quickstart

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

/quickstart

Two modes, picked by whether

$ARGUMENTS

is empty.

Empty → Intro mode. Short orientation, then offer the guided first run.
Non-empty → Help mode. Treat
```
$ARGUMENTS
```
as the operator's question.

分为两种模式，根据

$ARGUMENTS

是否为空来选择。

空参数 → 介绍模式：简短的入门引导，然后提供首次运行的指导。
非空参数 → 帮助模式：将
```
$ARGUMENTS
```
视为操作者的问题。

Intro mode

介绍模式

Keep it short and a little warm; this is the first thing a new operator sees.

Say roughly:

Welcome! This repo takes you from finding your first vulnerability to patching at scale, using a set of Claude Code skills and an autonomous pipeline. Two ways in: interactive skills (no setup, safe, start here) and the autonomous pipeline (Docker, scales to hundreds of parallel agents).

The ramp-up:

| Day 1 | Threat-model + first static scan + triage | | Day 2 | Run the reference pipeline (C/C++) | | Day 3-4 | Customize it for your stack | | Week 2 | Autonomous scanning, triage, and patching |

Day-1 goal: threat-model, scan, and triage the bundled canary target. Most teams get there before lunch.

Remind them to

export CLAUDE_CODE_SUBAGENT_MODEL=<model-id>

so subagents use the same model as the session.

Then AskUserQuestion with three options:

Walk me through Day 1 on the canary (~10 min) → run "Guided first run" below.
I have a question → ask what it is, then switch to Help mode.
I'll read the README → point at
```
README.md
```
Step 1 and stop.

内容要简短且亲切，这是新操作者看到的第一部分内容。

大致表述如下：

欢迎！ 本仓库借助一系列Claude Code技能和自动化流水线，带你从发现首个漏洞到大规模修复漏洞。有两种使用方式：交互式技能（无需配置，安全可靠，从此处开始）和自动化流水线（基于Docker，可扩展至数百个并行agents）。

学习进度安排：

| 第1天 | 威胁建模 + 首次静态扫描 + 分类筛选 | | 第2天 | 运行参考流水线（C/C++） | | 第3-4天 | 针对你的技术栈进行定制 | | 第2周 | 自动化扫描、分类筛选和漏洞修复 |

第1天的目标：对内置的canary目标进行威胁建模、扫描和分类筛选。大多数团队在午餐前就能完成。

提醒用户设置

export CLAUDE_CODE_SUBAGENT_MODEL=<model-id>

，这样子agents将使用与当前会话相同的模型。

然后通过AskUserQuestion提供三个选项：

引导我完成canary目标的第1天流程（约10分钟） → 运行下方的“首次运行引导”。
我有问题 → 询问具体问题，然后切换到帮助模式。
我要阅读README → 指向
```
README.md
```
的步骤1并结束。

Guided first run

首次运行引导

Runs the three Step-1 skills on

targets/canary

, pausing after each to show what landed on disk. These only read/write files in the repo; no sandbox needed.

```
/threat-model bootstrap targets/canary
```
via Task. When done, open
```
THREAT_MODEL.md
```
, show the focus areas, explain in 2-3 sentences how this steers the scan.
```
/vuln-scan targets/canary
```
via Task. When done, open
```
targets/canary/VULN-FINDINGS.md
```
, summarize the count and top 2-3 findings, point at
```
VULN-FINDINGS.json
```
.
```
/triage targets/canary/VULN-FINDINGS.json
```
via Task. When done, open
```
TRIAGE.md
```
, explain what changed vs. raw findings (verified, deduped, re-ranked).

Pause for the operator between each (AskUserQuestion); don't barrel through. Close with a one-line recap of the three artifacts on disk, then point at README Step 2 for the execution-verified pipeline. Never run
vuln-pipeline
or anything that executes target code here; that's Step 2 and needs Docker + a sandbox.

在

targets/canary

上运行三个步骤1的技能，每个步骤完成后暂停，展示磁盘上生成的文件。这些操作仅读写仓库内的文件；无需沙箱。

通过Task运行
```
/threat-model bootstrap targets/canary
```
。完成后，打开
```
THREAT_MODEL.md
```
，展示重点关注区域，用2-3句话解释这如何指导扫描工作。
通过Task运行
```
/vuln-scan targets/canary
```
。完成后，打开
```
targets/canary/VULN-FINDINGS.md
```
，总结发现的漏洞数量和前2-3个主要漏洞，指向
```
VULN-FINDINGS.json
```
。
通过Task运行
```
/triage targets/canary/VULN-FINDINGS.json
```
。完成后，打开
```
TRIAGE.md
```
，解释与原始漏洞发现相比有哪些变化（已验证、去重、重新排序）。

每个步骤之间要等待操作者的确认（通过AskUserQuestion）；不要连续执行。最后用一句话总结磁盘上生成的三个工件，然后指向README的步骤2以了解经过执行验证的流水线。此处绝对不要运行
vuln-pipeline
或任何执行目标代码的操作；那属于步骤2，需要Docker和沙箱。

Help mode

帮助模式

Answer the operator's question using this repo as ground truth: README,

docs/*.md

harness/*.py

targets/*/config.yaml

.claude/skills/*

. Don't answer from general knowledge when the repo has a specific answer.

以本仓库内容为依据回答操作者的问题：包括README、

docs/*.md

、

harness/*.py

、

targets/*/config.yaml

、

.claude/skills/*

。当仓库中有具体答案时，不要用通用知识回答。

Routing map

路由映射

If the question is about…	Read first	Then offer
running the pipeline	`docs/pipeline.md` , README Step 2	the `recon` / `run` command
too many findings, triage	`docs/triage.md`	`/triage <path>`
porting, Java/Go/Rust/etc.	`docs/customizing.md` , README Step 3	`/customize`
safety, sandbox, Docker	`docs/security.md`	cite; no action
rate limits, 429, token budget	`docs/pipeline.md` : Rate limits, `docs/troubleshooting.md#rate-limits`	cite the numbers
duplicates, dedup	`docs/troubleshooting.md#duplicate-findings`	`known_bugs:` hint
CLI flags, "what does --X do"	`harness/cli.py` (grep the argparse)	exact flag + example
which model, subagent pinning	`docs/troubleshooting.md` : Subagents	the `export` line
best practices, prompting	`docs/best-practices.md` , `docs/prompting.md`	cite the principle
"how do I start"	README Step 1	offer Guided first run
patching, fix, diff, re-attack	`docs/patching.md` , README Step 4	`/patch <input>`
binary, pentest, other domains	`docs/other-use-cases.md`	cite section
anything else	README Table of contents	best-match doc

如果问题关于…	优先查阅	然后提供
运行流水线	`docs/pipeline.md` 、README步骤2	`recon` / `run` 命令
漏洞发现过多、分类筛选	`docs/triage.md`	`/triage <path>`
移植、Java/Go/Rust等语言支持	`docs/customizing.md` 、README步骤3	`/customize`
安全性、沙箱、Docker	`docs/security.md`	引用相关内容；无需操作
速率限制、429错误、令牌配额	`docs/pipeline.md` 中的速率限制部分、 `docs/troubleshooting.md#rate-limits`	引用具体数值
重复漏洞、去重	`docs/troubleshooting.md#duplicate-findings`	提示 `known_bugs:` 相关内容
CLI参数、“--X有什么用”	`harness/cli.py` （使用grep查找argparse相关内容）	精确的参数说明 + 示例
模型选择、子agent固定	`docs/troubleshooting.md` 中的Subagents部分	对应的 `export` 命令行
最佳实践、提示词设计	`docs/best-practices.md` 、 `docs/prompting.md`	引用相关原则
“如何开始”	README步骤1	提供首次运行引导
漏洞修复、补丁、差异对比、复现攻击	`docs/patching.md` 、README步骤4	`/patch <input>`
二进制文件、渗透测试、其他领域	`docs/other-use-cases.md`	引用相关章节
其他问题	README目录	最匹配的文档

Answer format

回答格式

Direct answer in 2-5 sentences.
```
> source:
```
the file(s) and section you used.
Next action: one copy-pasteable command or skill invocation, if one applies. If none does, say so.
If the question is ambiguous, ask one clarifying question; don't guess.

直接回答：2-5句话。
```
> source:
```
你参考的文件和章节。
下一步操作：如果适用，提供一个可直接复制粘贴的命令或技能调用。如果不适用，说明情况。
如果问题模糊，提出一个澄清问题；不要猜测。

Constraints

约束条件

Never fabricate CLI flags or file paths. If unsure,
```
Grep
```
for it in
```
harness/cli.py
```
or the target configs and quote what you find.
If the repo doesn't answer the question, say so plainly and suggest the operator open a GitHub issue on this repo.
Keep the Q&A dry and cited. Save the warmth for Intro mode.

绝对不要编造CLI参数或文件路径。如果不确定，在
```
harness/cli.py
```
或目标配置文件中使用
```
Grep
```
查找，并引用找到的内容。
如果仓库中没有问题的答案，直接说明，并建议操作者在本仓库的GitHub上提交issue。
问答过程要简洁并注明来源。亲切的语气仅用于介绍模式。