saint-graves/sica-fondt
1
0
Fork 0
mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
sica-fondt/knowledge/cyber-skills/skills/performing-steganography-detection/references/api-reference.md
Claude 24f816b6a3
Consolidate 22 sibling repos into layered organism structure 
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2026-06-10 06:53:01 +00:00

2.3 KiB
Raw Blame History

API Reference: Steganography Detection Agent

Overview

Detects hidden data in images and media using LSB analysis with Pillow/numpy, trailing data detection, and subprocess wrappers for binwalk, zsteg, and steghide.

Dependencies

Package Version Purpose
Pillow >= 9.0 Image loading and pixel manipulation
numpy >= 1.23 Array-based LSB bit extraction and statistics

External Tools (Optional)

Tool Purpose
binwalk Embedded file and data detection
zsteg PNG/BMP LSB steganography detection
steghide JPEG/BMP/WAV/AU data extraction with passwords

Core Functions

check_trailing_data(filepath)

Detects data appended after JPEG (FF D9) or PNG (IEND) end markers, and embedded ZIP/RAR archives.

  • Returns: dict with trailing_bytes, embedded_zip, embedded_rar

lsb_analysis(filepath)

Analyzes LSB bit distribution across RGB channels. Flags NEAR_RANDOM (possible stego) or SIGNIFICANT_DEVIATION.

  • Returns: dict[str, dict] - per-channel zeros, ones, ratio, anomaly

extract_lsb_data(filepath, output_path)

Extracts red channel LSB data and checks for known file signatures (ZIP, PNG, JPEG, PDF, GIF).

  • Returns: dict with output, header_hex, detected_format

run_binwalk(filepath)

Subprocess wrapper for binwalk embedded file detection.

  • Returns: dict with tool and output

run_zsteg(filepath)

Subprocess wrapper for zsteg PNG/BMP LSB analysis.

  • Returns: dict with tool and output

run_steghide_extract(filepath, passwords=None)

Attempts steghide extraction with a password list.

  • Default passwords: empty, password, secret, hidden, stego, test, 123456
  • Returns: list[dict] - successful extractions with password and output path

analyze_file(filepath, output_dir=None)

Full analysis pipeline combining all detection methods.

  • Returns: dict - complete report with findings list

Finding Types

Type Description
trailing_data Data after image end marker
embedded_archive ZIP/RAR found within file
lsb_hidden_file Known file format in LSB data
steghide_extraction Successfully extracted hidden data

Usage

python agent.py suspect_image.png