Quick answers

No. A solution is a plain text file, one instruction per line. Lines that start with # are comments, and everything else is a name: value line. The authoring guide walks you from a one-step file to a full attack.

No. It replays one documented attack against one target. It does not crawl, discover, or sweep a network. It is a verified replay of a known technique, not a discovery tool.

Only systems you own or are authorized to test. The replica workflow applies: refine against a local replica first, then verify against an authorized target.

One line per step, then a result line. Each step line shows the step name, whether the test passed, and which test ran. There is no artifact file; the console output is the result.

So the file reads like a checklist, not markup. There is no syntax to remember, comments are allowed, and diffs stay clean. The format stays strict where it matters: the runtime validates required fields and hex at load time and refuses to run a bad file.

Steps that run commands or read files on your own machine, such as reading the flag file a lab writes. They run like any other step; the tool runs on your host.

Yes, through an LLM. The runtime itself takes a .txt file only, and that is the point: the file is exact, reviewable, and deterministic. Describe the attack in your own words, have an LLM draft the file, review it, then run it.

Yes. Start with the worked example, use the corpus as reference implementations, and verify each solution against a vulnerable replica before you contribute it.

Yes. The runtime is AGPLv3, and the solution corpus is Apache 2.0. The runtime is a portable binary downloaded from the releases page.