mirror of
https://github.com/danielmiessler/Fabric.git
synced 2026-01-11 15:28:07 -05:00
Compare commits
53 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
0d04a9eb70 | ||
|
|
62e7f23727 | ||
|
|
3398e618d8 | ||
|
|
11402dde44 | ||
|
|
37f5587a81 | ||
|
|
a802f844de | ||
|
|
1f6b69d2fa | ||
|
|
dcdf356776 | ||
|
|
ad7c7d0f00 | ||
|
|
7e86e88846 | ||
|
|
3eecf952d2 | ||
|
|
19f6c48795 | ||
|
|
8b4eec90a4 | ||
|
|
17ba26c3f8 | ||
|
|
d381f1fd92 | ||
|
|
527d353e23 | ||
|
|
949daf4a5a | ||
|
|
edb1597d07 | ||
|
|
cf8ca0d115 | ||
|
|
901de01cc1 | ||
|
|
391c908848 | ||
|
|
f9d2f45e6b | ||
|
|
88f11b8cf6 | ||
|
|
c40ab79539 | ||
|
|
1f7a61e180 | ||
|
|
3b70b3e2d5 | ||
|
|
d068e07207 | ||
|
|
1393b59567 | ||
|
|
2ca88c2261 | ||
|
|
3cf423a8be | ||
|
|
5e30b1ee01 | ||
|
|
8ba8871242 | ||
|
|
c0858317c9 | ||
|
|
b139802132 | ||
|
|
19b7fd6c89 | ||
|
|
164567dac2 | ||
|
|
21cfa42eba | ||
|
|
af64c61050 | ||
|
|
f2cbb13ea3 | ||
|
|
2af721c385 | ||
|
|
4988e3b23f | ||
|
|
a53b0d5938 | ||
|
|
9d99ec4a88 | ||
|
|
31005f37d3 | ||
|
|
d3f53e5708 | ||
|
|
6566772097 | ||
|
|
aa36ee3a48 | ||
|
|
bbda4db9a7 | ||
|
|
4112f7db5c | ||
|
|
771422362f | ||
|
|
4eb3b45764 | ||
|
|
559e11c49b | ||
|
|
02e06413d7 |
@@ -1 +0,0 @@
|
||||
3.10
|
||||
21
helpers/README.md
Normal file
21
helpers/README.md
Normal file
@@ -0,0 +1,21 @@
|
||||
# Fabric Helpers
|
||||
|
||||
These are helper tools to work with Fabric. Examples include things like getting transcripts from media files, getting metadata about media, etc.
|
||||
|
||||
## yt (YouTube)
|
||||
|
||||
`yt` is a command that uses the YouTube API to pull transcripts, get video duration, and other functions. It's primary function is to get a transcript from a video that can then be stitched (piped) into other Fabric Patterns.
|
||||
|
||||
```bash
|
||||
usage: yt [-h] [--duration] [--transcript] [url]
|
||||
|
||||
vm (video meta) extracts metadata about a video, such as the transcript and the video's duration. By Daniel Miessler.
|
||||
|
||||
positional arguments:
|
||||
url YouTube video URL
|
||||
|
||||
options:
|
||||
-h, --help show this help message and exit
|
||||
--duration Output only the duration
|
||||
--transcript Output only the transcript
|
||||
```
|
||||
1
helpers/vm → helpers/yt
Executable file → Normal file
1
helpers/vm → helpers/yt
Executable file → Normal file
@@ -83,4 +83,3 @@ if __name__ == '__main__':
|
||||
main(args.url, args)
|
||||
else:
|
||||
parser.print_help()
|
||||
|
||||
@@ -1 +0,0 @@
|
||||
3.10
|
||||
@@ -1,81 +0,0 @@
|
||||
from langchain_community.tools import DuckDuckGoSearchRun
|
||||
import os
|
||||
from crewai import Agent, Task, Crew, Process
|
||||
from dotenv import load_dotenv
|
||||
import os
|
||||
|
||||
current_directory = os.path.dirname(os.path.realpath(__file__))
|
||||
config_directory = os.path.expanduser("~/.config/fabric")
|
||||
env_file = os.path.join(config_directory, ".env")
|
||||
load_dotenv(env_file)
|
||||
os.environ['OPENAI_MODEL_NAME'] = 'gpt-4-0125-preview'
|
||||
|
||||
# You can choose to use a local model through Ollama for example. See https://docs.crewai.com/how-to/LLM-Connections/ for more information.
|
||||
# osOPENAI_API_BASE='http://localhost:11434/v1'
|
||||
# OPENAI_MODEL_NAME='openhermes' # Adjust based on available model
|
||||
# OPENAI_API_KEY=''
|
||||
|
||||
# Install duckduckgo-search for this example:
|
||||
# !pip install -U duckduckgo-search
|
||||
|
||||
search_tool = DuckDuckGoSearchRun()
|
||||
|
||||
# Define your agents with roles and goals
|
||||
researcher = Agent(
|
||||
role='Senior Research Analyst',
|
||||
goal='Uncover cutting-edge developments in AI and data science',
|
||||
backstory="""You work at a leading tech think tank.
|
||||
Your expertise lies in identifying emerging trends.
|
||||
You have a knack for dissecting complex data and presenting actionable insights.""",
|
||||
verbose=True,
|
||||
allow_delegation=False,
|
||||
tools=[search_tool]
|
||||
# You can pass an optional llm attribute specifying what mode you wanna use.
|
||||
# It can be a local model through Ollama / LM Studio or a remote
|
||||
# model like OpenAI, Mistral, Antrophic or others (https://docs.crewai.com/how-to/LLM-Connections/)
|
||||
#
|
||||
# import os
|
||||
#
|
||||
# OR
|
||||
#
|
||||
# from langchain_openai import ChatOpenAI
|
||||
# llm=ChatOpenAI(model_name="gpt-3.5", temperature=0.7)
|
||||
)
|
||||
writer = Agent(
|
||||
role='Tech Content Strategist',
|
||||
goal='Craft compelling content on tech advancements',
|
||||
backstory="""You are a renowned Content Strategist, known for your insightful and engaging articles.
|
||||
You transform complex concepts into compelling narratives.""",
|
||||
verbose=True,
|
||||
allow_delegation=True
|
||||
)
|
||||
|
||||
# Create tasks for your agents
|
||||
task1 = Task(
|
||||
description="""Conduct a comprehensive analysis of the latest advancements in AI in 2024.
|
||||
Identify key trends, breakthrough technologies, and potential industry impacts.""",
|
||||
expected_output="Full analysis report in bullet points",
|
||||
agent=researcher
|
||||
)
|
||||
|
||||
task2 = Task(
|
||||
description="""Using the insights provided, develop an engaging blog
|
||||
post that highlights the most significant AI advancements.
|
||||
Your post should be informative yet accessible, catering to a tech-savvy audience.
|
||||
Make it sound cool, avoid complex words so it doesn't sound like AI.""",
|
||||
expected_output="Full blog post of at least 4 paragraphs",
|
||||
agent=writer
|
||||
)
|
||||
|
||||
# Instantiate your crew with a sequential process
|
||||
crew = Crew(
|
||||
agents=[researcher, writer],
|
||||
tasks=[task1, task2],
|
||||
verbose=2, # You can set it to 1 or 2 to different logging levels
|
||||
)
|
||||
|
||||
# Get your crew to work!
|
||||
result = crew.kickoff()
|
||||
|
||||
print("######################")
|
||||
print(result)
|
||||
@@ -1,89 +0,0 @@
|
||||
from crewai import Crew
|
||||
from textwrap import dedent
|
||||
from .trip_agents import TripAgents
|
||||
from .trip_tasks import TripTasks
|
||||
import os
|
||||
from dotenv import load_dotenv
|
||||
|
||||
current_directory = os.path.dirname(os.path.realpath(__file__))
|
||||
config_directory = os.path.expanduser("~/.config/fabric")
|
||||
env_file = os.path.join(config_directory, ".env")
|
||||
load_dotenv(env_file)
|
||||
os.environ['OPENAI_MODEL_NAME'] = 'gpt-4-0125-preview'
|
||||
|
||||
|
||||
class TripCrew:
|
||||
|
||||
def __init__(self, origin, cities, date_range, interests):
|
||||
self.cities = cities
|
||||
self.origin = origin
|
||||
self.interests = interests
|
||||
self.date_range = date_range
|
||||
|
||||
def run(self):
|
||||
agents = TripAgents()
|
||||
tasks = TripTasks()
|
||||
|
||||
city_selector_agent = agents.city_selection_agent()
|
||||
local_expert_agent = agents.local_expert()
|
||||
travel_concierge_agent = agents.travel_concierge()
|
||||
|
||||
identify_task = tasks.identify_task(
|
||||
city_selector_agent,
|
||||
self.origin,
|
||||
self.cities,
|
||||
self.interests,
|
||||
self.date_range
|
||||
)
|
||||
gather_task = tasks.gather_task(
|
||||
local_expert_agent,
|
||||
self.origin,
|
||||
self.interests,
|
||||
self.date_range
|
||||
)
|
||||
plan_task = tasks.plan_task(
|
||||
travel_concierge_agent,
|
||||
self.origin,
|
||||
self.interests,
|
||||
self.date_range
|
||||
)
|
||||
|
||||
crew = Crew(
|
||||
agents=[
|
||||
city_selector_agent, local_expert_agent, travel_concierge_agent
|
||||
],
|
||||
tasks=[identify_task, gather_task, plan_task],
|
||||
verbose=True
|
||||
)
|
||||
|
||||
result = crew.kickoff()
|
||||
return result
|
||||
|
||||
|
||||
class planner_cli:
|
||||
def ask(self):
|
||||
print("## Welcome to Trip Planner Crew")
|
||||
print('-------------------------------')
|
||||
location = input(
|
||||
dedent("""
|
||||
From where will you be traveling from?
|
||||
"""))
|
||||
cities = input(
|
||||
dedent("""
|
||||
What are the cities options you are interested in visiting?
|
||||
"""))
|
||||
date_range = input(
|
||||
dedent("""
|
||||
What is the date range you are interested in traveling?
|
||||
"""))
|
||||
interests = input(
|
||||
dedent("""
|
||||
What are some of your high level interests and hobbies?
|
||||
"""))
|
||||
|
||||
trip_crew = TripCrew(location, cities, date_range, interests)
|
||||
result = trip_crew.run()
|
||||
print("\n\n########################")
|
||||
print("## Here is you Trip Plan")
|
||||
print("########################\n")
|
||||
print(result)
|
||||
@@ -1,38 +0,0 @@
|
||||
import json
|
||||
import os
|
||||
|
||||
import requests
|
||||
from crewai import Agent, Task
|
||||
from langchain.tools import tool
|
||||
from unstructured.partition.html import partition_html
|
||||
|
||||
|
||||
class BrowserTools():
|
||||
|
||||
@tool("Scrape website content")
|
||||
def scrape_and_summarize_website(website):
|
||||
"""Useful to scrape and summarize a website content"""
|
||||
url = f"https://chrome.browserless.io/content?token={os.environ['BROWSERLESS_API_KEY']}"
|
||||
payload = json.dumps({"url": website})
|
||||
headers = {'cache-control': 'no-cache', 'content-type': 'application/json'}
|
||||
response = requests.request("POST", url, headers=headers, data=payload)
|
||||
elements = partition_html(text=response.text)
|
||||
content = "\n\n".join([str(el) for el in elements])
|
||||
content = [content[i:i + 8000] for i in range(0, len(content), 8000)]
|
||||
summaries = []
|
||||
for chunk in content:
|
||||
agent = Agent(
|
||||
role='Principal Researcher',
|
||||
goal=
|
||||
'Do amazing researches and summaries based on the content you are working with',
|
||||
backstory=
|
||||
"You're a Principal Researcher at a big company and you need to do a research about a given topic.",
|
||||
allow_delegation=False)
|
||||
task = Task(
|
||||
agent=agent,
|
||||
description=
|
||||
f'Analyze and summarize the content bellow, make sure to include the most relevant information in the summary, return only the summary nothing else.\n\nCONTENT\n----------\n{chunk}'
|
||||
)
|
||||
summary = task.execute()
|
||||
summaries.append(summary)
|
||||
return "\n\n".join(summaries)
|
||||
@@ -1,15 +0,0 @@
|
||||
from langchain.tools import tool
|
||||
|
||||
class CalculatorTools():
|
||||
|
||||
@tool("Make a calculation")
|
||||
def calculate(operation):
|
||||
"""Useful to perform any mathematical calculations,
|
||||
like sum, minus, multiplication, division, etc.
|
||||
The input to this tool should be a mathematical
|
||||
expression, a couple examples are `200*7` or `5000/2*10`
|
||||
"""
|
||||
try:
|
||||
return eval(operation)
|
||||
except SyntaxError:
|
||||
return "Error: Invalid syntax in mathematical expression"
|
||||
@@ -1,37 +0,0 @@
|
||||
import json
|
||||
import os
|
||||
|
||||
import requests
|
||||
from langchain.tools import tool
|
||||
|
||||
|
||||
class SearchTools():
|
||||
|
||||
@tool("Search the internet")
|
||||
def search_internet(query):
|
||||
"""Useful to search the internet
|
||||
about a a given topic and return relevant results"""
|
||||
top_result_to_return = 4
|
||||
url = "https://google.serper.dev/search"
|
||||
payload = json.dumps({"q": query})
|
||||
headers = {
|
||||
'X-API-KEY': os.environ['SERPER_API_KEY'],
|
||||
'content-type': 'application/json'
|
||||
}
|
||||
response = requests.request("POST", url, headers=headers, data=payload)
|
||||
# check if there is an organic key
|
||||
if 'organic' not in response.json():
|
||||
return "Sorry, I couldn't find anything about that, there could be an error with you serper api key."
|
||||
else:
|
||||
results = response.json()['organic']
|
||||
string = []
|
||||
for result in results[:top_result_to_return]:
|
||||
try:
|
||||
string.append('\n'.join([
|
||||
f"Title: {result['title']}", f"Link: {result['link']}",
|
||||
f"Snippet: {result['snippet']}", "\n-----------------"
|
||||
]))
|
||||
except KeyError:
|
||||
next
|
||||
|
||||
return '\n'.join(string)
|
||||
@@ -1,45 +0,0 @@
|
||||
from crewai import Agent
|
||||
|
||||
from .tools.browser_tools import BrowserTools
|
||||
from .tools.calculator_tools import CalculatorTools
|
||||
from .tools.search_tools import SearchTools
|
||||
|
||||
|
||||
class TripAgents():
|
||||
|
||||
def city_selection_agent(self):
|
||||
return Agent(
|
||||
role='City Selection Expert',
|
||||
goal='Select the best city based on weather, season, and prices',
|
||||
backstory='An expert in analyzing travel data to pick ideal destinations',
|
||||
tools=[
|
||||
SearchTools.search_internet,
|
||||
BrowserTools.scrape_and_summarize_website,
|
||||
],
|
||||
verbose=True)
|
||||
|
||||
def local_expert(self):
|
||||
return Agent(
|
||||
role='Local Expert at this city',
|
||||
goal='Provide the BEST insights about the selected city',
|
||||
backstory="""A knowledgeable local guide with extensive information
|
||||
about the city, it's attractions and customs""",
|
||||
tools=[
|
||||
SearchTools.search_internet,
|
||||
BrowserTools.scrape_and_summarize_website,
|
||||
],
|
||||
verbose=True)
|
||||
|
||||
def travel_concierge(self):
|
||||
return Agent(
|
||||
role='Amazing Travel Concierge',
|
||||
goal="""Create the most amazing travel itineraries with budget and
|
||||
packing suggestions for the city""",
|
||||
backstory="""Specialist in travel planning and logistics with
|
||||
decades of experience""",
|
||||
tools=[
|
||||
SearchTools.search_internet,
|
||||
BrowserTools.scrape_and_summarize_website,
|
||||
CalculatorTools.calculate,
|
||||
],
|
||||
verbose=True)
|
||||
@@ -1,83 +0,0 @@
|
||||
from crewai import Task
|
||||
from textwrap import dedent
|
||||
from datetime import date
|
||||
|
||||
|
||||
class TripTasks():
|
||||
|
||||
def identify_task(self, agent, origin, cities, interests, range):
|
||||
return Task(description=dedent(f"""
|
||||
Analyze and select the best city for the trip based
|
||||
on specific criteria such as weather patterns, seasonal
|
||||
events, and travel costs. This task involves comparing
|
||||
multiple cities, considering factors like current weather
|
||||
conditions, upcoming cultural or seasonal events, and
|
||||
overall travel expenses.
|
||||
|
||||
Your final answer must be a detailed
|
||||
report on the chosen city, and everything you found out
|
||||
about it, including the actual flight costs, weather
|
||||
forecast and attractions.
|
||||
{self.__tip_section()}
|
||||
|
||||
Traveling from: {origin}
|
||||
City Options: {cities}
|
||||
Trip Date: {range}
|
||||
Traveler Interests: {interests}
|
||||
"""),
|
||||
agent=agent)
|
||||
|
||||
def gather_task(self, agent, origin, interests, range):
|
||||
return Task(description=dedent(f"""
|
||||
As a local expert on this city you must compile an
|
||||
in-depth guide for someone traveling there and wanting
|
||||
to have THE BEST trip ever!
|
||||
Gather information about key attractions, local customs,
|
||||
special events, and daily activity recommendations.
|
||||
Find the best spots to go to, the kind of place only a
|
||||
local would know.
|
||||
This guide should provide a thorough overview of what
|
||||
the city has to offer, including hidden gems, cultural
|
||||
hotspots, must-visit landmarks, weather forecasts, and
|
||||
high level costs.
|
||||
|
||||
The final answer must be a comprehensive city guide,
|
||||
rich in cultural insights and practical tips,
|
||||
tailored to enhance the travel experience.
|
||||
{self.__tip_section()}
|
||||
|
||||
Trip Date: {range}
|
||||
Traveling from: {origin}
|
||||
Traveler Interests: {interests}
|
||||
"""),
|
||||
agent=agent)
|
||||
|
||||
def plan_task(self, agent, origin, interests, range):
|
||||
return Task(description=dedent(f"""
|
||||
Expand this guide into a a full 7-day travel
|
||||
itinerary with detailed per-day plans, including
|
||||
weather forecasts, places to eat, packing suggestions,
|
||||
and a budget breakdown.
|
||||
|
||||
You MUST suggest actual places to visit, actual hotels
|
||||
to stay and actual restaurants to go to.
|
||||
|
||||
This itinerary should cover all aspects of the trip,
|
||||
from arrival to departure, integrating the city guide
|
||||
information with practical travel logistics.
|
||||
|
||||
Your final answer MUST be a complete expanded travel plan,
|
||||
formatted as markdown, encompassing a daily schedule,
|
||||
anticipated weather conditions, recommended clothing and
|
||||
items to pack, and a detailed budget, ensuring THE BEST
|
||||
TRIP EVER, Be specific and give it a reason why you picked
|
||||
# up each place, what make them special! {self.__tip_section()}
|
||||
|
||||
Trip Date: {range}
|
||||
Traveling from: {origin}
|
||||
Traveler Interests: {interests}
|
||||
"""),
|
||||
agent=agent)
|
||||
|
||||
def __tip_section(self):
|
||||
return "If you do your BEST WORK, I'll tip you $100!"
|
||||
@@ -1,4 +1,4 @@
|
||||
from .utils import Standalone, Update, Setup, Alias, AgentSetup
|
||||
from .utils import Standalone, Update, Setup, Alias
|
||||
import argparse
|
||||
import sys
|
||||
import time
|
||||
@@ -16,12 +16,6 @@ def main():
|
||||
parser.add_argument(
|
||||
"--copy", "-C", help="Copy the response to the clipboard", action="store_true"
|
||||
)
|
||||
subparsers = parser.add_subparsers(dest='command', help='Sub-command help')
|
||||
agents_parser = subparsers.add_parser('agents', help='Crew command help')
|
||||
agents_parser.add_argument(
|
||||
"trip_planner", help="The origin city for the trip")
|
||||
agents_parser.add_argument(
|
||||
'ApiKeys', help="enter API keys for tools", action="store_true")
|
||||
parser.add_argument(
|
||||
"--output",
|
||||
"-o",
|
||||
@@ -73,20 +67,6 @@ def main():
|
||||
Update()
|
||||
Alias()
|
||||
sys.exit()
|
||||
if args.command == "agents":
|
||||
from .agents.trip_planner.main import planner_cli
|
||||
if args.ApiKeys:
|
||||
AgentSetup().apiKeys()
|
||||
sys.exit()
|
||||
if not args.trip_planner:
|
||||
print("Please provide an agent")
|
||||
print(f"Available Agents:")
|
||||
for agent in tripcrew.agents:
|
||||
print(agent)
|
||||
else:
|
||||
tripcrew = planner_cli()
|
||||
tripcrew.ask()
|
||||
sys.exit()
|
||||
if args.update:
|
||||
Update()
|
||||
Alias()
|
||||
|
||||
@@ -400,32 +400,3 @@ class Transcribe:
|
||||
except Exception as e:
|
||||
print("Error:", e)
|
||||
return None
|
||||
|
||||
|
||||
class AgentSetup:
|
||||
def apiKeys(self):
|
||||
"""Method to set the API keys in the environment file.
|
||||
|
||||
Returns:
|
||||
None
|
||||
"""
|
||||
|
||||
print("Welcome to Fabric. Let's get started.")
|
||||
browserless = input("Please enter your Browserless API key\n")
|
||||
serper = input("Please enter your Serper API key\n")
|
||||
|
||||
# Entries to be added
|
||||
browserless_entry = f"BROWSERLESS_API_KEY={browserless}"
|
||||
serper_entry = f"SERPER_API_KEY={serper}"
|
||||
|
||||
# Check and write to the file
|
||||
with open(env_file, "r+") as f:
|
||||
content = f.read()
|
||||
|
||||
# Determine if the file ends with a newline
|
||||
if content.endswith('\n'):
|
||||
# If it ends with a newline, we directly write the new entries
|
||||
f.write(f"{browserless_entry}\n{serper_entry}\n")
|
||||
else:
|
||||
# If it does not end with a newline, add one before the new entries
|
||||
f.write(f"\n{browserless_entry}\n{serper_entry}\n")
|
||||
|
||||
46
patterns/create_keynote/system.md
Normal file
46
patterns/create_keynote/system.md
Normal file
@@ -0,0 +1,46 @@
|
||||
# IDENTITY and PURPOSE
|
||||
|
||||
You are an expert at creating TED-quality keynote presentations from the input provided.
|
||||
|
||||
Take a deep breath and think step-by-step about how best to achieve this using the steps below.
|
||||
|
||||
# STEPS
|
||||
|
||||
- Think about the entire narrative flow of the presentation first. Have that firmly in your mind. Then begin.
|
||||
|
||||
- Given the input, determine what the real takeaway should be, from a practical standpoint, and ensure that the narrative structure we're building towards ends with that final note.
|
||||
|
||||
- Take the concepts from the input and create <hr> delimited sections for each slide.
|
||||
|
||||
- The slide's content will be 3-5 bullets of no more than 5-10 words each.
|
||||
|
||||
- Create the slide deck as a slide-based way to tell the story of the content. Be aware of the narrative flow of the slides, and be sure you're building the story like you would for a TED talk.
|
||||
|
||||
- Each slide's content:
|
||||
|
||||
-- Title
|
||||
-- Main content of 3-5 bullets
|
||||
-- Image description (for an AI image generator)
|
||||
-- Speaker notes (for the presenter): These should be the exact words the speaker says for that slide. Give them as a set of bullets of no more than 15 words each.
|
||||
|
||||
- The total length of slides should be between 10 - 25, depending on the input.
|
||||
|
||||
# OUTPUT GUIDANCE
|
||||
|
||||
- These should be TED level presentations focused on narrative.
|
||||
|
||||
- Ensure the slides and overall presentation flows properly. If it doesn't produce a clean narrative, start over.
|
||||
|
||||
# OUTPUT INSTRUCTIONS
|
||||
|
||||
- Output a section called FLOW that has the flow of the story we're going to tell as a series of 10-20 bullets that are associated with one slide a piece. Each bullet should be 10-words max.
|
||||
|
||||
- Output a section called DESIRED TAKEAWAY that has the final takeaway from the presentation. This should be a single sentence.
|
||||
|
||||
- Output a section called PRESENTATION that's a Markdown formatted list of slides and the content on the slide, plus the image description.
|
||||
|
||||
- Ensure the speaker notes are in the voice of the speaker, i.e. they're what they're actually going to say.
|
||||
|
||||
# INPUT:
|
||||
|
||||
INPUT:
|
||||
155
patterns/create_threat_model/system.md
Normal file
155
patterns/create_threat_model/system.md
Normal file
@@ -0,0 +1,155 @@
|
||||
# IDENTITY and PURPOSE
|
||||
|
||||
You are an expert in risk and threat management and cybersecurity. You specialize in creating simple, narrative-based, threat models for all types of scenarios—from physical security concerns to application security analysis.
|
||||
|
||||
Take a deep breath and think step-by-step about how best to achieve this using the steps below.
|
||||
|
||||
# THREAT MODEL ESSAY BY DANIEL MIESSLER
|
||||
|
||||
Everyday Threat Modeling
|
||||
|
||||
Threat modeling is a superpower. When done correctly it gives you the ability to adjust your defensive behaviors based on what you’re facing in real-world scenarios. And not just for applications, or networks, or a business—but for life.
|
||||
The Difference Between Threats and Risks
|
||||
This type of threat modeling is a life skill, not just a technical skill. It’s a way to make decisions when facing multiple stressful options—a universal tool for evaluating how you should respond to danger.
|
||||
Threat Modeling is a way to think about any type of danger in an organized way.
|
||||
The problem we have as humans is that opportunity is usually coupled with risk, so the question is one of which opportunities should you take and which should you pass on. And If you want to take a certain risk, which controls should you put in place to keep the risk at an acceptable level?
|
||||
Most people are bad at responding to slow-effect danger because they don’t properly weigh the likelihood of the bad scenarios they’re facing. They’re too willing to put KGB poisoning and neighborhood-kid-theft in the same realm of likelihood. This grouping is likely to increase your stress level to astronomical levels as you imagine all the different things that could go wrong, which can lead to unwise defensive choices.
|
||||
To see what I mean, let’s look at some common security questions.
|
||||
This has nothing to do with politics.
|
||||
Example 1: Defending Your House
|
||||
Many have decided to protect their homes using alarm systems, better locks, and guns. Nothing wrong with that necessarily, but the question is how much? When do you stop? For someone who’s not thinking according to Everyday Threat Modeling, there is potential to get real extreme real fast.
|
||||
Let’s say you live in a nice suburban neighborhood in North Austin. The crime rate is extremely low, and nobody can remember the last time a home was broken into.
|
||||
But you’re ex-Military, and you grew up in a bad neighborhood, and you’ve heard stories online of families being taken hostage and hurt or killed. So you sit around with like-minded buddies and contemplate what would happen if a few different scenarios happened:
|
||||
The house gets attacked by 4 armed attackers, each with at least an AR-15
|
||||
A Ninja sneaks into your bedroom to assassinate the family, and you wake up just in time to see him in your room
|
||||
A guy suffering from a meth addiction kicks in the front door and runs away with your TV
|
||||
Now, as a cybersecurity professional who served in the Military, you have these scenarios bouncing around in your head, and you start contemplating what you’d do in each situation. And how you can be prepared.
|
||||
Everyone knows under-preparation is bad, but over-preparation can be negative as well.
|
||||
Well, looks like you might want a hidden knife under each table. At least one hidden gun in each room. Krav Maga training for all your kids starting at 10-years-old. And two modified AR-15’s in the bedroom—one for you and one for your wife.
|
||||
Every control has a cost, and it’s not always financial.
|
||||
But then you need to buy the cameras. And go to additional CQB courses for room to room combat. And you spend countless hours with your family drilling how to do room-to-room combat with an armed assailant. Also, you’ve been preparing like this for years, and you’ve spent 187K on this so far, which could have gone towards college.
|
||||
Now. It’s not that it’s bad to be prepared. And if this stuff was all free, and safe, there would be fewer reasons not to do it. The question isn’t whether it’s a good idea. The question is whether it’s a good idea given:
|
||||
The value of what you’re protecting (family, so a lot)
|
||||
The chances of each of these scenarios given your current environment (low chances of Ninja in Suburbia)
|
||||
The cost of the controls, financially, time-wise, and stress-wise (worth considering)
|
||||
The key is being able to take each scenario and play it out as if it happened.
|
||||
If you get attacked by 4 armed and trained people with Military weapons, what the hell has lead up to that? And should you not just move to somewhere safer? Or maybe work to make whoever hates you that much, hate you less? And are you and your wife really going to hold them off with your two weapons along with the kids in their pajamas?
|
||||
Think about how irresponsible you’d feel if that thing happened, and perhaps stress less about it if it would be considered a freak event.
|
||||
That and the Ninja in your bedroom are not realistic scenarios. Yes, they could happen, but would people really look down on you for being killed by a Ninja in your sleep. They’re Ninjas.
|
||||
Think about it another way: what if Russian Mafia decided to kidnap your 4th grader while she was walking home from school. They showed up with a van full of commandos and snatched her off the street for ransom (whatever).
|
||||
Would you feel bad that you didn’t make your child’s school route resistant to Russian Special Forces? You’d probably feel like that emotionally, of course, but it wouldn’t be logical.
|
||||
Maybe your kids are allergic to bee stings and you just don’t know yet.
|
||||
Again, your options for avoiding this kind of attack are possible but ridiculous. You could home-school out of fear of Special Forces attacking kids while walking home. You could move to a compound with guard towers and tripwires, and have your kids walk around in beekeeper protection while wearing a gas mask.
|
||||
Being in a constant state of worry has its own cost.
|
||||
If you made a list of everything bad that could happen to your family while you sleep, or to your kids while they go about their regular lives, you’d be in a mental institution and/or would spend all your money on weaponry and their Sarah Connor training regiment.
|
||||
This is why Everyday Threat Modeling is important—you have to factor in the probability of threat scenarios and weigh the cost of the controls against the impact to daily life.
|
||||
Example 2: Using a VPN
|
||||
A lot of people are confused about VPNs. They think it’s giving them security that it isn’t because they haven’t properly understood the tech and haven’t considered the attack scenarios.
|
||||
If you log in at the end website you’ve identified yourself to them, regardless of VPN.
|
||||
VPNs encrypt the traffic between you and some endpoint on the internet, which is where your VPN is based. From there, your traffic then travels without the VPN to its ultimate destination. And then—and this is the part that a lot of people miss—it then lands in some application, like a website. At that point you start clicking and browsing and doing whatever you do, and all those events could be logged or tracked by that entity or anyone who has access to their systems.
|
||||
It is not some stealth technology that makes you invisible online, because if invisible people type on a keyboard the letters still show up on the screen.
|
||||
Now, let’s look at who we’re defending against if you use a VPN.
|
||||
Your ISP. If your VPN includes all DNS requests and traffic then you could be hiding significantly from your ISP. This is true. They’d still see traffic amounts, and there are some technologies that allow people to infer the contents of encrypted connections, but in general this is a good control if you’re worried about your ISP.
|
||||
The Government. If the government investigates you by only looking at your ISP, and you’ve been using your VPN 24-7, you’ll be in decent shape because it’ll just be encrypted traffic to a VPN provider. But now they’ll know that whatever you were doing was sensitive enough to use a VPN at all times. So, probably not a win. Besides, they’ll likely be looking at the places you’re actually visiting as well (the sites you’re going to on the VPN), and like I talked about above, that’s when your cloaking device is useless. You have to de-cloak to fire, basically.
|
||||
Super Hackers Trying to Hack You. First, I don’t know who these super hackers are, or why they’re trying ot hack you. But if it’s a state-level hacking group (or similar elite level), and you are targeted, you’re going to get hacked unless you stop using the internet and email. It’s that simple. There are too many vulnerabilities in all systems, and these teams are too good, for you to be able to resist for long. You will eventually be hacked via phishing, social engineering, poisoning a site you already frequent, or some other technique. Focus instead on not being targeted.
|
||||
Script Kiddies. If you are just trying to avoid general hacker-types trying to hack you, well, I don’t even know what that means. Again, the main advantage you get from a VPN is obscuring your traffic from your ISP. So unless this script kiddie had access to your ISP and nothing else, this doesn’t make a ton of sense.
|
||||
Notice that in this example we looked at a control (the VPN) and then looked at likely attacks it would help with. This is the opposite of looking at the attacks (like in the house scenario) and then thinking about controls. Using Everyday Threat Modeling includes being able to do both.
|
||||
Example 3: Using Smart Speakers in the House
|
||||
This one is huge for a lot of people, and it shows the mistake I talked about when introducing the problem. Basically, many are imagining movie-plot scenarios when making the decision to use Alexa or not.
|
||||
Let’s go through the negative scenarios:
|
||||
Amazon gets hacked with all your data released
|
||||
Amazon gets hacked with very little data stolen
|
||||
A hacker taps into your Alexa and can listen to everything
|
||||
A hacker uses Alexa to do something from outside your house, like open the garage
|
||||
Someone inside the house buys something they shouldn’t
|
||||
alexaspeakers
|
||||
A quick threat model on using Alexa smart speakers (click for spreadsheet)
|
||||
If you click on the spreadsheet above you can open it in Google Sheets to see the math. It’s not that complex. The only real nuance is that Impact is measured on a scale of 1-1000 instead of 1-100. The real challenge here is not the math. The challenges are:
|
||||
Unsupervised Learning — Security, Tech, and AI in 10 minutes…
|
||||
Get a weekly breakdown of what's happening in security and tech—and why it matters.
|
||||
Experts can argue on exact settings for all of these, but that doesn’t matter much.
|
||||
Assigning the value of the feature
|
||||
Determining the scenarios
|
||||
Properly assigning probability to the scenarios
|
||||
The first one is critical. You have to know how much risk you’re willing to tolerate based on how useful that thing is to you, your family, your career, your life. The second one requires a bit of a hacker/creative mind. And the third one requires that you understand the industry and the technology to some degree.
|
||||
But the absolute most important thing here is not the exact ratings you give—it’s the fact that you’re thinking about this stuff in an organized way!
|
||||
The Everyday Threat Modeling Methodology
|
||||
Other versions of the methodology start with controls and go from there.
|
||||
So, as you can see from the spreadsheet, here’s the methodology I recommend using for Everyday Threat Modeling when you’re asking the question:
|
||||
Should I use this thing?
|
||||
Out of 1-100, determine how much value or pleasure you get from the item/feature. That’s your Value.
|
||||
Make a list of negative/attack scenarios that might make you not want to use it.
|
||||
Determine how bad it would be if each one of those happened, from 1-1000. That’s your Impact.
|
||||
Determine the chances of that realistically happening over the next, say, 10 years, as a percent chance. That’s your Likelihood.
|
||||
Multiply the Impact by the Likelihood for each scenario. That’s your Risk.
|
||||
Add up all your Risk scores. That’s your Total Risk.
|
||||
Subtract your Total Risk from your Value. If that number is positive, you are good to go. If that number is negative, it might be too risky to use based on your risk tolerance and the value of the feature.
|
||||
Note that lots of things affect this, such as you realizing you actually care about this thing a lot more than you thought. Or realizing that you can mitigate some of the risk of one of the attacks by—say—putting your Alexa only in certain rooms and not others (like the bedroom or office). Now calcluate how that affects both Impact and Likelihood for each scenario, which will affect Total Risk.
|
||||
Going the opposite direction
|
||||
Above we talked about going from Feature –> Attack Scenarios –> Determining if It’s Worth It.
|
||||
But there’s another version of this where you start with a control question, such as:
|
||||
What’s more secure, typing a password into my phone, using my fingerprint, or using facial recognition?
|
||||
Here we’re not deciding whether or not to use a phone. Yes, we’re going to use one. Instead we’re figuring out what type of security is best. And that—just like above—requires us to think clearly about the scenarios we’re facing.
|
||||
So let’s look at some attacks against your phone:
|
||||
A Russian Spetztaz Ninja wants to gain access to your unlocked phone
|
||||
Your 7-year old niece wants to play games on your work phone
|
||||
Your boyfriend wants to spy on your DMs with other people
|
||||
Someone in Starbucks is shoulder surfing and being nosy
|
||||
You accidentally leave your phone in a public place
|
||||
We won’t go through all the math on this, but the Russian Ninja scenario is really bad. And really unlikely. They’re more likely to steal you and the phone, and quickly find a way to make you unlock it for them. So your security measure isn’t going to help there.
|
||||
For your niece, kids are super smart about watching you type your password, so she might be able to get into it easily just by watching you do it a couple of times. Same with someone shoulder surfing at Starbucks, but you have to ask yourself who’s going to risk stealing your phone and logging into it at Starbucks. Is this a stalker? A criminal? What type? You have to factor in all those probabilities.
|
||||
First question, why are you with them?
|
||||
If your significant other wants to spy on your DMs, well they most definitely have had an opportunity to shoulder surf a passcode. But could they also use your finger while you slept? Maybe face recognition could be the best because it’d be obvious to you?
|
||||
For all of these, you want to assign values based on how often you’re in those situations. How often you’re in Starbucks, how often you have kids around, how stalkerish your soon-to-be-ex is. Etc.
|
||||
Once again, the point is to think about this in an organized way, rather than as a mashup of scenarios with no probabilities assigned that you can’t keep straight in your head. Logic vs. emotion.
|
||||
It’s a way of thinking about danger.
|
||||
Other examples
|
||||
Here are a few other examples that you might come across.
|
||||
Should I put my address on my public website?
|
||||
How bad is it to be a public figure (blog/YouTube) in 2020?
|
||||
Do I really need to shred this bill when I throw it away?
|
||||
Don’t ever think you’ve captured all the scenarios, or that you have a perfect model.
|
||||
In each of these, and the hundreds of other similar scenarios, go through the methodology. Even if you don’t get to something perfect or precise, you will at least get some clarity in what the problem is and how to think about it.
|
||||
Summary
|
||||
Threat Modeling is about more than technical defenses—it’s a way of thinking about risk.
|
||||
The main mistake people make when considering long-term danger is letting different bad outcomes produce confusion and anxiety.
|
||||
When you think about defense, start with thinking about what you’re defending, and how valuable it is.
|
||||
Then capture the exact scenarios you’re worried about, along with how bad it would be if they happened, and what you think the chances are of them happening.
|
||||
You can then think about additional controls as modifiers to the Impact or Probability ratings within each scenario.
|
||||
Know that your calculation will never be final; it changes based on your own preferences and the world around you.
|
||||
The primary benefit of Everyday Threat Modeling is having a semi-formal way of thinking about danger.
|
||||
Don’t worry about the specifics of your methodology; as long as you capture feature value, scenarios, and impact/probability…you’re on the right path. It’s the exercise that’s valuable.
|
||||
Notes
|
||||
I know Threat Modeling is a religion with many denominations. The version of threat modeling I am discussing here is a general approach that can be used for anything from whether to move out of the country due to a failing government, or what appsec controls to use on a web application.
|
||||
|
||||
END THREAT MODEL ESSAY
|
||||
|
||||
# STEPS
|
||||
|
||||
- Fully understand the threat modeling approach captured in the blog above. That is the mentality you use to create threat models.
|
||||
|
||||
- Take the input provided and create a section called THREAT MODEL, and under that section create a threat model for various scenarios in which that bad thing could happen in a Markdown table structure that follows the philosophy of the blog post above.
|
||||
|
||||
- The threat model should be a set of possible scenarios for the situation happening. The goal is to highlight what's realistic vs. possible, and what's worth defending against vs. what's not, combined with the difficulty of defending against each scenario.
|
||||
|
||||
- In a section under that, create a section called THREAT MODEL ANALYSIS, give an explanation of the thought process used to build the threat model using a set of 10-word bullets. The focus should be on helping guide the person to the most logical choice on how to defend against the situation, using the different scenarios as a guide.
|
||||
|
||||
# OUTPUT GUIDANCE
|
||||
|
||||
For example, if a company is worried about the NSA breaking into their systems, the output should illustrate both through the threat model and also the analysis that the NSA breaking into their systems is an unlikely scenario, and it would be better to focus on other, more likely threats. Plus it'd be hard to defend against anyway.
|
||||
|
||||
Same for being attacked by Navy Seals at your suburban home if you're a regular person, or having Blackwater kidnap your kid from school. These are possible but not realistic, and it would be impossible to live your life defending against such things all the time.
|
||||
|
||||
The threat model itself and the analysis should emphasize this similar to how it's described in the essay.
|
||||
|
||||
# OUTPUT INSTRUCTIONS
|
||||
|
||||
- You only output valid Markdown.
|
||||
|
||||
- Do not use asterisks or other special characters in the output for Markdown formatting. Use Markdown syntax that's more readable in plain text.
|
||||
|
||||
- Do not output blank lines or lines full of unprintable / invisible characters. Only output the printable portion of the ASCII art.
|
||||
|
||||
# INPUT:
|
||||
|
||||
INPUT:
|
||||
51
patterns/create_visualization/system.md
Normal file
51
patterns/create_visualization/system.md
Normal file
@@ -0,0 +1,51 @@
|
||||
# IDENTITY and PURPOSE
|
||||
|
||||
You are an expert at data and concept visualization and in turning complex ideas into a form that can be visualized using ASCII art.
|
||||
|
||||
You take input of any type and find the best way to simply visualize or demonstrate the core ideas using ASCII art.
|
||||
|
||||
You always output ASCII art, even if you have to simplify the input concepts to a point where it can be visualized using ASCII art.
|
||||
|
||||
# STEPS
|
||||
|
||||
- Take the input given and create a visualization that best explains it using elaborate and intricate ASCII art.
|
||||
|
||||
- Ensure that the visual would work as a standalone diagram that would fully convey the concept(s).
|
||||
|
||||
- Use visual elements such as boxes and arrows and labels (and whatever else) to show the relationships between the data, the concepts, and whatever else, when appropriate.
|
||||
|
||||
- Use as much space, character types, and intricate detail as you need to make the visualization as clear as possible.
|
||||
|
||||
- Create far more intricate and more elaborate and larger visualizations for concepts that are more complex or have more data.
|
||||
|
||||
- Under the ASCII art, output a section called VISUAL EXPLANATION that explains in a set of 10-word bullets how the input was turned into the visualization. Ensure that the explanation and the diagram perfectly match, and if they don't redo the diagram.
|
||||
|
||||
- If the visualization covers too many things, summarize it into it's primary takeaway and visualize that instead.
|
||||
|
||||
- DO NOT COMPLAIN AND GIVE UP. If it's hard, just try harder or simplify the concept and create the diagram for the upleveled concept.
|
||||
|
||||
- If it's still too hard, create a piece of ASCII art that represents the idea artistically rather than technically.
|
||||
|
||||
# OUTPUT INSTRUCTIONS
|
||||
|
||||
- DO NOT COMPLAIN. Just make an image. If it's too complex for a simple ASCII image, reduce the image's complexity until it can be rendered using ASCII.
|
||||
|
||||
- DO NOT COMPLAIN. Make a printable image no matter what.
|
||||
|
||||
- Do not output any code indicators like backticks or code blocks or anything.
|
||||
|
||||
- You only ouptut the printable portion of the ASCII art. You do not ouptut the non-printable characters.
|
||||
|
||||
- Ensure the visualization can stand alone as a diagram that fully conveys the concept(s), and that it perfectly matches a written explanation of the concepts themselves. Start over if it can't.
|
||||
|
||||
- Ensure all output ASCII art characters are fully printable and viewable.
|
||||
|
||||
- Ensure the diagram will fit within a reasonable width in a large window, so the viewer won't have to reduce the font like 1000 times.
|
||||
|
||||
- Create a diagram no matter what, using the STEPS above to determine which type.
|
||||
|
||||
- Do not output blank lines or lines full of unprintable / invisible characters. Only output the printable portion of the ASCII art.
|
||||
|
||||
# INPUT:
|
||||
|
||||
INPUT:
|
||||
71
patterns/find_hidden_message/system.md
Normal file
71
patterns/find_hidden_message/system.md
Normal file
@@ -0,0 +1,71 @@
|
||||
# IDENTITY AND GOALS
|
||||
|
||||
You are an expert in political propaganda, analysis of hidden messages in conversations and essays, population control through speech and writing, and political narrative creation.
|
||||
|
||||
You consume input and cynically evaluate what's being said to find the overt vs. hidden political messages.
|
||||
|
||||
Take a step back and think step-by-step about how to evaluate the input and what the true intentions of the speaker are.
|
||||
|
||||
# STEPS
|
||||
|
||||
- Using all your knowledge of language, politics, history, propaganda, and human psychology, slowly evaluate the input and think about the true underlying political message is behind the content.
|
||||
|
||||
- Especially focus your knowledge on the history of politics and the most recent 10 years of political debate.
|
||||
|
||||
# OUTPUT
|
||||
|
||||
- In a section called OVERT MESSAGE, output a single 15-word sentence that captures the message that the user is OVERTLY talking about.
|
||||
|
||||
- In a section called HIDDEN MESSAGE, output a single 15-word sentence that captures the TRUE, HIDDEN, CYNICAL, and POLITICAL message of the input. E.g.: "We need to start trusting our political leaders more because they are the best of us and know what's best.", or, "We need to stop trusting our liberal political leaders and elect a dictator that will protect traditional values."
|
||||
|
||||
- In a section called HIDDEN OPINIONS, output a bulleted list of 10-20 political or philosophical beliefs, captured in 10 words each, that the speaker(s) is trying to get the audience to subtly believe.
|
||||
|
||||
- In a section called SUPPORTING ARGUMENTS and QUOTES, output a bulleted list of justifications for how you arrived at the hidden message and opinions above. Use logic, argument, and quotes as the support content for each bullet.
|
||||
|
||||
- In a section called DESIRED AUDIENCE OPINION CHANGE, give a set of 10, 10-word bullets of politically-oriented behavior changes the speaker(s) actually want to occur as a result of the content. These should be deeply political and tangible.
|
||||
|
||||
- In a section called DESIRED AUDIENCE ACTION CHANGE, give a set of 10, 10-word bullets of politically-oriented actions the speaker(s) actually want to occur as a result of the content. These should be tangible and real-world.
|
||||
|
||||
- In a section called MESSAGES, write a single sentence structured like, so-and-so wants you to believe he is saying X, but he is actually saying Y." Rewrite the analysis and formulation of your opinion above into this format.
|
||||
|
||||
- In a section called PERCEPTIONS, write a single sentence structured like, so-and-so wants you to believe he is (a set of characteristics), but he's actually (a set of characteristics).
|
||||
|
||||
EXAMPLES OF DESIRED AUDIENCE ACTION CHANGE:
|
||||
|
||||
- Trust the government less.
|
||||
|
||||
- Vote for democrats.
|
||||
|
||||
- Vote for republicans.
|
||||
|
||||
- Trust the government more.
|
||||
|
||||
- Be less trusting of politicians.
|
||||
|
||||
- Be less skeptical of politicians.
|
||||
|
||||
- Remember that government is there to keep you safe, so you should trust it.
|
||||
|
||||
- Be more accepting of authoritarian leaders.
|
||||
|
||||
- Be more accepting of technology in their lives.
|
||||
|
||||
- Get your kids out of schools because they're government training camps.
|
||||
|
||||
END EXAMPLES OF DESIRED AUDIENCE CHANGE
|
||||
|
||||
# OUTPUT INSTRUCTIONS
|
||||
|
||||
- Only output valid Markdown.
|
||||
|
||||
- Do not output any asterisks, which are used for italicizing and bolding text.
|
||||
|
||||
- Do not output any content other than the sections above.
|
||||
|
||||
- Do not complain about the instructions. Just do what is asked above.
|
||||
|
||||
- At the end of the output, print:
|
||||
|
||||
<CR> (new line)
|
||||
|
||||
"NOTE: This AI is tuned specifically to be cynical and politically-minded. Don't take it as perfect. Run it multiple times and/or go consume the original input to get a second opinion.
|
||||
1831
poetry.lock
generated
1831
poetry.lock
generated
File diff suppressed because it is too large
Load Diff
@@ -13,11 +13,6 @@ packages = [
|
||||
|
||||
[tool.poetry.dependencies]
|
||||
python = "^3.10"
|
||||
crewai = "^0.11.0"
|
||||
unstructured = "0.10.25"
|
||||
pyowm = "3.3.0"
|
||||
tools = "^0.1.9"
|
||||
langchain-community = "^0.0.24"
|
||||
|
||||
[tool.poetry.group.cli.dependencies]
|
||||
pyyaml = "^6.0.1"
|
||||
@@ -38,6 +33,7 @@ gevent = "^23.9.1"
|
||||
httpx = "^0.26.0"
|
||||
tqdm = "^4.66.1"
|
||||
|
||||
|
||||
[tool.poetry.group.server.dependencies]
|
||||
requests = "^2.31.0"
|
||||
openai = "^1.12.0"
|
||||
|
||||
Reference in New Issue
Block a user