{"id":"52a3dec8-1e57-4193-94a5-556366eac489","slug":"wisehat","kind":"skill","name":"Wisehat","summary":"Wisehat AI Helps Whitehats Hunt Wisely","owner":"TradMod","repoUrl":"https://github.com/TradMod/Wisehat","license":"GPL-3.0","licenseTier":"strong-copyleft","trust":"community","stars":2,"match":null,"fewStars":true,"format":"skill","createdAt":"2026-07-15T11:00:35.000Z","addedAt":"2026-10-22T01:30:09.179Z","logoUrl":"https://avatars.githubusercontent.com/u/99166851?u=edc2b64c2b3dbb03369b7bb8bee9446722e943d0&v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["writing"],"tags":["ai-app","langchain","python"],"runtime":"binary","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-27T04:45:57.550Z","sample":false,"url":"https://conduits.dev/tools/wisehat","language":"Python","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"```text\n ▄█     █▄   ▄█     ▄████████    ▄████████    ▄█    █▄       ▄████████     ███    \n███     ███ ███    ███    ███   ███    ███   ███    ███     ███    ███ ▀█████████▄\n███     ███ ███▌   ███    █▀    ███    █▀    ███    ███     ███    ███    ▀███▀▀██\n███     ███ ███▌   ███         ▄███▄▄▄      ▄███▄▄▄▄███▄▄   ███    ███     ███   ▀\n███     ███ ███▌ ▀███████████ ▀▀███▀▀▀     ▀▀███▀▀▀▀███▀  ▀███████████     ███    \n███     ███ ███           ███   ███    █▄    ███    ███     ███    ███     ███    \n███ ▄█▄ ███ ███     ▄█    ███   ███    ███   ███    ███     ███    ███     ███    \n ▀███▀███▀  █▀    ▄████████▀    ██████████   ███    █▀      ███    █▀     ▄████▀  \n```\n**Wisehat Helps Whitehats Hunt Wisely - AI-powered intelligence for bug bounty hunters.**\n\n> Try the live app: **https://wisehat-ai.streamlit.app/**\n\n---\n\nWiseHat is an AI-powered intelligence tool that analyzes Blockchain Bug Bounty Programs (BBPs) and produces a structured, researcher-friendly report **before** you spend time hunting. Instead of reading pages of documentation, whitehats get an instant breakdown of the rules, risks, rewards, scope, and requirements that materially affect whether a valid vulnerability will actually be accepted, classified correctly, and rewarded.\n\nWiseHat does **not** summarize documentation. It analyzes bug bounty documentation from the perspective of an experienced security triager and expert bug bounty rules analyzer — identifying the rules, wording, exclusions, classifications, and requirements that determine whether a researcher can:\n\n- Hunt safely\n- Submit valid reports\n- Receive fair rewards\n- Avoid unnecessary disputes\n- Understand program expectations\n\n---\n\n## Supported Platforms\n\n| Platform | How data is fetched |\n|---|---|\n| **Immunefi** | Scrapes the program's `information`, `scope`, and `resources` pages via LangChain's `WebBaseLoader`. Program slugs are resolved case-insensitively against Immunefi's canonical program list. |\n| **Hackenproof** | Fetches program data through the Hackenproof MCP (JSON-RPC) API. |\n\n---\n\n## Report Sections\n\nEvery WiseHat report contains the following sections, generated strictly from the provided documentation:\n\n- **Program Overview** — what the project protects, assets covered, notable characteristics (no marketing language).\n- **WiseHat Recommendation and Rating** — an overall `1–10` score representing how researcher-friendly the program is, with a verdict and short explanation.\n  - `9.0–10.0` → Excellent — Highly Recommended\n  - `8.0–8.9` → Very Good — Recommended\n  - `7.0–7.9` → Good — Hunt with Awareness\n  - `5.0–6.9` → Proceed with Caution\n  - `< 5.0` → High Risk for Researchers\n- **Mandatory Requirements** — every requirement that could invalidate an otherwise valid report (PoC, KYC, responsible disclosure, testing restrictions, etc.).\n- **Green Flags** — characteristics that benefit researchers (clear documentation, Primacy of Impact, deterministic rewards, etc.).\n- **Red Flags** — characteristics that increase researcher uncertainty or risk (\"up to\", \"sole discretion\", undefined severities, vague exclusions, etc.).\n- **Scope & Impact Analysis** — in-scope/out-of-scope assets, reward ranges, severity classification, and known-issue exclusions.\n- **Other Things to Consider** — additional observations worth knowing before hunting.\n- **Hunter Tips** — practical advice derived only from the documentation.\n- **Before You Hunt Checklist** — a concise, documentation-backed checklist to run through before starting.\n\n---\n\n## Project Structure\n\n```\nWisehat/\n├── app.py                      # Core: LLM chain, WiseHatReport schema, generate_report()\n├── frontend/\n│   └── streamlit_app.py        # Streamlit web UI\n├── programs/\n│   ├── immunefi_loader.py      # Immunefi page loader + case-insensitive slug resolver\n│   └── hackenproof_mcp.py      # Hackenproof MCP (JSON-RPC) client\n├── prompts/\n│   ├── system_prompt.md        # WiseHat AI system prompt (analysis framework + rules)\n│   └── SKILL.md                # Agent skill definition (bug-bounty-program-analysis)\n├── .env.example                # Required environment variables\n└── requirements.txt            # Python dependencies\n```\n\n---\n\n## Setup\n\n### 1. Clone & install dependencies\n\n```bash\ngit clone <repo-url>\ncd Wisehat\nuv pip install -r requirements.txt   # or: pip install -r requirements.txt\n```\n\n### 2. Configure environment variables\n\nCopy `.env.example` to `.env` and fill in your keys:\n\n```bash\ncp .env.example .env\n```\n\n| Variable | Required for | Description |\n|---|---|---|\n| `OPENCODE_GO_API_KEY` | All reports | API key for the OpenCode GO LLM endpoint (Kimi K2.6). |\n| `HACKENPROOF_API_KEY` | Hackenproof only | API key for the Hackenproof MCP. |\n\n---\n\n## Usage\n\n### Web UI (Streamlit)\n\n**Live deployment:** https://wisehat-ai.streamlit.app/\n\nTo run locally:\n\n```bash\nstreamlit run frontend/streamlit_app.py\n```\n\nThen open http://localhost:8501, pick a platform, enter the program name (any casing works), and click **Generate Intelligence Report**.\n\n> Note: Streamlit hot-reloads `streamlit_app.py` on save, but changes to `app.py` or files under `programs/` require a server restart to take effect (Python caches imported modules).\n\n### CLI\n\n```bash\npython app.py\n```\n\nPrompts for platform and program name, then prints the structured report as JSON.\n\n---\n\n## How It Works\n\n```\nUser input (platform + program name)\n        │\n        ▼\n┌────────────────────────┐\n│  Platform data loader  │\n│  (Immunefi / Hackenproof)│\n└────────────────────────┘\n        │ program_data\n        ▼\n┌────────────────────────┐\n│  ChatPromptTemplate    │  ← system_prompt.md (WiseHat analysis framework)\n│  + WiseHatReport schema│  ← pydantic structured output\n└────────────────────────┘\n        │ structured_llm.invoke()\n        ▼\n┌────────────────────────┐\n│   WiseHatReport (JSON) │\n└────────────────────────┘\n```\n\n1. The selected platform loader fetches the program's raw documentation.\n2. The documentation is injected into a chat prompt built from `prompts/system_prompt.md`.\n3. The LLM (`kimi-k2.6` via OpenCode GO) produces a `WiseHatReport` using LangChain's structured output, guaranteed to match the pydantic schema.\n4. The report is rendered in the Streamlit UI (or printed as JSON in CLI mode).\n\n---\n\n## Core Principles\n\nWiseHat follows a strict analyst mindset, enforced by the system prompt:\n\n- **Accuracy over completeness** — never invent rules, exclusions, requirements, or severity mappings.\n- **No speculation** — if something is missing, unclear, or ambiguous, it is explicitly called out.\n- **Documented facts vs. WiseHat observations** — these are always distinguished, never blurred.\n- **No bad-faith accusations** — only practical consequences of wording are explained.\n- **Date agnosticism** — dates are reported as documented facts, never interpreted relative to \"today\" to infer whether a program is active/paused/expired.\n\n---\n\n## Agent Skill\n\nWiseHat's analysis framework is also packaged as a reusable agent skill in [`prompts/SKILL.md`](prompts/SKILL.md). It carries YAML frontmatter:\n\n```yaml\nname: bug-bounty-program-analysis\ndescription: Analyze Blockchain Bug Bounty Program documentation from the perspective\n  of an experienced security triager to produce researcher-focused intelligence reports.\n```\n\nThis lets AI coding agents (such as opencode) load WiseHat's analysis workflow — the same expertise, core principles, section structure, and verdict scale that power the app — and apply it to any bug bounty documentation you provide directly (program pages, scope pages, PDFs, markdown, HTML, website extracts) across platforms beyond Immunefi and Hackenproof, including Cantina, Sherlock, and Code4rena.\n\nUse the skill when you already have the documentation in hand and want the WiseHat analysis without running the data loaders. Use the app (`app.py` / Streamlit UI) when you only have a program name and want WiseHat to fetch and analyze everything end-to-end.\n\n---\n\n## Tech Stack\n\n- **LangChain** — prompt templates + structured output\n- **OpenCode GO (Kimi K2.6)** — LLM via OpenAI-compatible API\n- **Pydantic** — `WiseHatReport` structured schema\n- **Streamlit** — web frontend\n- **requests / WebBaseLoader** — program data fetching\n\n---\n\n## License\n\nSee [LICENSE](LICENSE).\n"}