indra
Menu How it works

Start

How it works

The review pipeline stage by stage, what the plugin contains, and how to add a vulnerability class.

  1. Setup - probe available tools, define scope, create the run directory.
  2. Recon (sh-recon) - build the Graft graph; detect stack/versions; SBOM + CVEs; enumerate entry points, trust boundaries, and dangerous sinks.
  3. Hunt (sh-hunter ×N, parallel) - one hunter per relevant class loads its sh-kb-* knowledge base, traces attacker input from source to sink, and records candidates. A shared attempts ledger stops agents from repeating each other's probes. With indra available, the orchestrator first recalls each class's past findings, guards and false positives from long-term memory and hands them to that hunter.
  4. Chain (sh-chainer) - compose findings into higher-severity attack paths.
  5. Verify (sh-verifier) - refute first, then confirm exploitability from evidence, build PoCs, assign CVSS, and cut false positives.
  6. Report (sh-reporter) - produce the deliverables.
  7. Remember (optional, sh-memory) - record verified findings, false positives and a few learnings into the long-term memory graph for the next run.

Subagents share nothing but files; the contract is in plugins/indra/references/state-files.md.

What's inside

indra/                           # this repository: a plugin marketplace + the indra CLI
├── plugins/indra/               # the indra plugin
│   ├── skills/
│   │   ├── indra                # /indra - the entry point, routes any appsec request
│   │   ├── sh-security-review   # the pipeline orchestrator (stages 0-6)
│   │   ├── sh-pr-review         # review one pull request, post inline comments
│   │   ├── sh-memory            # long-term graph memory across runs
│   │   ├── sh-publish           # findings to Jira, Confluence, GitHub issues, Notion
│   │   └── sh-kb-*  (15)        # per-vulnerability-class knowledge bases
│   ├── agents/
│   │   ├── sh-recon             # map: code graph, stack, SBOM/CVE, attack surface
│   │   ├── sh-hunter            # find: source-to-sink hunting, one per class, in parallel
│   │   ├── sh-chainer           # escalate: combine findings into attack chains
│   │   ├── sh-verifier          # confirm: refute first, then prove impact with a PoC
│   │   └── sh-reporter          # deliver: README/JSON/SARIF/HTML/PDF/doc
│   └── references/              # shared contracts (finding schema, SARIF map, rubrics)
├── tools/indra/                 # the indra CLI (Rust): graph memory + agent web console
├── site/                        # the project website (GitHub Pages)
└── assets/                      # logo, banner and screenshots

Vulnerability classes covered (the sh-kb-* skills)

access-control (IDOR/BOLA/priv-esc) · sqli · xss · ssrf · injection (cmd/code/SSTI/LDAP) · auth (session/JWT) · deserialization · path-traversal (LFI/RFI) · secrets · csrf · xxe · open-redirect · crypto · race-conditions · file-upload. Dependency CVEs and the SBOM are handled by the recon stage.

Extending

Add a new vulnerability class by creating skills/sh-kb-<class>/SKILL.md following the shared template (When to hunt · Sources & sinks · Detection recipe · Payloads/PoC · False-positive filters · CWE/OWASP · Chaining hints · Mitigation), then add its slug to the class enum in references/finding-schema.json and the routing table in skills/indra/SKILL.md.