# Untitled graph

View this di3 canvas

- **Canvas:** https://forefy.com/canvas/89561a02-c0e4-4934-b201-eab30665867b
- **Graph (JSON):** https://forefy.com/api/di3/public/canvases/89561a02-c0e4-4934-b201-eab30665867b
- **Install the chain:** `curl -fsSL https://forefy.com/api/di3/canvases/89561a02-c0e4-4934-b201-eab30665867b/install | bash`
  (PowerShell: `irm "https://forefy.com/api/di3/canvases/89561a02-c0e4-4934-b201-eab30665867b/install?shell=powershell" | iex`; add `location=project` to install into the current project, `harness=agents` for `.agents/`)

## Chain

Run these registry items in this order; it follows the canvas's arrows. Items in the same step don't depend on each other.

1. Together:
   - **audit-scope** (skill) - https://forefy.com/skills/051b9918-2909-4d4b-b289-0312c03549d1: Draft a security-audit scope from GitHub repos or API access, with a protocol narrative and a sizing table. Use when scoping a new engagement.
   - **pre-bounty** (skill) - https://forefy.com/skills/18c3e623-cf91-4992-a51c-d83815c1147c: Map a bug-bounty scope and rank targets by payout, crowding, and freshness. Use to size up a program or decide where to hunt before committing time.
2. **tiny-auditor** (skill) - https://forefy.com/skills/1c0ebab8-209a-4b29-a92d-840a8da68a5d: Audit codebase to uncover critical issues explicitly without false positives
3. Together:
   - **burp-interaction** (skill) - https://forefy.com/skills/4b232fe0-83e2-4edc-9054-c3956a758f52: Interacting with BurpSuite over the reburp extension that exposes the full Montoya API as a local REST API. Use when driving Burp programmatically - reading proxy history, sending HTTP requests throug...
   - **nuclei-suggest** (skill) - https://forefy.com/skills/87b50395-f6aa-4dde-8a00-560de2f59c87: Browse the nuclei-templates library, recommend a scoped template set for a given stack, target, or CVE, then run it against an authorized target and report findings.
4. **bug-bounty-triage** (skill) - https://forefy.com/skills/b7a1cfae-3fbb-40c6-8a74-053bb6844472: Bug bounty report triage, validation, and severity escalation. Use when the user provides a bug bounty report to validate, wants to check if a finding is submittable, needs to escalate severity for ma...
5. Together:
   - **archify** (skill) - https://forefy.com/skills/5862895c-8516-4bb0-b055-09be35c21cb5: Create polished, validated architecture, workflow, sequence, data-flow, and lifecycle/state diagrams as explorable standalone HTML with inline SVG, dark/light themes, optional trace motion, and PNG/JP...
   - **no-aispeak** (skill) - https://forefy.com/skills/5d72b0de-53c5-4382-90ed-a356b4be9df9: Generate textual content as the user will normally write without the disliked common AI way of writing
6. **evidence-video** (skill) - https://forefy.com/skills/c90dee70-c5c8-44df-8b07-3aa8f5029ace: Turn a user story or a bug reproduction into a short, evidence-backed walkthrough video where every scene is a real capture, hash-chained so nothing can be faked, and the ending discusses insight, imp...

## Diagram

- audit-scope -> tiny-auditor: Start auditing code
- pre-bounty -> tiny-auditor
- tiny-auditor -> burp-interaction: Use full burp interaction for reality checks and reproducibles
- Audit codebase for critical vulnerabilities -> audit-scope: Preliminary collection
- Audit codebase for critical vulnerabilities -> pre-bounty
- tiny-auditor -> nuclei-suggest: Suggest PASSIVE existing or build new nuclei templates for applicative scan
- burp-interaction -> Report Draft
- nuclei-suggest -> Report Draft: Exploitable issues vulnerability reports
- Report Draft -> bug-bounty-triage: Triage actual important issues only
- bug-bounty-triage -> archify: Draw attacker story diagrams
- bug-bounty-triage -> no-aispeak: Make report concise and with no AI signs
- archify -> Wait until all done
- no-aispeak -> Wait until all done
- Wait until all done -> evidence-video: Create PoC videos per each critical validated issue, use report and architectural attacker flows
- burp-interaction -> github.com/forefy/reburp: fetches
- nuclei-suggest -> github.com/projectdiscovery/nuclei: fetches