# External Knowledge & Tool Integrations

Rhodawk now embeds three external knowledge / capability sources directly
into the runtime so the orchestrator and analysis engines can use them
offline, without round-tripping to the public web on every audit.

| Vendor                                                      | Lives at                          | Python module             | What it gives Rhodawk |
|-------------------------------------------------------------|-----------------------------------|---------------------------|------------------------|
| [`jo-inc/camofox-browser`](https://github.com/jo-inc/camofox-browser)               | `/opt/camofox` (npm) + node server | `camofox_client.py`       | Anti-detection Firefox-fork browsing for live web tasks (cve_intel, repo_harvester, knowledge_rag, red_team_fuzzer, bounty_gateway) |
| [`0xmaximus/Galaxy-Bugbounty-Checklist`](https://github.com/0xmaximus/Galaxy-Bugbounty-Checklist) | `vendor/galaxy_bugbounty/`        | `bugbounty_checklist.py`  | 24-category bug bounty methodology + payload corpora keyed by CWE / vuln tag |
| [`zomasec/client-side-bugs-resources`](https://github.com/zomasec/client-side-bugs-resources)     | `vendor/clientside_bugs/`         | `clientside_resources.py` | Curated client-side (XSS / CSP / postMessage / prototype-pollution / CORS) reading list — section-indexed |
| [`PrathamLearnsToCode/paper2code`](https://github.com/PrathamLearnsToCode/paper2code)             | `vendor/paper2code/`              | `paper2code_engine.py`    | arXiv-paper → citation-anchored, ambiguity-audited Python scaffold (uses the existing OpenClaude gRPC bridge for LLM calls) |

## Where they plug into the existing engines

### `bugbounty_checklist.py`

* **`vuln_classifier.py`** — after CWE classification, call
  `bugbounty_checklist.match_for_tag(cwe)` to surface the canonical
  Galaxy checklist for that class (24 categories covered: XSS, SSRF,
  SQLi, OAuth, CSRF bypass, IDOR, file upload, request smuggling,
  rate-limit bypass, password reset, IIS, Log4Shell, WordPress, …).
* **`red_team_fuzzer.py` / `harness_factory.py`** — call
  `payloads_for("sql_injection")` to seed the SQLi corpus from
  Galaxy's `SQL.txt`, or `payloads_for("xss")` to harvest inline
  XSS payload snippets from the README.
* **`hermes_orchestrator.py`** — call
  `hints_for_finding(cwe=..., label=..., description=...)` to inject
  hand-curated tradecraft bullets into the triage prompt.

### `clientside_resources.py`

* **`knowledge_rag.py`** — `seed_urls()` returns a flat unique list of
  the upstream README's links, perfect as initial input to the
  embedding-store ingest loop.
* **`red_team_fuzzer.py`** — `for_tag("postmessage")` returns the
  reference write-ups to attach to a generated client-side PoC.
* **`vuln_classifier.py`** — `search("dompurify")` etc. surfaces
  reference research write-ups when classifying client-side findings.

### `paper2code_engine.py`

* **`hermes_orchestrator.py`** Night-Hunt mode — when a new primitive
  surfaces in the wild, call `paper2code_engine.run(arxiv_url)` to
  scaffold a reproduction under `/data/paper2code/{slug}/` with an
  ambiguity audit.  The orchestrator can then hand the scaffold to
  the OpenClaude gRPC bridge for completion.
* **`training_store.py`** — register the scaffold's
  `REPRODUCTION_NOTES.md` + `ambiguity_audit.json` as a training
  example for the data flywheel.
* **`knowledge_rag.py`** — the ambiguity audit (per-dimension
  SPECIFIED / PARTIALLY_SPECIFIED / UNSPECIFIED classification) is
  embedded alongside the paper text so the RAG store learns *what is
  uncertain*, not just *what was written*.

## Quick programmatic checks

```python
import bugbounty_checklist as bb
print(bb.stats())                      # {'categories': 24, 'total_payloads': ...}
print(bb.list_categories())
print(bb.payloads_for('sqli', limit=5))
print(bb.hints_for_finding(cwe='CWE-918'))

import clientside_resources as cs
print(cs.stats())                      # sections + resource count
print(cs.for_tag('prototype_pollution'))

import paper2code_engine as p2c
print(p2c.stats())                     # vendor + LLM availability
result = p2c.run('https://arxiv.org/abs/1706.03762')   # heuristic mode if no LLM
print(result.to_dict())
```

## Vendoring policy

* All three repos are mirrored under `vendor/` so the runtime is
  self-contained and reproducible — no surprise upstream changes can
  break a Rhodawk scan in the middle of an engagement.
* Re-vendoring is a manual operation (just `git clone` the upstream
  and copy the relevant directories) — version pinning is implicit
  through git history.
* Source licenses (MIT for camofox-browser and clientside-bugs,
  MIT for paper2code, MIT for Galaxy-Bugbounty-Checklist) are
  preserved alongside the vendored content.