hive/examples/templates/vulnerability_assessment/flowchart.json

{
  "original_draft": {
    "agent_name": "vulnerability_assessment",
    "goal": "A passive, OSINT-based website vulnerability assessment agent that accepts a website domain, performs non-intrusive security scanning using purpose-built Python tools, produces letter-grade risk scores (A-F) per category, and delivers a structured vulnerability report with remediation guidance. The user is consulted after scanning to decide whether to investigate further or generate the final report.",
    "description": "",
    "success_criteria": [
      "Overall risk grade (A-F) generated from combined scan results",
      "At least 5 of 6 security categories scored (SSL/TLS, HTTP Headers, DNS, Network, Technology, Attack Surface)",
      "At least 3 security findings identified across different categories",
      "Every finding includes clear, actionable remediation steps a developer can follow",
      "User is presented findings with risk grades and given checkpoint to continue deeper scanning or generate report"
    ],
    "constraints": [
      "Never execute active attacks, send exploit payloads, or perform actions that could trigger WAF/IDS systems. Passive and OSINT-based scanning only \u2014 no nmap, sqlmap, or attack payloads.",
      "All findings and remediation steps must be written for developers using clear language, not security jargon"
    ],
    "nodes": [
      {
        "id": "intake",
        "name": "Intake",
        "description": "Collect the target website domain from the user and confirm the scanning scope",
        "node_type": "event_loop",
        "tools": [],
        "input_keys": [],
        "output_keys": [
          "target_domain"
        ],
        "success_criteria": "",
        "sub_agents": [],
        "flowchart_type": "start",
        "flowchart_shape": "stadium",
        "flowchart_color": "#8aad3f"
      },
      {
        "id": "passive-recon",
        "name": "Passive Reconnaissance",
        "description": "Run all 6 passive scanning tools against the target domain: SSL/TLS, HTTP headers, DNS security, port scanning, tech stack detection, and subdomain enumeration",
        "node_type": "event_loop",
        "tools": [
          "ssl_tls_scan",
          "http_headers_scan",
          "dns_security_scan",
          "port_scan",
          "tech_stack_detect",
          "subdomain_enumerate"
        ],
        "input_keys": [
          "target_domain",
          "feedback"
        ],
        "output_keys": [
          "scan_results"
        ],
        "success_criteria": "",
        "sub_agents": [],
        "flowchart_type": "process",
        "flowchart_shape": "rectangle",
        "flowchart_color": "#b5a575"
      },
      {
        "id": "risk-scoring",
        "name": "Risk Scoring",
        "description": "Calculate weighted letter grades (A-F) per security category and overall risk score from scan results",
        "node_type": "event_loop",
        "tools": [
          "risk_score"
        ],
        "input_keys": [
          "scan_results"
        ],
        "output_keys": [
          "risk_report"
        ],
        "success_criteria": "",
        "sub_agents": [],
        "flowchart_type": "process",
        "flowchart_shape": "rectangle",
        "flowchart_color": "#b5a575"
      },
      {
        "id": "findings-review",
        "name": "Findings Review",
        "description": "Present risk grades and security findings to the user, ask whether to continue deeper scanning or generate the final report",
        "node_type": "event_loop",
        "tools": [],
        "input_keys": [
          "scan_results",
          "risk_report",
          "target_domain"
        ],
        "output_keys": [
          "continue_scanning",
          "feedback",
          "all_findings"
        ],
        "success_criteria": "",
        "sub_agents": [],
        "flowchart_type": "decision",
        "flowchart_shape": "diamond",
        "flowchart_color": "#d89d26"
      },
      {
        "id": "final-report",
        "name": "Risk Dashboard Report",
        "description": "Generate an HTML risk dashboard with color-coded grades, category breakdown, detailed findings, and remediation steps",
        "node_type": "event_loop",
        "tools": [
          "save_data",
          "append_data",
          "serve_file_to_user"
        ],
        "input_keys": [
          "all_findings",
          "risk_report",
          "target_domain"
        ],
        "output_keys": [
          "report_status"
        ],
        "success_criteria": "",
        "sub_agents": [],
        "flowchart_type": "terminal",
        "flowchart_shape": "stadium",
        "flowchart_color": "#b5453a"
      }
    ],
    "edges": [
      {
        "id": "edge-0",
        "source": "intake",
        "target": "passive-recon",
        "condition": "on_success",
        "description": "",
        "label": ""
      },
      {
        "id": "edge-1",
        "source": "passive-recon",
        "target": "risk-scoring",
        "condition": "on_success",
        "description": "",
        "label": ""
      },
      {
        "id": "edge-2",
        "source": "risk-scoring",
        "target": "findings-review",
        "condition": "on_success",
        "description": "",
        "label": ""
      },
      {
        "id": "edge-3",
        "source": "findings-review",
        "target": "passive-recon",
        "condition": "conditional",
        "description": "",
        "label": ""
      },
      {
        "id": "edge-4",
        "source": "findings-review",
        "target": "final-report",
        "condition": "conditional",
        "description": "",
        "label": ""
      },
      {
        "id": "edge-5",
        "source": "final-report",
        "target": "intake",
        "condition": "on_success",
        "description": "",
        "label": ""
      }
    ],
    "entry_node": "intake",
    "terminal_nodes": [
      "final-report"
    ],
    "flowchart_legend": {
      "start": {
        "shape": "stadium",
        "color": "#8aad3f"
      },
      "terminal": {
        "shape": "stadium",
        "color": "#b5453a"
      },
      "process": {
        "shape": "rectangle",
        "color": "#b5a575"
      },
      "decision": {
        "shape": "diamond",
        "color": "#d89d26"
      },
      "io": {
        "shape": "parallelogram",
        "color": "#d06818"
      },
      "document": {
        "shape": "document",
        "color": "#c4b830"
      },
      "database": {
        "shape": "cylinder",
        "color": "#508878"
      },
      "subprocess": {
        "shape": "subroutine",
        "color": "#887a48"
      },
      "browser": {
        "shape": "hexagon",
        "color": "#cc8850"
      }
    }
  },
  "flowchart_map": {
    "intake": [
      "intake"
    ],
    "passive-recon": [
      "passive-recon"
    ],
    "risk-scoring": [
      "risk-scoring"
    ],
    "findings-review": [
      "findings-review"
    ],
    "final-report": [
      "final-report"
    ]
  }
}