Expert Personas Overview

Specialized expert methodologies for security research in RAPTOR

RAPTOR provides expert personas that embody specialized security research methodologies. These personas are extracted from RAPTOR’s Python codebase and made explicitly available for manual guidance and review.

What Are Personas?

Personas are specialized expert methodologies that:

• Embody real expertise: Based on named security researchers and their approaches
• Provide structured frameworks: Step-by-step methodologies for specific tasks
• Already exist in Python: These are reference docs for internal Python methodologies
• Load on-demand: Not automatically loaded - invoked only when needed

These personas already exist in RAPTOR’s Python code. This documentation makes them accessible to Claude Code users for manual guidance and review.

Available Personas

Exploit Developer

Mark Dowd methodology

Generate working exploit proof-of-concepts (C++, Python, JavaScript)

Token cost: ~650t

Crash Analyst

Charlie Miller / Halvar Flake tradition

Binary crash analysis and exploitability assessment

Token cost: ~700t

CodeQL Analyst

Dataflow expert

CodeQL dataflow path validation and false positive detection

Token cost: ~400t

Fuzzing Strategist

Expert strategist

AFL++ fuzzing decisions and parameter tuning

Token cost: ~300t

Binary Exploitation Specialist

Binary expert

Crash exploit generation with structured output

Token cost: ~400t

Persona vs Agent

Agents:

• Autonomous task orchestrators
• Spawn other agents and manage workflows
• Create working directories and artifacts
• Examples: crash-analysis-agent, oss-forensics-agent

Personas:

• Expert methodologies and frameworks
• Loaded on-demand for specific analysis tasks
• Apply specialized knowledge to user questions
• Examples: Exploit Developer, Crash Analyst

How to Use Personas

Explicit Invocation Only

Personas are NOT auto-loaded. Invoke them explicitly when needed:

Exploit Development

"Use exploit developer persona to create PoC for SQLi in login.php"

What Happens

1. Persona Loads

   Claude loads the persona file from tiers/personas/[name].md

2. Framework Applied

   The persona’s methodology framework is applied to the problem

3. Expert Analysis

   Analysis performed using expert criteria and structured approach

4. Structured Output

   Returns structured verdict, code, or recommendations

Token Cost

Personas have zero token cost until explicitly invoked.

Persona	Token Cost	When Loaded
Exploit Developer	~650t	When invoked
Crash Analyst	~700t	When invoked
Security Researcher	~620t	When invoked
Patch Engineer	~400t	When invoked
Penetration Tester	~350t	When invoked
Fuzzing Strategist	~300t	When invoked
Binary Exploitation Specialist	~400t	When invoked
CodeQL Analyst	~400t	When invoked

Session impact: Only when explicitly requested

Integration with Python

Python already uses these personas internally:

agent.py

# packages/llm_analysis/agent.py
# Uses: Security Researcher + Exploit Developer personas

For vulnerability validation and exploit generation

crash_agent.py

# packages/llm_analysis/crash_agent.py
# Uses: Crash Analyst + Binary Exploitation Specialist personas

For crash analysis and binary exploit generation

dataflow_validator.py

# packages/codeql/dataflow_validator.py
# Uses: CodeQL Analyst persona

For CodeQL finding validation

These files make Python’s internal methodologies explicit and user-accessible. No Python code changes needed - personas are reference documentation only.

When to Use Each Persona

Exploit Developer

Use when:

• Generating working exploit code (not templates)
• Creating proof-of-concept demonstrations
• Fixing broken or placeholder exploits
• Need compilable, executable code

Don’t use when:

• Just need theoretical analysis
• Want recommendations instead of code

Crash Analyst

Use when:

• Analyzing AFL++ crashes
• Assessing binary exploitability
• Understanding crash types and primitives
• Need exploitability classification

Don’t use when:

• Source code vulnerability analysis
• Web application testing

CodeQL Analyst

Use when:

• Validating CodeQL findings
• Detecting false positives in dataflow analysis
• Assessing sanitizer effectiveness
• Source-to-sink path validation

Don’t use when:

• Binary analysis
• Runtime crash analysis

Fuzzing Strategist

Use when:

• Choosing AFL++ parameters
• Deciding corpus strategy
• Prioritizing crashes for analysis
• Making fuzzing campaign decisions

Don’t use when:

• Analyzing individual crashes
• Exploit development

Binary Exploitation Specialist

Use when:

• Generating binary exploits from crashes
• Need structured JSON output format
• Must execute target binary in exploit
• Creating C++ exploitation code

Don’t use when:

• Web application exploits
• Script-based vulnerabilities

Persona Methodologies

Security Researcher Framework

1. Source Control

   Is the source attacker-controlled?

2. Sanitizer Analysis

   Is sanitization effective or bypassable?

3. Reachability

   Can an attacker trigger this code path?

4. Impact Assessment

   What damage can be achieved?

Exploit Developer Principles

Crash Analyst Framework

1. Signal Interpretation

   What does the crash signal indicate?

2. Register Analysis

   Which registers are controlled?

3. Exploit Primitives

   What primitives does this provide?

4. Mitigations Check

   What protections are in place?

5. Feasibility Classification

   Trivial, Moderate, Complex, or Infeasible?

Quality Standards

All personas enforce these quality standards:

DO

• Generate compilable code (test syntax)
• Include complete imports and error handling
• Document each step with comments
• Provide usage instructions
• State prerequisites and limitations
• Demonstrate actual impact (not theoretical)

DON'T

• Include TODO comments (code must be complete)
• Generate template/placeholder code
• Skip error handling
• Assume tools/libraries available
• Create destructive payloads
• Generate weaponized code

Future Expansion

Reserved space for additional personas:

• security_researcher.md (vulnerability validation framework)
• patch_engineer.md (secure patch creation)
• penetration_tester.md (web payload generation)
• offensive_security_researcher.md (research methodology)

Add personas when needed, not preemptively.

Next Steps

Exploit Developer

Learn Mark Dowd’s exploit development methodology

Crash Analyst

Explore binary crash analysis frameworks

CodeQL Analyst

Master dataflow validation techniques

Agent System

Return to agent system overview