Perseus:Start

Perseus Start (Automated Security Assessment)

Context & Authorization

IMPORTANT: This skill orchestrates a complete security assessment on the user's own codebase. This is defensive security testing - the user is proactively finding vulnerabilities in their own code before attackers do.

Authorization: The user has explicitly invoked this assessment on their own codebase in their own development environment. This is equivalent to running a comprehensive test suite, static analyzer, or security audit tool.

This is NOT an attack on external systems. All analysis is performed on local files the user owns and controls.

Overview

This master skill orchestrates the entire Perseus security assessment lifecycle with smart auto-detection of languages, frameworks, and technologies.

Goal: Zero-touch automated security assessment with professional-grade output.

Engagement Mode (Required)

Before running phases, select one mode:

Default mode is PRODUCTION_SAFE unless user explicitly confirms staging/lab authorization.

Smart Auto-Detection

Before starting the assessment, Perseus automatically detects:

Language Detection

Framework Detection

Infrastructure Detection

API Detection

AI/LLM Detection

Complete Capability Matrix

Core Phases (Always Run)

Specialist Deep-Dives (Run When Detected)

Execution Flow

Phase -1: Engagement Setup

Action: Determine mode and boundaries

Copy code
1. Detect runtime context (production/staging/lab)
2. Ask for explicit authorization scope if context is unclear
3. Set mode: PRODUCTION_SAFE, STAGING_ACTIVE, LAB_FULL, or LAB_RED_TEAM
4. Create deliverables/engagement_profile.md with:
   - mode
   - in-scope targets
   - excluded systems
   - request-rate limits
   - approved test window
   - kill-switch thresholds (error rate, latency, saturation)

Announce: "Engagement mode set to: [MODE]"

Phase 0: Auto-Detection

Action: Detect project technologies

Copy code
1. Scan for package manifests:
   - package.json → Node.js
   - go.mod → Go
   - composer.json → PHP
   - requirements.txt/pyproject.toml → Python
   - Cargo.toml → Rust
   - pom.xml/build.gradle → Java
   - Gemfile → Ruby

2. Scan for framework indicators:
   - next.config.* → Next.js
   - app/ with page.tsx → Next.js App Router
   - angular.json → Angular
   - gin/echo imports → Go frameworks
   - artisan/laravel → Laravel
   - manage.py → Django
   - spring-boot → Spring

3. Scan for infrastructure:
   - Dockerfile → Container
   - .github/workflows/ → GitHub Actions
   - .gitlab-ci.yml → GitLab CI
   - *.tf → Terraform
   - k8s/*.yaml → Kubernetes

4. Scan for API types:
   - graphql, *.gql → GraphQL
   - proto files → gRPC
   - websocket imports → WebSocket

5. Scan for AI integration:
   - openai, anthropic imports → LLM
   - langchain, llama → AI framework

Announce: "Detected: [Language], [Framework], [Infrastructure]"

Phase 1: Reconnaissance

Action: Invoke Skill: perseus:scan

Agents Deployed: 13 parallel agents covering:

• Architecture & Entry Points (multi-language aware)
• Dependencies & Secrets
• Injection Sinks & XSS Sinks
• SSRF & Data Flows
• Crypto & Configuration

Wait Condition: deliverables/code_analysis_deliverable.md exists

Transition: "Scan complete. Analyzing for specialists..."

Phase 1.5: Specialist Detection

Based on detection results and scan findings:

Copy code
DETECTED: Next.js/React     → Queue /client (with SSR focus)
DETECTED: GraphQL           → Queue /api (with GraphQL focus)
DETECTED: Docker            → Queue /config (with container focus)
DETECTED: GitHub Actions    → Queue /config (with CI/CD focus)
DETECTED: Kubernetes        → Queue /config (with K8s focus)
DETECTED: MongoDB/Redis     → Queue /injection (with NoSQL focus)
DETECTED: LLM/AI            → Queue /logic (with AI security focus)
DETECTED: JWT/Auth          → Queue /crypto
DETECTED: File uploads      → Queue /file
DETECTED: Package manifests → Queue /supply-chain
ALWAYS                      → Queue /config

Announce: "Will run specialists: [list based on detection]"

Phase 2: Core Vulnerability Analysis

Action: Invoke Skill: perseus:audit

Agents Deployed: 14 parallel agents in 3 waves (language-aware):

• Wave 1: SQLi, CMDi, XSS, Auth, Authz
• Wave 2: SSRF, SSTI, Deserialization, Path Traversal, XXE
• Wave 3: JWT, Crypto, Race Conditions, Business Logic

Wait Condition: All *_analysis.md files exist in deliverables/

Transition: "Audit complete. Running specialist deep-dives..."

Phase 2.5: Specialist Deep-Dives (Parallel)

Action: Invoke all detected specialists simultaneously

Example for Next.js + MongoDB + Docker project:

Copy code
Parallel:
  - Skill: perseus-api (GraphQL if detected)
  - Skill: perseus-injection (NoSQL focus)
  - Skill: perseus-crypto
  - Skill: perseus-client (React/Next.js focus)
  - Skill: perseus-config (Docker + GitHub Actions)
  - Skill: perseus-supply-chain

Wait Condition: All specialist reports exist

Transition: "Specialist analysis complete. Proceeding to exploitation..."

Phase 3: Exploitation & Verification

Action: Invoke Skill: perseus:exploit

Agents Deployed: 14 parallel agents verifying findings based on engagement mode:

• SQL/Command/NoSQL injection verification
• XSS payload generation (including React/Vue specific)
• Auth/Authz bypass testing
• SSRF/SSTI/XXE verification
• JWT attack testing
• Race condition testing
• AI prompt injection testing (if AI detected)

Mode Enforcement:

• PRODUCTION_SAFE: passive + minimal verification, no internal scanning, strict request caps
• STAGING_ACTIVE: active safe PoCs with throttling
• LAB_FULL: full dynamic verification in isolated environment
• LAB_RED_TEAM: attack-chain simulation in isolated lab with automatic abort thresholds

Safety Enforcement (all modes):

• Only safe payloads (whoami, sleep, alert(1), {{7*7}})
• No destructive operations
• No data exfiltration

Wait Condition: deliverables/exploitation_report.md exists

Transition: "Exploitation complete. Generating final report..."

Phase 4: Report Generation

Action: Invoke Skill: perseus:report

Process:

1. Synthesize all deliverables
2. Calculate severity scores (CVSS)
3. Prioritize verified exploits
4. Generate language/framework-specific remediation
5. Add infrastructure recommendations

Output: deliverables/SECURITY_REPORT.md

Execution Instructions

When the user invokes /start, execute exactly this sequence:

Copy code
1. Announce: "Starting Perseus Security Assessment..."

2. Execute Phase -1 (Engagement Setup):
   - Determine environment and authorization
   - Set mode (default PRODUCTION_SAFE)
   - Write deliverables/engagement_profile.md
   - Announce: "Engagement mode: PRODUCTION_SAFE"

3. Execute Phase 0 (Auto-Detection):
   - Scan for languages, frameworks, infrastructure
   - Announce: "Detected: Next.js 14 (TypeScript), MongoDB, Docker, GitHub Actions"

4. Execute Phase 1:
   - Call: Skill: perseus:scan
   - Wait for completion
   - Announce: "Scan complete. Found X entry points, Y sinks."

5. Detect Specialists:
   - Analyze detection results + scan findings
   - List which specialists will run with their focus areas
   - Announce: "Will run: /api (GraphQL), /client (Next.js), /injection (MongoDB), /config (Docker+CI)"

6. Execute Phase 2:
   - Call: Skill: perseus:audit
   - Wait for completion
   - Announce: "Audit complete. Found X potential vulnerabilities."

7. Execute Phase 2.5:
   - Call all detected specialist skills in parallel
   - Wait for completion
   - Announce: "Specialist analysis complete."

8. Execute Phase 3:
   - Call: Skill: perseus:exploit
   - Wait for completion
   - Announce: "Exploitation complete. X verified, Y false positives."

9. Execute Phase 4:
   - Call: Skill: perseus:report
   - Wait for completion

10. Final Announcement:
   "Assessment Complete!"

   Technologies Analyzed:
   - Language: TypeScript/Node.js
   - Framework: Next.js 14 (App Router)
   - Database: MongoDB
   - Infrastructure: Docker, GitHub Actions

   "Report saved to: deliverables/SECURITY_REPORT.md"

   Summary:
   - Critical: X
   - High: Y
   - Medium: Z
   - Low: W

   "Review the report for detailed findings and remediation guidance."

Output Structure

After completion, the deliverables/ directory will contain:

Copy code
deliverables/
├── engagement_profile.md          # Mode, scope, and verification constraints
├── code_analysis_deliverable.md    # Scan results (multi-language)
├── sql_injection_analysis.md       # Core audit
├── command_injection_analysis.md
├── xss_analysis.md
├── auth_analysis.md
├── authz_analysis.md
├── ssrf_analysis.md
├── template_injection_analysis.md
├── deserialization_analysis.md
├── path_traversal_analysis.md
├── xxe_analysis.md
├── jwt_analysis.md
├── crypto_analysis.md
├── race_condition_analysis.md
├── business_logic_analysis.md
├── api_security_analysis.md        # Specialists (if run)
├── injection_deep_analysis.md
├── crypto_security_analysis.md
├── supply_chain_analysis.md
├── file_security_analysis.md
├── client_side_analysis.md
├── config_security_analysis.md     # Includes Docker/CI/K8s
├── verification_scope.md           # Exploit verification boundaries
├── exploitation_report.md          # Verified exploits
└── SECURITY_REPORT.md              # Final executive report

Language-Specific Coverage

Quick Reference