v4.6.0 — clown & mail code skill

Highlights

• Clown skill
• Mailcode skill

v4.3.1 - Domain-Scoped Artifact Layout

This patch release standardizes all hunt artifacts under a normalized target-domain directory.

Highlights:

• Stores every process file and result under output/{domain}/.
• Classifies artifacts into recon, assets, analysis, evidence, reports, and runtime.
• Normalizes target URLs so schemes, ports, paths, and query strings cannot create inconsistent directories.
• Adds a machine-readable artifact manifest and path traversal protection.
• Aligns task declarations, typed adapters, phase gates, linkage persistence, Skill instructions, and knowledge references.
• Adds artifact-layout and architecture-consistency tests.

Verification: 51 tests passed. GitHub provides the complete source code as ZIP and tar.gz archives for this tag.

v4.3.0 - Four-Phase Durable Queue Infrastructure

v4.3.0 - Four-Phase Durable Queue Infrastructure

This small release hardens the four-phase bug bounty workflow with durable execution infrastructure and consistency safeguards.

Highlights

• Cleaned legacy six/seven-phase knowledge references and added architecture consistency tests.
• Refactored workflow/tasks.py into thin task declarations backed by typed deterministic tool adapters.
• Added SQLite-backed persistence for hunt snapshots, events, and queue jobs.
• Added a durable async queue with backpressure, deduplication, leases, retries, and idempotent completion.
• Improved CLI status, statistics, history, resume visibility, and --version output.
• Introduced a single VERSION source and Release version sync checks.

Validation

• python -m pytest passes: 39 tests.
• Version sync check passes for v4.3.0-four-phase-durable-queue.

v4.2.0 - Impact-Gated SRC Findings

Impact-Gated SRC Findings

This release makes demonstrated security impact a mandatory boundary between reconnaissance leads and reportable SRC findings.

Highlights

• Adds a dedicated SRC reportability policy before severity scoring and triage.
• Suppresses CORS findings, client-side map API keys, non-exploitable information disclosure, and bare internal architecture metadata.
• Treats hardcoded API tokens and API keys as leads that must be mapped to their owning APIs, authentication placement, endpoints, and parameters.
• Requires API credentials to prove sensitive data access or a sensitive operation before they can become findings.
• Treats internal IP/domain, Swagger/OpenAPI, Druid, routing, and monitoring paths as lead-only signals.
• Requires a successful in-scope bypass plus a sensitive outcome before exposed paths can enter verification.
• Adds a Phase 2 lead-validation artifact, _validated_candidates.json, between raw candidates and the Verifier.
• Requires structured credential_validation or exposure_validation evidence for these lead classes.
• Drops unsuccessful leads from user-visible reports instead of assigning them inflated severity.
• Updates Analyst, Autonomous Attacker, Vulnerability Class, Report, workflow, and rating guidance to continue exploitation research without reporting unproven exposure.

Validation

• 27 automated tests passed.
• Python compilation checks passed.
• Source archives contain the complete main branch source at commit c1d38ba.

v4.1.0 - Verified Four-Phase Execution Pipeline

Verified Four-Phase Execution Pipeline

This release turns the four-phase architecture from a prompt-level design into an enforceable execution pipeline.

Highlights

• Adds a structured Phase 1 attack-surface contract with ranked hypotheses, evidence, confidence, impact, exploitability, normalized priority scores, planned tests, and chain links.
• Replaces premature report generation in Phase 2 with a candidate-finding workflow.
• Connects the Verifier directly to the runtime pipeline and only promotes findings with reproducible evidence, demonstrated impact, valid reproduction steps, and sufficient confidence.
• Restricts Phase 3 reports to Verifier-approved findings through _verified_findings.json.
• Expands Phase 0 deterministic reconnaissance coverage for DNS and subdomains, Swagger/OpenAPI and common exposure paths, and JavaScript sourcemaps.
• Adds dedicated progressive-disclosure instruction layers for the Analyst and Autonomous Attacker agents.
• Normalizes priority scoring to a 0-1 range and removes confidence threshold gaps.
• Removes obsolete phase terminology from active third-layer resources while preserving backward-compatible state names.
• Adds four-phase pipeline, artifact-contract, and verifier regression tests.

Validation

• 24 automated tests passed.
• Python compilation checks passed.
• Source archives contain the complete main branch source at commit d202fe9.

v4.0.0 Four-Phase Autonomous Pipeline Source Release

This release captures the current main branch source code for Mastermind Bug Bounty v4.0.0, the four-phase autonomous pipeline version.

What Changed

This version replaces the previous six-phase v3.1 FUSED flow with a cleaner four-phase architecture that gives the AI more autonomy while keeping deterministic execution, validation, and reporting boundaries explicit.

Four-Phase Pipeline

1. Phase 0 | Asset Recon
   The AI receives one goal: map all externally exposed assets. Python handles deterministic collection such as JS and sourcemap downloads, endpoint extraction, Swagger/OpenAPI exposure probing, and common-path checks.

2. Phase 1 | Attack Surface Analysis
   The AI ranks attack surfaces without active testing. Each hypothesis includes confidence, impact, exploitability, and priority_score so the next phase has a clear queue.

3. Phase 2 | Autonomous Attack
   The AI tests by priority and decides when to continue, switch direction, or stop. Confidence below 0.4 triggers a direction change, 0.4-0.7 means collect more evidence, and above 0.8 moves into verification and exploitation.

4. Phase 3 | Report Generation
   Reporting is intentionally rigid: only verifier-confirmed findings are included, with reproducible evidence and no speculative impact.

Knowledge Loading

The skill system now uses progressive disclosure:

• Metadata layer: skill names and one-line descriptions at startup.
• Instruction layer: goal, tools, constraints, and chain-first questions after a skill match.
• Resource layer: payloads, exploit details, and references loaded on demand through references/INDEX.md.

Key Traits

• Finding a vulnerability is treated as the start of deeper chaining, not the endpoint.
• Skills are concise routing instructions instead of fixed step-by-step exploit scripts.
• Large knowledge modules stay in the resource layer to avoid context overload.
• The opencode slash command is now a thin four-phase launcher that defers to the installed skill instructions.

Release Contents

• Tag: v4.0.0-four-phase
• Target branch: main
• Target commit: 95f5c223fe92fd1d5d7e8c78cc16838cfa3a6e60
• GitHub automatically provides the full source archives as Source code (zip) and Source code (tar.gz).

v3.1 FUSED - Six-Phase Pipeline + Seven-Hook Lifecycle Source Release

This is the complete source-code release for the main branch, corresponding to Mastermind Bug Bounty v3.1 FUSED.

This version uses a six-phase pipeline + seven lifecycle hooks architecture to organize AI agents into a bug bounty workflow with persistent state, risk gates, evidence validation, and resumable handoff.

Six-Phase Pipeline

1. Phase 0 | RECON
   Performs technology fingerprinting, WAF detection, source-code leak search, passive intelligence gathering, and baseline attack-surface mapping.

2. Phase 1 | DEPENDENCY_SCAN
   Extracts components and versions from JavaScript, headers, cookies, error pages, and public signals, then maps them to known risk surfaces such as Log4j, Shiro, Fastjson, and Spring Boot exposures.

3. Phase 2 | API_FUZZ
   Links endpoints, parameters, response fields, and value pools to test IDOR, broad queries, unauthenticated access, GraphQL behavior, and parameter-driven attack paths. The core principle is response-driven request chaining.

4. Phase 3 | CRYPTO_ATTACK
   Analyzes JWTs, signatures, encrypted fields, leaked keys, encoding logic, and plaintext/ciphertext relationships discovered from JavaScript or API responses.

5. Phase 4 | BYPASS
   Focuses on 401/403 bypasses, path manipulation, method switching, header injection, OAuth/SSO weaknesses, CDN behavior, and cache-related access-control edges.

6. Phase 5 | EXPLOIT + REPORT
   Validates impact, builds PoCs, applies the Triage Gate, and generates Chinese reports. FOUND is not CONFIRMED; only findings with verifiable impact belong in the main report.

Seven Lifecycle Hooks

1. Context Injector: restores target state, current phase, historical logs, value pools, and handoff context to reduce cross-session memory loss.
2. Coordinator Guard: provides soft warnings for risky operations, repeated actions, or workflow drift while preserving agent autonomy.
3. Triage Gate: enforces report-time validation so detection signals are not mistaken for confirmed vulnerabilities.
4. Pair Completeness Gate: checks whether high-value endpoint, parameter, and value-pool combinations have been sufficiently consumed.
5. Worklog Recorder: records tool calls, findings, negative results, phase decisions, and evidence paths for auditability.
6. Retry Detector: detects premature surrender, repeated failures, or inefficient loops after WAF/403 blocking, then suggests alternate angles.
7. Handoff Saver: persists the state needed to resume later, including target progress, findings, evidence, queues, and value pools.

Release Contents

• Tag: main-2026-07-10
• Target branch: main
• Target commit: aa6add756319927e75578ef42fbc76480431634e
• GitHub automatically provides the full source archives as Source code (zip) and Source code (tar.gz).

This release preserves the v3.1 FUSED mainline state before the later four-phase pipeline refactor. It is intended for users who need the complete six-phase pipeline and seven-hook lifecycle implementation.