Public Tooling

The Arsenal

Every tool, running and public on GitHub. Offensive and defensive security, wireless and RF, forensics, and the AI red-team frameworks built alongside it. The curated version is on Work. This page is all of it.

Recent Findings

Building the tools is half of it. This is the other half: real bugs found and fixed by actually running this arsenal against reality instead of trusting what a comment claims.

  • 2026-09-03amnesia

    The privacy sanitizer's own comment claimed metadata was wiped; the code called the one sharp() method that retains it. GPS coordinates and camera serials survived every "sanitized" output. Fixed by removing the call. Sharp strips by default. Full write-up →

  • 2026-09-03claude_whisperer

    The core safety-detection pipeline matched nothing, for any input, ever: three compounding bugs (a pattern-merge that silently dropped two of three files, a field-name mismatch, a confidence gate with no real confidence value). Its own tests passed because their fixtures no longer matched the real schema. Full write-up →

AI Red-Team Labs

Vulnerable/fixed pairs and detection logic, not illustrated tools — each one tested, containerized, and run for real before anything here got written down.

VULN / FIX8/8

Boarding Pass Lab

A check-in portal that accepts a last name but never checks it against the booking. A boarding-pass barcode with no signature, so a hand-tampered seat upgrade scans clean.

github.com/ghostintheprompt/boarding_pass_lab

DETECTION12/12

Facial Liveness Detection Lab

No single presentation-attack signal catches every spoof: depth misses a screen replay, motion misses a printed photo. Only the fused check catches a photo, a replay, and a mask alike.

github.com/ghostintheprompt/facial_liveness_detection_lab

DETECTION6/6

Agentic C2 Detection Lab

An AI agent using a shared cloud document as a covert command channel, caught on three independent signals: beaconing, privileged fan-out, command-then-execute timing.

github.com/ghostintheprompt/agentic_c2_detection_lab

DETECTION30/30

Coding Agent Monitor Lab

Seven ways to hide an instruction in what a coding agent reads — a comment, a README, a dependency's own docs. Checking scope misses all seven. Checking where the instruction came from catches all seven.

github.com/ghostintheprompt/coding_agent_monitor_lab

Systems & Tools

ClutchCellular SecurityClutch

Security monitor for iOS, macOS, and Linux that detects IMSI catchers and signal downgrades.

Hidden BastardMaintenanceHidden Bastard

macOS utility that identifies and removes gigabytes of invisible junk files and build artifacts.

CyclopsVisual QACyclops

Automation engine for visual regression testing and generating framed App Store screenshots.

LinemanSecurity internalsLineman

Host Intrusion Prevention System (HIPS) prototype for macOS demonstrating security internals.

Flea FlickerNetworkingFlea Flicker

Network filter for packet manipulation, MAC spoofing, and IDS evasion for security research.

Image Payload InjectionSecurityImage Payload Injection

Security tool for testing metadata injection, steganography, and parser exploits in image formats.

Tit-for-TatPentestingTit-for-Tat

Penetration testing framework designed to audit and secure newsroom infrastructure.

DuckHunterDrone DefenseDuckHunter

Tactical drone security platform for protocol interception, RF analysis, and MAVLink override simulation.

Bot TollSecurityBot Toll

A high-deterrence security layer that protects digital domains from unauthorized scrapers by imposing resource-draining retaliation protocols.

SkepticSecurity AuditSkeptic

Trust nothing, verify everything. A multi-agent security auditor that hunts for hallucinations, ghost methods, and sanitization theater in AI-generated code.

half-lifeContent Integrityhalf-life

LLM-powered content-decay auditor, points at an archive and ranks every piece by how far it has rotted: dead links, superseded model IDs, predictions that already landed.