SanMuzZzZz/LuaN1aoAgent

What it solves

LuaN1aoAgent is an autonomous security research agent designed for authorized penetration testing. It solves the problem of relying on linear, fragile task lists for complex security audits by implementing a cognitive-driven approach that treats security research as a dynamic graph of evidence and hypotheses.

How it works

The system uses a specialized Planner-Executor-Observer architecture to separate concerns:

• Planner: Manages high-level goals and dependencies using a dynamic Task Graph. Instead of a linear list, it patches and adapts the plan based on new evidence.
• Executor: Operates in an isolated sandbox (Docker, Bubblewrap, or Seatbelt) to perform specific tasks using a suite of security tools (bash, web_fetch, vulnerability_search, etc.).
• Observer: Acts as both a Supervisor (making control decisions) and a Projector (converting raw execution data into a causal reasoning graph).

This "Causal Graph Reasoning" ensures that every conclusion—such as a confirmed vulnerability or a successful exploit—is explicitly linked to persisted evidence and artifacts, making the agent's reasoning traceable and verifiable.

Who it’s for

It is intended for security researchers and penetration testers who need an autonomous agent to conduct authorized security audits while maintaining a strict audit trail of evidence and ensuring sandbox isolation for safety.

Highlights

• Causal Reasoning Graph: Connects evidence to hypotheses and vulnerabilities, preventing the agent from making unsupported claims.
• Plan-on-Graph (PoG): Uses a dependency-aware task graph that allows for parallel task execution and local adaptation without regenerating the entire plan.
• Strict Sandbox Isolation: Employs Docker-based executors with restricted capabilities and a transparent Gateway to enforce network scope and authorization.
• Evidence Fidelity: Large outputs are stored as content-addressed artifacts to prevent LLM context window inflation while maintaining provenance.
• Integrated Security Skills: Supports importing community-curated pentest and CTF skill collections.