security-tooling

Detect drift. Defend cloud.

Agent skills for OpenClaw and MCP clients: pay and charge in USDC via x402, Agent Passport identity, context compression, and the Liquefy vault flight recorder.

AI-powered multi-chain Web3 security toolkit. Scan smart contracts across 6 EVM chains in minutes, not weeks.

Interactive React/Vite portfolio for Tasfiya Tabassum — useful experiments, security tooling, systems work, and the modern web.

Hand requests from Burp Suite to any AI agent on your machine — select in Proxy history, agent reads a shared file inbox. No MCP, no daemon, no network.

Browser-based UI for editing, validating, and managing Sysmon XML configs — Flask + vanilla JS, multi-schema support.

Native DeepSeek Harness workbench for evidence-first vulnerability research, reproduction, and reporting.

Web interface for the Bumblebee supply-chain scanner. Runs locally with Docker Compose, inventories the dependencies under a directory you mount, and reports matches against pinned upstream exposure catalogues. Unofficial project, not affiliated with Perplexity.

Security Notes/Tools/Scripts

A taxonomy of silent-success failures in security tooling — tools that report success while doing nothing — with reproducible demonstrations against real tools and a guard that catches each class.

Client-side AWS IAM policy blast-radius analyzer (fail-closed): web tool, CLI with SARIF output, and a GitHub Action on the Marketplace.

Static analysis for AI agent codebases: agentic vulnerability patterns + quantum-readiness/PKI gaps, in one scan.

A research instrument working toward one map of detection knowledge — the major rule libraries, where they intersect and where they don't, resolved against MITRE ATT&CK.

Offline Ed25519 verifier for Aiyo execution receipts. Published as @aiyoplane/verify on npm. Companion to aiyoplane/verify-python.

Local-first context-integrity engine. Reconstructs trust from immutable runtime history, contains risky actions in QTF, and gates promotion through EXT.

Automated reconnaissance and attack-surface analysis pipeline for infrastructure visibility, asset discovery, and vulnerability identification.

Resolves messy installed-software names from a machine audit to canonical product identifiers so an inventory can be matched against CVE data. Deterministic similarity first, LLM adjudication only for ambiguous names, constrained to a shortlist, with a content-hash cache.

A comprehensive collection of regex patterns and verification functions for detecting and validating PII and sensitive data across multiple global regions and languages.

Deterministic, local-first context builder for flow automation exports: redacts sensitive data, detects risks, and produces auditable bundles for AI assistants and support workflows: flow analysis, subflow expansion, secret redaction, token budgeting, and reproducible bundle generation via CLI and VUE web app.

Defense shield for the Agent2Agent (A2A) protocol: SSRF-guarded push webhooks, per-operation capability tokens, signed Agent Card verification and covert-collusion detection. AGPL-3.0.