cain-agent

What the README says you get

• Other
  Cloud penetration modulecloud penetration module covering AWS / Azure / GCP / 阿里云 / 腾讯云 / 华为云
• Other
  Scope enforcement hooka `PreToolUse` hook blocks any tool call whose target falls outside `scope.yaml`
• Other
  Dangerous flags blacklisteach with a per-tool `dangerous_flags` blacklist
• Other
  Finder/validator separationdiscovery and validation run in **separate agent sessions** that never share context
• Other
  Credential redactiona redaction hook strips secrets before anything is persisted
• Other
  IAM privilege-escalation graphmodels entities → escalation actions → high-privilege targets as a directed graph
• Other
  DOT/JSON graph exportexports **DOT / JSON** for rendering, and finds escalation paths via BFS
• Other
  Per-stage model routingthe two discovery stages can each run their own engine and model
• Other
  Markdown report artifact`report.md` — the human-readable report
• Other
  Machine-readable aggregate report`aggregated-report.json` — the machine-readable aggregate
• Other
  Validation summary artifact`validation-summary.json` — the validation-pipeline summary
• Testing
  Vulnerable-terraform benchmarkSelf-built vulnerable-terraform range (`bench/aliyun-vuln-tf/`) with per-scene expected-detection fixtures

Extracted from the kit's README by a local AI model (deepseek-flash) on Sep 29, 2026. Every item is checked against an exact README quote; 2 unverifiable items were discarded. A README claim is the maker's description, not something we tested.