dreadnode/capabilities

恐惧节点功能

这是 Dreadnode 发布给 app.dreadnode.io 的能力的源仓库。能力是一个目录——一个清单加上任意组合的代理、工具、技能和 MCP 服务器——Dreadnode 运行时会接收并加载它：

安装一个

• 已发布 — dn capability install dreadnode/ai-red-teaming（可从capabilities/中替换任意名称）
• From source — dn capability install ./capabilities/ai-red-teaming 将目录符号链接到你的运行时，因此编辑在重新加载时即生效
• 从 TUI — 开始 dn，按 Ctrl+P，筛选 dreadnode/

dn 是 Dreadnode CLI — 详见安装和认证的启动。功能的完整安装参考存在于 docs.dreadnode.io/capabilities/installing。

自己打造

capabilities/ 下的每个目录都是已发货且可用的示例。请与文档并列阅读：

• 概念与负载模型
• 显现引用
• 快速启动 — 约十分钟内完成TUI跑步的支架

安全扫描

该仓库中的每项技能都用NVIDIA SkillSpector扫描，以检测快速注入、数据泄露、工具链滥用和供应链风险。

Dreadnode Capabilities

This is the source repo for the capabilities Dreadnode publishes to app.dreadnode.io. A capability is a directory — a manifest plus any combination of agents, tools, skills, and MCP servers — that a Dreadnode runtime picks up and loads:

ai-red-teaming/
  capability.yaml     # manifest
  agents/             # markdown prompts
  tools/              # python @tool functions
  skills/             # SKILL.md packs

Install one

• Published — dn capability install dreadnode/ai-red-teaming (swap in any name from capabilities/)
• From source — dn capability install ./capabilities/ai-red-teaming symlinks the directory into your runtime, so edits go live on reload
• From the TUI — start dn, press Ctrl+P, filter for dreadnode/

dn is the Dreadnode CLI — see getting-started to install and authenticate. Full install reference for capabilities lives at docs.dreadnode.io/capabilities/installing.

Build your own

Every directory under capabilities/ is a shipped, working example. Read one alongside the docs:

• Concepts and load model
• Manifest reference
• Quickstart — scaffold to running in the TUI in about ten minutes

Security scanning

Every skill in this repo is scanned with NVIDIA SkillSpector for prompt injection, data exfiltration, tool-chaining abuse, and supply chain risk. CI runs SkillSpector in static mode (--no-llm) for deterministic scans without provider API keys, uploads SARIF reports to GitHub Code Scanning, and reports findings. Because security-focused capabilities intentionally contain offensive security content, the workflow currently reports findings without blocking merges while thresholds are tuned.

just security-scan                    # scan all capabilities
just security-scan web-security       # scan one capability
just security-scan behavioral="true"  # ignored by SkillSpector; kept for compatibility