grammar_{epoch}.txt")
    coverage_stats = run_fuzzer(grammar)                     # stop when Δcoverage < ε
```

The rest: https://github.com/xalgorix/xalgorix/blob/HEAD/internal/tools/skills/data/ai-security/performing-ai-assisted-vulnerability-discovery/SKILL.md