Bug-bounty hunter who builds tools. Crystal-native offensive security, autonomous hunt pipelines, and hardware-adjacent frameworks for offline research.
Work surfaces at prowlrbot.com.
quartz · Crystal · Flipper Zero dev framework.
Single static binary. Offline-first. Federated .sig bundles shared peer-to-peer, not uploaded to someone else's lab. Parser, host-side simulator, native FAP build, serial RPC.
CyberBox · Docker · Security workspace. 160+ tools, Caido proxy plugin, dual-LLM routing (Claude + Ollama), plugin marketplace, AI guardrails. Latest: v0.2.1.
ProwlrBot · Python + Go · Multi-agent platform. Bash pipelines chain security binaries into recon → vulnscan → triage → report. AI agents read tool output; no LLM wraps a CLI. Spine is FastAPI, console is shadcn/Tailwind.
| Repo | Stack | What it does |
|---|---|---|
| flaw | Crystal | SAST for bug-bounty targets — regex + AST rules, plugin-friendly |
| ghactor | Go | GitHub Actions hardening CLI: lint · fix · SHA-pin · trial · trail |
| Prowlrview | Crystal | Intercepting proxy + live attack-surface graph, Lua plugins |
| ROAR Protocol | Python | Agent-to-agent communication standard — MCP + A2A + ACP + ANP in one |
| gf-patterns | regex | Opinionated bug-bounty grep patterns |
| nuclei-templates-custom | YAML | Custom nuclei templates from live hunts |
Languages Crystal · Rust · Go · Python · TypeScript
Security Caido · Nuclei · 160+ Go binaries · custom Crystal tooling
Agents Claude Code · Ollama · MCP · ROAR
Hardware Flipper Zero · GL-AR150 · RTL-SDR
Infra Cloudflare Pages · Fly.io · Docker · WSL2
Notes Obsidian second-brain — methodology, CVEs, red/blue playbooks
Autonomous recon → triage → report pipelines that make one hunter move like a team. Prompt-injection guardrails and secret redaction for offensive tooling. Supply-chain posture for the bug-bounty toolchain itself — pin every action, audit every dependency. Crystal-native security tools.
- Crystal macros and AST work for flaw's rule engine
- Rust for the
roartransport fast-path - Flipper firmware internals (FuriHAL, protobuf RPC, native FAPs)
prowlrbot.com · kdaistack · @ProwlrBot · prowlr@proton.me