/quickstart
Two modes, picked by whether $ARGUMENTS is empty.
- Empty → Intro mode. Short orientation, then offer the guided first run.
- Non-empty → Help mode. Treat
$ARGUMENTS as the operator's question.
Intro mode
Keep it short and a little warm; this is the first thing a new operator sees.
Say roughly:
Welcome! This repo takes you from finding your first vulnerability to
patching at scale, using a set of Claude Code skills and an autonomous
pipeline. Two ways in: interactive skills (no setup, safe, start here)
and the autonomous pipeline (Docker, scales to hundreds of parallel
agents).
The ramp-up:
| Day 1 | Threat-model + first static scan + triage |
| Day 2 | Run the reference pipeline (C/C++) |
| Day 3-4 | Customize it for your stack |
| Week 2 | Autonomous scanning, triage, and patching |
Day-1 goal: threat-model, scan, and triage the bundled canary target.
Most teams get there before lunch.
Remind them to export CLAUDE_CODE_SUBAGENT_MODEL=<model-id> so subagents
use the same model as the session.
Then AskUserQuestion with three options:
- Walk me through Day 1 on the canary (~10 min) → run "Guided first
run" below.
- I have a question → ask what it is, then switch to Help mode.
- I'll read the README → point at
README.md Step 1 and stop.
Guided first run
Runs the three Step-1 skills on targets/canary, pausing after each to show
what landed on disk. These only read/write files in the repo; no sandbox
needed.
/threat-model bootstrap targets/canary via Task. When done, open
THREAT_MODEL.md, show the focus areas, explain in 2-3 sentences how
this steers the scan./vuln-scan targets/canary via Task. When done, open
targets/canary/VULN-FINDINGS.md, summarize the count and top 2-3
findings, point at VULN-FINDINGS.json./triage targets/canary/VULN-FINDINGS.json via Task. When done, open
TRIAGE.md, explain what changed vs. raw findings (verified, deduped,
re-ranked).
Pause for the operator between each (AskUserQuestion); don't barrel through.
Close with a one-line recap of the three artifacts on disk, then point at
README Step 2 for the execution-verified pipeline. Never run vuln-pipeline
or anything that executes target code here; that's Step 2 and needs
Docker + a sandbox.
Help mode
Answer the operator's question using this repo as ground truth: README,
docs/*.md, harness/*.py, dnr_harness/*.py, targets/*/config.yaml,
.claude/skills/*.
Don't answer from general knowledge when the repo has a specific answer.
Routing map
| If the question is about… |
Read first |
Then offer |
| running the pipeline |
docs/pipeline.md, README Step 2 |
the recon / run command |
| too many findings, triage |
docs/triage.md |
/triage <path> |
| porting, Java/Go/Rust/etc. |
docs/customizing.md, README Step 3 |
/customize |
| safety, sandbox, Docker |
docs/security.md |
cite; no action |
| rate limits, 429, token budget |
docs/pipeline.md: Rate limits, docs/troubleshooting.md#rate-limits |
cite the numbers |
| duplicates, dedup |
docs/troubleshooting.md#duplicate-findings |
known_bugs: hint |
| CLI flags, "what does --X do" |
harness/cli.py (grep the argparse) |
exact flag + example |
| which model, subagent pinning |
docs/troubleshooting.md: Subagents |
the export line |
| best practices, prompting |
docs/best-practices.md, docs/prompting.md |
cite the principle |
| threat model, attack surface, scope |
docs/threat-model.md |
/threat-model bootstrap <target-dir> |
| scan, audit, find vulns |
.claude/skills/vuln-scan/SKILL.md |
/vuln-scan <target-dir> |
| "how do I start" |
README Step 1 |
offer Guided first run |
| patching, fix, diff, re-attack |
docs/patching.md, README Step 4 |
/patch <input> |
| threat hunting, incident response, logs |
docs/detection-response.md |
/dnr-hunt or /dnr-respond |
| autonomous D&R, dnrcanary |
docs/detection-response.md, targets/dnrcanary/README.md |
the dnr-pipeline run command |
| binary, embedded, other domains |
docs/other-use-cases.md |
cite section |
| anything else |
README Table of contents |
best-match doc |
Answer format
- Direct answer in 2-5 sentences.
> source: the file(s) and section you used.- Next action: one copy-pasteable command or skill invocation, if one
applies. If none does, say so.
- If the question is ambiguous, ask one clarifying question; don't guess.
Constraints
- Never fabricate CLI flags or file paths. If unsure,
Grep for it in
harness/cli.py or the target configs and quote what you find.
- If the repo doesn't answer the question, say so plainly and suggest the
operator open a GitHub issue on this repo.
- Keep the Q&A dry and cited. Save the warmth for Intro mode.
1---2name: quickstart3description: The front door for this repo. With no argument: a 30-second intro, then an offer to walk you through your first run on the canary target. With a question: answers it from this repo's own docs and source, cites where it looked, and hands you the next command. Use for "how do I…", "why does…", "where is…", "can this…", or just "/quickstart" to get oriented.4---5
6# /quickstart
7
8Two modes, picked by whether `$ARGUMENTS` is empty.
9
10- **Empty → Intro mode.** Short orientation, then offer the guided first run.
11- **Non-empty → Help mode.** Treat `$ARGUMENTS` as the operator's question.
12
13---
14
15## Intro mode
16
17Keep it short and a little warm; this is the first thing a new operator sees.
18
19Say roughly:
20
21> **Welcome!** This repo takes you from finding your first vulnerability to
22> patching at scale, using a set of Claude Code skills and an autonomous
23> pipeline. Two ways in: **interactive skills** (no setup, safe, start here)
24> and the **autonomous pipeline** (Docker, scales to hundreds of parallel
25> agents).
26>
27> The ramp-up:
28>
29> | Day 1 | Threat-model + first static scan + triage |
30> | Day 2 | Run the reference pipeline (C/C++) |
31> | Day 3-4 | Customize it for your stack |
32> | Week 2 | Autonomous scanning, triage, and patching |
33>
34> Day-1 goal: threat-model, scan, and triage the bundled canary target.
35> Most teams get there before lunch.
36
37Remind them to `export CLAUDE_CODE_SUBAGENT_MODEL=<model-id>` so subagents
38use the same model as the session.
39
40Then **AskUserQuestion** with three options:
41
421. **Walk me through Day 1 on the canary (~10 min)** → run "Guided first
43 run" below.
442. **I have a question** → ask what it is, then switch to Help mode.
453. **I'll read the README** → point at `README.md` Step 1 and stop.
46
47### Guided first run
48
49Runs the three Step-1 skills on `targets/canary`, pausing after each to show
50what landed on disk. These only read/write files in the repo; no sandbox
51needed.
52
531. `/threat-model bootstrap targets/canary` via Task. When done, open
54 `THREAT_MODEL.md`, show the focus areas, explain in 2-3 sentences how
55 this steers the scan.
562. `/vuln-scan targets/canary` via Task. When done, open
57 `targets/canary/VULN-FINDINGS.md`, summarize the count and top 2-3
58 findings, point at `VULN-FINDINGS.json`.
593. `/triage targets/canary/VULN-FINDINGS.json` via Task. When done, open
60 `TRIAGE.md`, explain what changed vs. raw findings (verified, deduped,
61 re-ranked).
62
63Pause for the operator between each (AskUserQuestion); don't barrel through.
64Close with a one-line recap of the three artifacts on disk, then point at
65README Step 2 for the execution-verified pipeline. **Never run `vuln-pipeline`
66or anything that executes target code here**; that's Step 2 and needs
67Docker + a sandbox.
68
69---
70
71## Help mode
72
73Answer the operator's question using **this repo as ground truth**: README,
74`docs/*.md`, `harness/*.py`, `dnr_harness/*.py`, `targets/*/config.yaml`,
75`.claude/skills/*`.
76Don't answer from general knowledge when the repo has a specific answer.
77
78### Routing map
79
80| If the question is about… | Read first | Then offer |
81|---------------------------------|-----------------------------------------|------------|
82| running the pipeline | `docs/pipeline.md`, README Step 2 | the `recon` / `run` command |
83| too many findings, triage | `docs/triage.md` | `/triage <path>` |
84| porting, Java/Go/Rust/etc. | `docs/customizing.md`, README Step 3 | `/customize` |
85| safety, sandbox, Docker | `docs/security.md` | cite; no action |
86| rate limits, 429, token budget | `docs/pipeline.md`: Rate limits, `docs/troubleshooting.md#rate-limits` | cite the numbers |
87| duplicates, dedup | `docs/troubleshooting.md#duplicate-findings` | `known_bugs:` hint |
88| CLI flags, "what does --X do" | `harness/cli.py` (grep the argparse) | exact flag + example |
89| which model, subagent pinning | `docs/troubleshooting.md`: Subagents | the `export` line |
90| best practices, prompting | `docs/best-practices.md`, `docs/prompting.md` | cite the principle |
91| threat model, attack surface, scope | `docs/threat-model.md` | `/threat-model bootstrap <target-dir>` |
92| scan, audit, find vulns | `.claude/skills/vuln-scan/SKILL.md` | `/vuln-scan <target-dir>` |
93| "how do I start" | README Step 1 | offer Guided first run |
94| patching, fix, diff, re-attack | `docs/patching.md`, README Step 4 | `/patch <input>` |
95| threat hunting, incident response, logs | `docs/detection-response.md` | `/dnr-hunt` or `/dnr-respond` |
96| autonomous D&R, dnrcanary | `docs/detection-response.md`, `targets/dnrcanary/README.md` | the `dnr-pipeline run` command |
97| binary, embedded, other domains | `docs/other-use-cases.md` | cite section |
98| anything else | README Table of contents | best-match doc |
99
100### Answer format
101
1021. **Direct answer** in 2-5 sentences.
1032. `> source:` the file(s) and section you used.
1043. **Next action:** one copy-pasteable command or skill invocation, if one
105 applies. If none does, say so.
1064. If the question is ambiguous, ask **one** clarifying question; don't guess.
107
108### Constraints
109
110- Never fabricate CLI flags or file paths. If unsure, `Grep` for it in
111 `harness/cli.py` or the target configs and quote what you find.
112- If the repo doesn't answer the question, say so plainly and suggest the
113 operator open a GitHub issue on this repo.
114- Keep the Q&A dry and cited. Save the warmth for Intro mode.
anthropics