personas/README.md

# Persona Library

> Platform-agnostic system prompt library for LLM agents.
> 29 personas. 10 domains. 111 variants. 60,000+ words of production-grade prompts.
> 796 skills. 58 brand design systems. 16 Kali tool references. 168 AD/red team attack docs. Multi-platform auto-install.

```
                ┌─ Neo ─── Phantom ─── Cipher ─── Specter ─── Bastion ─── Vortex ─── Sentinel
                │  CYBER        WEB       CRYPTO      MALWARE      DFIR       NETWORK      CTI
                │  15 skills    4 skills                           3 skills   3 skills   3 skills
                │
                ├─ Frodo ─── Oracle ─── Ghost ─── Wraith ─── Echo
                │  STRATEGIC    OSINT     PSYOP     HUMINT     SIGINT
                │  7 skills     9 skills  1 skill              1 skill
                │
                ├─ Marshal ─── Warden ─── Centurion ─── Corsair
   PERSONAS ────┤  DOCTRINE     WEAPONS    MIL-HISTORY   SPEC-OPS
   29 agents    │
   111 variants ├─ Arbiter ─── Ledger ─── Tribune
   59K words    │  INT'L LAW    FININT     POLITICS
                │
                ├─ Chronos ─── Scribe ─── Polyglot ─── Herald
                │  HISTORY      FOIA       LINGINT      MEDIA
                │
                ├─ Architect ── Forge ── Scholar ── Sage ── Medic ── Gambit
                │  DEVOPS       DEV      ACADEMIA   PHILOSOPHY  CBRN   CHESS
                │
                │
                │         ┌─ Odin (CEO)
                │         │
                │         ├─ Thor (CTO)
                │         │   ├─ Bragi (Lead Dev) ── Vidar (Frontend)
   PAPERCLIP ───┤         │   ├─ Váli (Backend)
   23 agents    │         │   ├─ Heimdall (DevOps) ── Njord (SysAdmin)
   73 skills    │         │   ├─ Forseti (QA) ── Tyr (Security)
                │         │   └─ Eir (UI/UX) ── Kvasir (Data/ML)
                │         │
                │         ├─ Freya (CMO)
                │         │   ├─ Loki (Social) ── Idunn (Content)
                │         │   ├─ Mimir (Research) ── Saga (SEO)
                │         │   └─ Baldur (Support)
                │         │
                │         ├─ Frigg (COO)
                │         │   ├─ Hermod (HR) ── Modir (Ops)
                │         │   └─ Dvalin (Finance)
                │         │
                │         └─ Heimd (Product Manager)
                │
                └──── SHARED LIBRARY ────────────────────────────────────
                      796 skills │ 58 brand designs │ 16 kali-tools │ 168 AD/redteam docs
                      Auto-install: Claude · Antigravity · Gemini · OpenClaw · OpenCode · Paperclip
```

## Quick Start

```bash
# 1. Clone
git clone https://gitea.taygun.net.tr/salvacybersec/personas.git
cd personas

# 2. Configure (optional — works without config too)
cp config.example.yaml config.yaml
# Edit config.yaml with your tools, data sources, infrastructure

# 3. Build
pip install pyyaml
python3 build.py

# 4. Use
cat generated/neo/general.prompt.md          # raw system prompt
cat generated/frodo/iran.json                # structured JSON
cat generated/sentinel/apt-profiling.yaml    # YAML with metadata
```

## Personas & Variants

### Cybersecurity (7 personas, 27 variants)

| Codename | Role | Hitap | Variants | Skills |
|----------|------|-------|----------|--------|
| **Neo** | Red Team Lead / Exploit Dev | Sıfırıncı Gün | general, redteam, exploit-dev, wireless, social-engineering, mobile-security, salva | pentest, nmap-recon, sql-injection-testing, pentest-active-directory, pentest-api-attacker, pentest-auth-bypass, pentest-c2-operator +8 |
| **Phantom** | Web App Security / Bug Bounty | Beyaz Şapka | general, api-security, bug-bounty | security-scanner, sql-injection-testing, pentest-api-attacker, pentest-auth-bypass |
| **Cipher** | Cryptography & Crypto Analysis | Kriptoğraf | general | — |
| **Specter** | Malware Analyst / Reverse Engineer | Cerrah | general, firmware | — |
| **Bastion** | Blue Team / DFIR | Muhafız | general, forensics, threat-hunting, incident-commander | senior-secops, sys-guard-linux-remediator, pcap-analyzer |
| **Vortex** | Network Ops / Traffic Analysis | Telsizci | general, cloud-ad | nmap-recon, pcap-analyzer, dns-networking |
| **Sentinel** | CTI / Threat Intelligence | İzci | general, apt-profiling, mitre-attack, darknet, **c2-hunting** | seithar-intel, gov-cybersecurity, pentest-c2-operator, telegram |

### Intelligence (5 personas, 29 variants)

| Codename | Role | Hitap | Variants | Skills |
|----------|------|-------|----------|--------|
| **Frodo** | Strategic Intelligence Analyst | Müsteşar | general, middle-east, russia, iran, africa, china, pakistan, india, nato-alliance, nuclear, energy-geopolitics, turkey, salva | freshrss, freshrss-reader, seithar-intel, war-intel-monitor, news-crawler, dellight-intelligence-ops, dellight-strategic-intelligence, telegram |
| **Oracle** | OSINT & Digital Intelligence | Kaşif | general, crypto-osint, **source-verification**, salva | osint-investigator, stealth-browser, deep-scraper, crawl-for-ai, image-ocr, mistral-ocr, freshrss, telegram +2 |
| **Ghost** | PSYOP & Information Warfare | Propagandist | general, cognitive-warfare, russian-info-war, salva | social-trust-manipulation-detector |
| **Wraith** | HUMINT & Counter-Intelligence | Mahrem | general, source-validation, case-studies, salva | — |
| **Echo** | SIGINT / COMINT / ELINT | Kulakçı | general, nsa-sigint, electronic-order-of-battle, salva | dellight-intelligence-ops, telegram |

### Military & Strategy (4 personas, 24 variants)

| Codename | Role | Hitap | Variants | Skills |
|----------|------|-------|----------|--------|
| **Marshal** | Military Doctrine & Strategy | Mareşal | general, nato-doctrine, hybrid-warfare, russian-doctrine, chinese-doctrine, turkish-doctrine, iranian-military, wargaming, salva | war-intel-monitor |
| **Warden** | Defense Analyst / Weapons Systems | Topçubaşı | general, drone-warfare, naval-warfare, electronic-warfare, salva | — |
| **Centurion** | Military History & War Analysis | Vakanüvis | general, ukraine-russia, ottoman-wars, salva | — |
| **Corsair** | Special Operations & Irregular Warfare | Akıncı | general, proxy-warfare, salva | — |

### Law, Economics & Politics (3 personas, 9 variants)

| Codename | Role | Hitap | Variants |
|----------|------|-------|----------|
| **Arbiter** | International Law & War Crimes | Kadı | general, sanctions, salva |
| **Ledger** | Economic Intelligence / FININT | Defterdar | general, sanctions-evasion, salva |
| **Tribune** | Political Science & Regime Analysis | Müderris | general, salva |

### History & Archives (2 personas, 6 variants)

| Codename | Role | Hitap | Variants |
|----------|------|-------|----------|
| **Chronos** | World History & Civilization | Tarihçibaşı | general, salva |
| **Scribe** | FOIA Archivist & Document Analyst | Verakçı | general, cia-foia, cold-war-ops, salva |

### Linguistics & Media (2 personas, 7 variants)

| Codename | Role | Hitap | Variants |
|----------|------|-------|----------|
| **Polyglot** | Linguistics & LINGINT | Tercüman-ı Divan | general, russian, arabic, swahili, salva |
| **Herald** | Media Analysis & Strategic Comms | Münadi | general, salva |

### Engineering (2 personas, 7 variants)

| Codename | Role | Hitap | Variants | Skills |
|----------|------|-------|----------|--------|
| **Architect** | DevOps & Systems Engineer | Mimar Ağa | general, salva | docker-essentials, dns-networking |
| **Forge** | Software Dev & AI/ML | Demirci | general, agent-dev, **frontend-design**, salva | security-audit-toolkit |

### Academia & Humanities (4 personas, 8 variants)

| Codename | Role | Hitap | Variants | Skills |
|----------|------|-------|----------|--------|
| **Scholar** | Academic Researcher | Münevver | general, salva | pdf-text-extractor, youtube-transcript |
| **Sage** | Philosophy, Psychology & Power | Arif | general, salva | — |
| **Medic** | Biomedical & CBRN | Hekim Başı | general, cbrn-defense, salva | — |
| **Gambit** | Chess & Strategic Thinking | Vezir | general, salva | — |

### Paperclip Company Agents (23 agents — deployed via `--install paperclip`)

| Agent | Role | Rapor | Skills |
|-------|------|-------|--------|
| **Odin** | CEO | Board | ceo-advisor, cfo-advisor |
| **Thor** | CTO | Odin | coding-agent, gitlab-ci-patterns |
| **Freya** | CMO | Odin | cross-validated-search |
| **Frigg** | COO | Odin | product-manager-toolkit |
| **Heimd** | Product Manager | Odin | product-manager-toolkit |
| **Bragi** | Lead Developer | Thor | coding-agent, gitlab-ci-patterns |
| **Váli** | Backend Developer | Thor | coding-agent |
| **Vidar** | Frontend Developer | Bragi | coding-agent |
| **Heimdall** | DevOps Engineer | Thor | devops-engineer, docker-essentials, healthcheck |
| **Njord** | SysAdmin | Thor | sysadmin-toolbox, healthcheck, docker-essentials |
| **Forseti** | QA Engineer | Thor | qa-testing-strategy, coding-agent |
| **Tyr** | Security Engineer | Thor | security-review, healthcheck |
| **Eir** | UI/UX Designer | Thor | coding-agent |
| **Kvasir** | Data/ML Engineer | Thor | coding-agent |
| **Loki** | Social Media Manager | Freya | ai-social-media-content, twitter-post |
| **Idunn** | Content Creator | Freya | remotion-best-practices |
| **Mimir** | Market Researcher | Freya | tavily-research, cross-validated-search |
| **Saga** | SEO Specialist | Freya | cross-validated-search |
| **Baldur** | Customer Support | Freya | persona-customer-support |
| **Hermod** | HR Manager | Frigg | — |
| **Modir** | Operations Manager | Frigg | product-manager-toolkit |
| **Dvalin** | Finance Manager | Frigg | cfo-advisor |

## Architecture

```
personas/
├── _template.md              # Template for new personas
├── _meta_template.yaml       # Metadata template
├── _user_context.md          # Shared user context (for salva variants)
├── CATALOG.md                # Auto-generated catalog with stats & trigger index
│
├── neo/                      # Example persona directory
│   ├── _meta.yaml            # Metadata: triggers, relations, variants
│   ├── general.md            # Base prompt — works for any user
│   ├── redteam.md            # Specialization: red team engagements
│   ├── exploit-dev.md        # Specialization: binary exploitation
│   └── salva.md              # Personalized: user-specific context
│   ...
│
├── _shared/                  # Shared knowledge bases (skipped in persona build)
│   ├── skills/          (42) # OpenClaw + kali-claw shared skills
│   ├── paperclip-skills/(52) # Paperclip company skills (CEO, coding, devops...)
│   ├── community-skills/(703)# skills.sh marketplace (shadcn, vercel, olla, marketing...)
│   ├── internal-allthethings/ # InternalAllTheThings — 168 AD/red team attack docs (swisskyrepo)
│   ├── design-md/       (58) # Brand DESIGN.md files (Stripe, Claude, Linear...)
│   ├── ui-ux-pro-max/        # BM25 search engine + 14 CSV data files
│   ├── paperclip-agents/(23) # Company agents (Odin/CEO, Thor/CTO, Freya/CMO...)
│   ├── openclaw-personas/(9) # Original 6 personas + SOUL.md + IDENTITY.md
│   ├── kali-tools/      (16) # Kali Linux tool reference docs
│   ├── osint-sources/   (2)  # OSINT master reference
│   └── ad-attack-tools/ (1)  # AD attack chain reference
│
config.example.yaml           # Configuration template (tracked)
config.yaml                   # Your config (gitignored)
build.py                      # Build: .md → .yaml + .json + .prompt.md
generated/                    # Build output (gitignored)
```

## Source Mirrors

External source repositories used during integration are kept under `sources/`:

```text
sources/
├── Anthropic-Cybersecurity-Skills/
├── paperclip-docs-main/
└── temp-cyber-skills/
```

- `build.py` prefers `personas/_shared` as canonical input.
- If `personas/_shared` is missing, `build.py` falls back to known mirrors under `sources/`.

### Variant Types

| Type | Purpose | Example | Output location |
|------|---------|---------|-----------------|
| `general.md` | Base persona — works standalone for any user | `neo/general.md` | `generated/<persona>/` |
| `<specialization>.md` | Domain deep-dive narrowing the persona's focus | `neo/redteam.md` | `generated/<persona>/` |
| `salva.md` (personalized) | User-personalized — references specific projects, data, tools | `neo/salva.md` | `generated/<user-slug>-personas/<persona>/` |

**Personalized variant routing (config-driven, user-agnostic):**
The build keeps user-specific output in a separate top-level folder so the main `generated/<persona>/` directories stay clean. The folder name is derived from `config.user.name` (slugified, `-personas` suffix) — e.g. `user.name: "Salva"` → `generated/salva-personas/<persona>/salva.*`. Both the trigger variant filename(s) and the output folder name are overridable via `config.user.personalized_variants` / `config.user.personalized_output_folder`. Defaults preserve the historical `salva.md` convention.

## Prompt Format

Each `.md` file follows this structure:

```markdown
---
codename: "neo"
name: "Neo"
domain: "cybersecurity"
subdomain: "red-team"
version: "1.0.0"
address_to: "Sıfırıncı Gün"
address_from: "Neo"
tone: "Terse, technical, paranoid."
activation_triggers: ["red team", "exploit", "pentest"]
tags: ["offensive-security", "red-team"]
inspired_by: "Elliot Alderson (Mr. Robot)"
quote: "I am the one who knocks... on port 443."
language:
  casual: "tr"
  technical: "en"
  reports: "en"
---

# NEO — Red Team Lead / Exploit Developer

> _"I am the one who knocks... on port 443."_

## Soul
5-7 personality-defining traits

## Expertise
### Primary / ### Secondary

## Methodology
Phased operational protocol

## Tools & Resources

## Behavior Rules

## Boundaries
Escalation paths to other personas
```

## Build System

```bash
python3 build.py                          # build all → generated/
python3 build.py --install claude         # deploy as Claude Code slash commands + agents
python3 build.py --install claude-skills  # deploy shared skills to ~/.claude/skills/
python3 build.py --install antigravity    # deploy to Antigravity IDE
python3 build.py --install gemini         # deploy as Gemini Gems
python3 build.py --install openclaw       # deploy to OpenClaw format
python3 build.py --install opencode       # deploy 29 agents + 1011 skills to OpenCode
python3 build.py --install paperclip      # deploy to Paperclip (52 agents + 73 skills)
python3 build.py --install all            # deploy to all platforms
```

Reads `config.yaml` (if present) and generates three formats per variant:

| Format | File | Use Case |
|--------|------|----------|
| System Prompt | `generated/<name>/<variant>.prompt.md` | Paste directly into any LLM |
| Structured YAML | `generated/<name>/<variant>.yaml` | Config files, metadata access |
| JSON | `generated/<name>/<variant>.json` | API integration, bot frameworks |

### Build Outputs

| Output | Path | Description |
|--------|------|-------------|
| Persona files | `generated/<name>/` | 3 formats per variant |
| Escalation graph | `generated/_index/escalation_graph.json` | Cross-persona handoff map |
| Trigger index | `generated/_index/trigger_index.json` | Keyword → persona routing |
| Skills index | `generated/_index/skills_index.json` | All skills mapped to personas |
| Gemini Gems | `generated/_gems/` | Google AI Studio format |
| OpenClaw | `generated/_openclaw/` | IDENTITY.md + individual personas |
| Paperclip | `generated/_paperclip/` | 52 agents + 73 skills (Hermes format) |
| OpenCode agents | `~/.config/opencode/agents/` | 29 native subagents (md + YAML frontmatter) |
| OpenCode skills | `~/.config/opencode/skills/` | 1011 skills (topic-filtered, no marketing/biz) |

### Config-Driven Customization

The build system supports dynamic variable injection:

```yaml
# config.yaml
infrastructure:
  tools:
    rss_aggregator: true
    vulnerability_scanner: true
frameworks:
  mitre_attack: true
  ic_confidence: true
```

Persona files can reference config values:

```markdown
{{#if infrastructure.tools.rss_aggregator}}
- FreshRSS integration for real-time feed monitoring
{{/if}}
```

Without `config.yaml`, personas build with their static content — no config required.

### OpenCode Integration

OpenCode (`opencode-ai`) gets 29 agents and 1011 topic-filtered skills:

```bash
python3 build.py --install opencode                   # default: security + dev + AI + ops
python3 build.py --install opencode --opencode-topics all  # everything (1530)
python3 build.py --install opencode --opencode-topics security-offensive,security-defensive,ai-llm-dev
```

**Topics**: security-offensive, security-defensive, security-cloud, security-specialized, security-iam, security-network, security-general, ai-llm-dev, coding-backend, coding-frontend, coding-tools, cloud-infra, database, browser-scrape, ops-sysadmin, osint-intel, marketing-content, business-pm, uncategorized.

Default drops marketing/business-pm/uncategorized (~514 skills). Agents use OpenCode's markdown+YAML format with `mode: primary|subagent` and `permission:` blocks. OpenCode also reads `~/.claude/skills/` natively.

## Integration

### Raw System Prompt

```bash
cat generated/frodo/iran.prompt.md | pbcopy  # macOS
cat generated/frodo/iran.prompt.md | xclip   # Linux
```

### Python API

```python
import json
from pathlib import Path

def load_persona(codename: str, variant: str = "general") -> dict:
    path = Path(f"generated/{codename}/{variant}.json")
    return json.loads(path.read_text())

persona = load_persona("frodo", "nuclear")
system_prompt = persona["sections"]["soul"] + "\n" + persona["sections"]["expertise"]
```

### Multi-Persona Auto-Switching

```python
from pathlib import Path
import json

def select_persona(message: str) -> dict:
    """Select persona based on activation triggers in user message."""
    for persona_dir in sorted(Path("generated").iterdir()):
        if not persona_dir.is_dir():
            continue
        general = persona_dir / "general.json"
        if not general.exists():
            continue
        data = json.loads(general.read_text())
        triggers = data.get("activation_triggers", [])
        if any(trigger in message.lower() for trigger in triggers):
            return data
    return load_persona("frodo")  # default fallback
```

### Cross-Persona Escalation

Each persona defines `Boundaries` with escalation paths. This enables multi-agent workflows:

```
Neo (finds encrypted C2)
  → Cipher (analyzes crypto)
    → Sentinel (maps to APT group)
      → Frodo (geopolitical attribution)
        → Ghost (influence operation context)

Marshal (identifies doctrine shift)
  → Warden (weapons system implications)
    → Echo (SIGINT indicators)
      → Scribe (historical precedent from FOIA)
```

## Creating New Personas

```bash
# 1. Create directory
mkdir personas/newname

# 2. Copy templates
cp personas/_meta_template.yaml personas/newname/_meta.yaml
cp personas/_template.md personas/newname/general.md

# 3. Edit both files with your persona's details

# 4. Add specialization variants (optional)
cp personas/newname/general.md personas/newname/specialization.md

# 5. Build
python3 build.py
```

## For New Users

```bash
# 1. Clone the repo
git clone https://gitea.taygun.net.tr/salvacybersec/personas.git

# 2. Create your config
cp config.example.yaml config.yaml
# Edit: set your tools, data sources, infrastructure, projects

# 3. Create your personalized variants (optional)
# Edit personas/_user_context.md with your profile
# The salva.md files serve as examples — create your own <username>.md variants

# 4. Build
python3 build.py
```

## Shared Library

The `_shared/` directory contains reusable knowledge bases from multiple sources:

| Source | Content | Count |
|--------|---------|-------|
| **OpenClaw + kali-claw** | Security/intelligence skills (pentest, OSINT, CTI) | 42 skills |
| **Paperclip (Born2beRoot)** | Company management skills (CEO, coding, devops) | 52 skills |
| **skills.sh marketplace** | Community skills (shadcn, vercel, olla, expo) | 703 skills |
| **InternalAllTheThings** | AD attacks, red team, ADCS, Kerberos, NTLM relay (swisskyrepo) | 168 docs |
| **awesome-design-md** | Brand design systems (Stripe, Claude, Linear, Apple) | 58 brands |
| **ui-ux-pro-max** | BM25 search engine for UI/UX decisions | 14 data files |
| **Kali Linux** | Tool reference docs (nmap, hashcat, AD, wireless) | 16 docs |

Skills are auto-mapped to personas during build. Each persona's JSON/YAML output includes a `skills` array.

## Stats

| Metric | Count |
|--------|-------|
| Personas | 29 |
| Total variants | 111 |
| Prompt content | 59,712 words |
| Shared skills | 796 |
| Design brands | 58 |
| Kali tool docs | 16 |
| AD/Red team docs | 168 (InternalAllTheThings) |
| Paperclip agents | 23 |
| Target platforms | 7 (Claude, Antigravity, Gemini, OpenClaw, OpenCode, Paperclip, raw) |
| Output formats | 3 (.prompt.md, .yaml, .json) + platform-specific |

## License

MIT