fix(web-security): preflight tooling guard when pdtm tools unavailable (CAP-1174) - #114
Merged
GangGreenTemperTatum merged 2 commits intoAug 11, 2026
Conversation
…e (CAP-1174) Add a 'Preflight Tooling' section to the web-security agent prompt so that when required external binaries (ProjectDiscovery pdtm suite: nuclei, httpx, dnsx, katana, interactsh-client; plus caido-cli, jxscout, protoscope, burp) are missing on a local runtime, the agent engages the operator instead of silently delivering a half-run assessment. Pairs with the SDK runtime change that surfaces failed capability 'checks:' into the agent system prompt and logs them for headless operators.
Drop the hardcoded tool inventory (nuclei/httpx/caido-cli/...) from the agent prompt. The runtime's '## Runtime Tooling Health' block already enumerates the specific failed checks dynamically from capability.yaml checks:, so restating the list in prose only invited drift. The prompt now defers to that block as the authoritative source.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
When a user has the web-security capability locally but its external tools are not installed (the ProjectDiscovery
pdtmsuite —nuclei,httpx,dnsx,katana,interactsh-client— pluscaido-cli,jxscout,protoscope, Burp), the agent previously proceeded blind, called failing tools, and burned tokens delivering half an engagement. These tools are auto-installed in a Dreadnode sandbox but commonly missing on a local runtime.Change
Adds a brief Preflight Tooling section to the web-security agent prompt: if the runtime reports a
## Runtime Tooling Healthblock (failed capabilitychecks:), the agent must engage the operator (ask_user), name the missing tools, and either wait or explicitly scope down — rather than silently running a partial scan.Pairs with
The SDK-side runtime change in
dreadnode-tigerthat:checks:into the agent system prompt (## Runtime Tooling Health) — scalable to all capabilities that declarechecks:.--printoperators get a signal even without the TUI health panel.Non-blocking by design: the capability still loads; this only alerts.
Scope
Prompt-only; one file. No tooling/behavior change beyond the added guidance.