StatusSAFE

Bug bounty agent framework for Claude Code, Codex, Gemini, Cursor, Windsurf, Copilot, and OpenClaw — 48 agents, 26 commands, 19 CLI tools, 2 MCP servers, autonomous hunt loops, exploit chain builder.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: status
description: "Show engagement dashboard with program info, scope, brain state, findings, agent activity, and cost estimate."
disable-model-invocation: false
---
Show the engagement status dashboard.

Run `uv run python3 $CLAUDE_PROJECT_DIR/tools/statusline.py` to display the full dashboard.

After displaying, offer relevant next actions based on the state:
- If no scope: suggest `/sync`
- If no brain: suggest `/brain init`
- If no findings: suggest `/quickscan` or `/fullscan`
- If findings but no reports: suggest `/report`
- If exhausted vectors are high: suggest focusing on untested areas

## Top-Tier Dashboard Bar

Status should drive the next decision.

Always surface:
- highest-value untested target
- strongest confirmed finding not yet reported
- chain-pending feeders
- stale recon or scope data
- blockers requiring user action
- cost burn versus validated output
- evidence gaps before submission

End with exactly three recommended next actions ordered by expected value. Avoid generic "continue hunting" unless the target and vuln class are named.

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (1)

Gates applied: no_behavioural_pass, no_license.