command-vault-mcp 0.8.0__tar.gz

command_vault_mcp-0.8.0/.analyze/P1-implementation.md

@@ -0,0 +1,108 @@
+# P1: Index Writeup Prose as Searchable Chunks
+
+## Context
+
+Currently command-vault-mcp only indexes **commands** and **scripts** from writeups. The rich prose — methodology explanations, attack chain reasoning, forensic analysis — is discarded during parsing. This is ~307K words of invisible knowledge. P1 stores prose paragraphs as chunks with FTS5 search, making concepts like "ADCS misconfiguration ESC8" or "NTLM relay to LDAP" searchable.
+
+## Changes
+
+### 1. Schema — `database.py`
+
+Add to `SCHEMA` string:
+```sql
+CREATE TABLE IF NOT EXISTS writeup_chunks (
+    id INTEGER PRIMARY KEY,
+    writeup_id INTEGER NOT NULL,
+    section TEXT,
+    content TEXT NOT NULL,
+    chunk_index INTEGER NOT NULL,
+    FOREIGN KEY (writeup_id) REFERENCES writeups(id)
+);
+CREATE INDEX IF NOT EXISTS idx_chunks_writeup ON writeup_chunks(writeup_id);
+```
+
+Add to `FTS_SCHEMA` string:
+```sql
+CREATE VIRTUAL TABLE IF NOT EXISTS writeup_chunks_fts USING fts5(
+    content, section,
+    content='writeup_chunks', content_rowid='id'
+);
+-- Sync triggers (INSERT/DELETE/UPDATE pattern matching existing ones)
+```
+
+### 2. Database methods — `database.py`
+
+- `insert_chunk(writeup_id, section, content, chunk_index)` — insert a single chunk
+- `clear_writeup_chunks(writeup_id)` — delete chunks for re-indexing (called from `clear_writeup_data`)
+- `search_chunks(query, writeup_type, limit)` — FTS search returning chunk + writeup metadata
+- Update `clear_writeup_data()` to also delete from `writeup_chunks`
+- Update `reset()` to drop `writeup_chunks_fts` table and its triggers
+- Update `get_stats()` to include chunk count
+
+### 3. Prose extraction — `parser.py`
+
+Add `extract_prose_chunks(content) -> list[dict]` method to `WriteupParser`:
+- Walk the content line by line
+- Track current section (H2/H3 headings)
+- Skip: code blocks (```...```), image embeds (![[...]]), the Tags: line, blank lines
+- Collect consecutive prose lines into paragraphs
+- Skip paragraphs shorter than ~30 chars (noise like "Let's check:" or single words)
+- Return `[{section, content, chunk_index}]`
+
+### 4. Return chunks from parser — `parser.py`
+
+- `parse_file()` currently returns `(Writeup, commands, scripts)` — change to also extract and return chunks
+- Return type becomes `(Writeup, commands, scripts, chunks)` where chunks is a list of dicts
+
+### 5. Indexer — `indexer.py`
+
+- Update `index_file()` to receive chunks from parser and call `db.insert_chunk()` for each
+- Update `clear_writeup_data` call path to also clear chunks
+- Add `chunks_extracted` counter to `IndexResult` tracking
+
+### 6. Model — `models.py`
+
+- Add `ChunkResult` pydantic model: `id, section, content, source (dict with filename, writeup_type, title)`
+- Add `chunks_extracted` field to `IndexResult` (default 0 for backward compat)
+
+### 7. MCP tool — `server.py`
+
+- Add `search_writeup_prose` tool in `list_tools()` with params: `query` (required), `writeup_type`, `tags`, `limit`
+- Add dispatch in `call_tool()`
+- Implement in `VaultTools`
+
+### 8. CLI — `cli.py`
+
+- Add `prose` subcommand: `vault prose "NTLM relay"` — searches writeup chunks
+- Display format:
+  ```
+  ============================================================
+  Source: Authority.md [389/tcp - LDAP]
+
+    <prose content, truncated to ~300 chars>
+  ```
+
+### 9. Tests
+
+- Test `extract_prose_chunks()` with sample markdown
+- Test chunk insertion and FTS search
+- Test that chunks are cleared on re-index
+
+## Files to modify
+
+1. `src/command_vault/database.py` — schema, CRUD, search, reset, stats
+2. `src/command_vault/parser.py` — `extract_prose_chunks()`, update `parse_file()` return
+3. `src/command_vault/indexer.py` — wire chunks through indexing pipeline
+4. `src/command_vault/models.py` — `ChunkResult`, update `IndexResult`
+5. `src/command_vault/server.py` — new MCP tool
+6. `src/command_vault/cli.py` — new `prose` subcommand
+7. `tests/test_parser.py` — prose extraction tests
+
+## Verification
+
+1. `uv run python -m pytest tests/ -q` — all tests pass
+2. `vault index --rebuild` — reindex all writeups (required for chunks)
+3. `vault stats` — shows chunk count
+4. `vault prose "NTLM relay"` — returns relevant prose from writeups
+5. `vault prose "ADCS ESC8"` — returns AD CS methodology text
+6. MCP `search_writeup_prose` tool returns results

command_vault_mcp-0.8.0/.analyze/analyze_boxes.py

@@ -0,0 +1,215 @@
+#!/usr/bin/env python3
+"""Comprehensive box writeup analysis"""
+import os, re, statistics
+from pathlib import Path
+from collections import defaultdict, Counter
+
+BOXES_DIR = Path.home() / "writeups" / "boxes"
+
+TECHNIQUES = {
+    "AD": ["Kerberoasting", "AS-REP", "DCSync", "Pass-the-Hash", "Pass-the-Ticket", "Silver Ticket",
+           "Golden Ticket", "ADCS", "ESC1", "ESC2", "ESC3", "ESC4", "ESC5", "ESC6", "ESC7", "ESC8",
+           "ESC9", "ESC10", "Shadow Credentials", "Constrained Delegation", "Unconstrained Delegation",
+           "RBCD", "GenericWrite", "WriteDacl", "WriteOwner", "AddMember", "ForceChangePassword",
+           "BloodHound", "DACL", "ACL", "GPO", "LAPS", "gMSA", "DPAPI", "Certipy", "NTLM relay",
+           "PetitPotam", "Coercion"],
+    "Web": ["CVE", "exploit", "vulnerability", "LFI", "RFI", "SSRF", "SQLi", "SQL injection", "XSS",
+            "SSTI", "RCE", "deserialization", "upload", "IDOR", "JWT", "cookie", "XXE", "CRLF",
+            "Prototype Pollution", "Command Injection", "Path Traversal", "GraphQL", "OAuth", "CORS"],
+    "Linux privesc": ["SUID", "sudo", "cron", "capabilities", "docker", "container escape",
+                      "kernel exploit", "path hijack", "LD_PRELOAD", "NFS", "wildcard", "polkit"],
+    "Windows privesc": ["token", "impersonation", "SeImpersonate", "JuicyPotato", "PrintSpoofer",
+                        "GodPotato", "service", "AlwaysInstallElevated", "DLL hijack", "UAC bypass"],
+    "Pivoting": ["chisel", "ligolo", "sshuttle", "proxychains", "tunnel", "port forward", "pivot"],
+    "Credentials": ["hashcat", "john", "hydra", "credential", "password spray", "brute force",
+                    "NTLM", "Kerberos", "relay"]
+}
+
+TOOL_NAMES = ["nmap", "rustscan", "ffuf", "feroxbuster", "gobuster", "dirsearch", "nikto", "wpscan",
+              "sqlmap", "burp", "nuclei", "httpx", "curl", "wget", "bloodhound", "certipy", "rubeus",
+              "mimikatz", "impacket", "secretsdump", "smbclient", "smbmap", "crackmapexec", "netexec",
+              "nxc", "evil-winrm", "psexec", "wmiexec", "chisel", "ligolo", "proxychains", "hashcat",
+              "john", "hydra", "linpeas", "winpeas", "pspy", "seatbelt", "ghidra", "ida", "gdb",
+              "frida", "metasploit", "msfvenom", "responder", "ntlmrelayx"]
+
+def analyze_file(filepath):
+    content = filepath.read_text(encoding='utf-8', errors='ignore')
+    lines = content.split('\n')
+    total = len(lines)
+
+    # Headers
+    headers = Counter()
+    sections = []
+    for line in lines:
+        m = re.match(r'^(#{1,4})\s+(.+)$', line)
+        if m:
+            headers[len(m.group(1))] += 1
+            sections.append(m.group(2).strip().lower())
+
+    # Code blocks & prose
+    in_code = False
+    code_lines = 0
+    code_blocks = 0
+    code_langs = Counter()
+    for line in lines:
+        if line.strip().startswith('```'):
+            if not in_code:
+                code_blocks += 1
+                lang = re.match(r'^```(\w+)', line.strip())
+                code_langs[lang.group(1) if lang else 'plain'] += 1
+            in_code = not in_code
+        elif in_code:
+            code_lines += 1
+
+    prose_lines = total - code_lines
+    prose_ratio = prose_lines / total if total > 0 else 0
+
+    # Images
+    images = len(re.findall(r'!\[\[.*?\]\]', content))
+
+    # Tags
+    tags = re.findall(r'#(\w+)', '\n'.join(lines[:10]))
+    tags = [t.lower() for t in tags]
+
+    # Tables (credential tables)
+    tables = sum(1 for line in lines if '|' in line and not line.strip().startswith('```'))
+
+    # Technique keywords in full content
+    content_lower = content.lower()
+    tech_hits = {}
+    for cat, keywords in TECHNIQUES.items():
+        hits = 0
+        for kw in keywords:
+            hits += len(re.findall(r'\b' + re.escape(kw.lower()) + r'\b', content_lower))
+        if hits > 0:
+            tech_hits[cat] = hits
+
+    # Tool mentions in prose (outside code blocks)
+    prose_content = re.sub(r'```.*?```', '', content, flags=re.DOTALL).lower()
+    tool_hits = Counter()
+    for tool in TOOL_NAMES:
+        count = len(re.findall(r'\b' + re.escape(tool.lower()) + r'\b', prose_content))
+        if count > 0:
+            tool_hits[tool] = count
+
+    # Word count
+    words = len(re.sub(r'```.*?```', '', content, flags=re.DOTALL).split())
+
+    return {
+        'name': filepath.name, 'total': total, 'prose_lines': prose_lines,
+        'code_lines': code_lines, 'prose_ratio': prose_ratio, 'headers': headers,
+        'sections': sections, 'code_blocks': code_blocks, 'code_langs': code_langs,
+        'images': images, 'tags': tags, 'tables': tables, 'tech_hits': tech_hits,
+        'tool_hits': tool_hits, 'words': words
+    }
+
+def main():
+    files = list(BOXES_DIR.glob("*.md"))
+    print(f"Analyzing {len(files)} box writeups...\n")
+    results = [analyze_file(f) for f in sorted(files)]
+
+    print("=" * 80)
+    print("BOX WRITEUP ANALYSIS")
+    print("=" * 80)
+
+    # 1. Structure
+    print("\n--- STRUCTURE ---")
+    totals = sum(r['total'] for r in results)
+    print(f"Total lines: {totals:,}")
+    print(f"Avg lines/writeup: {totals/len(results):.1f}")
+    print(f"Min: {min(r['total'] for r in results)}, Max: {max(r['total'] for r in results)}")
+    print(f"Median: {statistics.median(r['total'] for r in results):.0f}")
+
+    print(f"\nHeaders: H1={sum(r['headers'][1] for r in results)}, H2={sum(r['headers'][2] for r in results)}, "
+          f"H3={sum(r['headers'][3] for r in results)}, H4={sum(r['headers'][4] for r in results)}")
+
+    all_sections = Counter()
+    for r in results:
+        all_sections.update(r['sections'])
+    print("\nTop 20 section names:")
+    for name, count in all_sections.most_common(20):
+        print(f"  {count:3d}x {name}")
+
+    print(f"\nTotal code blocks: {sum(r['code_blocks'] for r in results)}")
+    print(f"Avg code blocks/writeup: {sum(r['code_blocks'] for r in results)/len(results):.1f}")
+    print(f"Total images: {sum(r['images'] for r in results)}")
+    print(f"Avg images/writeup: {sum(r['images'] for r in results)/len(results):.1f}")
+    print(f"Writeups with images: {sum(1 for r in results if r['images'] > 0)}")
+    print(f"Total table lines: {sum(r['tables'] for r in results)}")
+
+    # 2. Prose ratio
+    print("\n--- PROSE RATIO ---")
+    avg_pr = statistics.mean(r['prose_ratio'] for r in results)
+    print(f"Average prose ratio: {avg_pr*100:.1f}%")
+    print(f"Median prose ratio: {statistics.median(r['prose_ratio'] for r in results)*100:.1f}%")
+    bins = [(0, 0.2, "<20%"), (0.2, 0.4, "20-40%"), (0.4, 0.6, "40-60%"), (0.6, 1.01, ">60%")]
+    for lo, hi, label in bins:
+        n = sum(1 for r in results if lo <= r['prose_ratio'] < hi)
+        print(f"  {label}: {n} ({n/len(results)*100:.1f}%)")
+
+    # 3. Tags
+    print("\n--- TAGS ---")
+    all_tags = Counter()
+    tagged = 0
+    for r in results:
+        if r['tags']:
+            tagged += 1
+            all_tags.update(r['tags'])
+    print(f"Writeups with tags: {tagged}/{len(results)} ({tagged/len(results)*100:.1f}%)")
+    print(f"Unique tags: {len(all_tags)}")
+    print("\nTop 30 tags:")
+    for tag, count in all_tags.most_common(30):
+        print(f"  {count:3d}x #{tag}")
+
+    # 4. Technique mentions
+    print("\n--- TECHNIQUE MENTIONS ---")
+    for cat in TECHNIQUES:
+        total_mentions = sum(r['tech_hits'].get(cat, 0) for r in results)
+        writeups_with = sum(1 for r in results if cat in r['tech_hits'])
+        print(f"  {cat:20s}: {total_mentions:5d} mentions across {writeups_with:3d} writeups")
+
+    # 5. Tool mentions in prose
+    print("\n--- TOOL MENTIONS IN PROSE ---")
+    all_tools = Counter()
+    for r in results:
+        all_tools.update(r['tool_hits'])
+    print("Top 30 tools mentioned in prose:")
+    for tool, count in all_tools.most_common(30):
+        print(f"  {tool:20s}: {count:4d}")
+
+    # 6. Code languages
+    print("\n--- CODE BLOCK LANGUAGES ---")
+    all_langs = Counter()
+    for r in results:
+        all_langs.update(r['code_langs'])
+    for lang, count in all_langs.most_common(15):
+        print(f"  {lang:15s}: {count:4d} blocks")
+
+    # 7. Word count
+    total_words = sum(r['words'] for r in results)
+    print(f"\n--- WORD COUNT ---")
+    print(f"Total prose words: {total_words:,}")
+    print(f"Avg words/writeup: {total_words/len(results):.0f}")
+
+    # 8. Length distribution
+    print("\n--- LENGTH DISTRIBUTION ---")
+    for lo, hi, label in [(0,50,"<50"), (50,100,"50-100"), (100,200,"100-200"),
+                           (200,400,"200-400"), (400,800,"400-800"), (800,9999,">800")]:
+        n = sum(1 for r in results if lo <= r['total'] < hi)
+        bar = "█" * (n // 3)
+        print(f"  {label:>8s}: {n:3d} {bar}")
+
+    # Longest
+    by_len = sorted(results, key=lambda r: r['total'], reverse=True)
+    print("\n5 longest:")
+    for r in by_len[:5]:
+        print(f"  {r['total']:5d} lines - {r['name']}")
+    print("5 shortest:")
+    for r in by_len[-5:]:
+        print(f"  {r['total']:5d} lines - {r['name']}")
+
+    print("\n" + "=" * 80)
+    print("DONE")
+
+if __name__ == "__main__":
+    main()

command_vault_mcp-0.8.0/.analyze/analyze_challenges.py

@@ -0,0 +1,232 @@
+#!/usr/bin/env python3
+"""Comprehensive challenge writeup analysis"""
+import os, re, statistics
+from pathlib import Path
+from collections import defaultdict, Counter
+
+DIR = Path.home() / "writeups" / "challenges"
+
+TECHNIQUES = [
+    "XSS", "SQLi", "SQL injection", "SSTI", "SSRF", "RCE", "LFI", "RFI", "deserialization",
+    "prototype pollution", "JWT", "cookie", "session", "CORS", "CSP", "WAF bypass",
+    "buffer overflow", "heap", "stack overflow", "ROP", "format string", "race condition",
+    "use-after-free", "shellcode", "GOT overwrite", "ret2libc", "canary", "PIE", "ASLR", "NX",
+    "reverse engineering", "decompile", "disassemble", "IDA", "Ghidra", "Frida", "debug",
+    "breakpoint", "crypto", "RSA", "AES", "XOR", "padding oracle", "hash", "ECDSA",
+    "elliptic curve", "CBC", "ECB", "GCM", "HMAC", "command injection", "path traversal",
+    "XXE", "CRLF", "WebSocket", "GraphQL", "OAuth", "IDOR", "file upload", "SUID",
+    "ptrace", "anti-debug", "packing", "obfuscation", "virtual machine", "sandbox escape"
+]
+
+def extract_category(name):
+    m = re.search(r'\(([^)]+)\)\.md$', name)
+    return m.group(1).strip().lower() if m else 'unknown'
+
+def analyze_file(filepath):
+    content = filepath.read_text(encoding='utf-8', errors='ignore')
+    lines = content.split('\n')
+    total = len(lines)
+    category = extract_category(filepath.name)
+
+    # Code blocks
+    in_code = False
+    code_lines = 0
+    code_blocks = 0
+    code_langs = Counter()
+    for line in lines:
+        if line.strip().startswith('```'):
+            if not in_code:
+                code_blocks += 1
+                lang = re.match(r'^```(\w+)', line.strip())
+                code_langs[lang.group(1) if lang else 'plain'] += 1
+            in_code = not in_code
+        elif in_code:
+            code_lines += 1
+
+    prose_lines = total - code_lines
+    prose_ratio = prose_lines / total if total > 0 else 0
+    images = len(re.findall(r'!\[\[.*?\]\]', content))
+
+    # Sections
+    sections = []
+    for line in lines:
+        m = re.match(r'^(#{1,4})\s+(.+)$', line)
+        if m:
+            sections.append(m.group(2).strip().lower())
+
+    # Techniques
+    content_lower = content.lower()
+    tech_hits = Counter()
+    for t in TECHNIQUES:
+        count = len(re.findall(r'\b' + re.escape(t.lower()) + r'\b', content_lower))
+        if count > 0:
+            tech_hits[t] = count
+
+    # Scripts
+    has_pwn = bool(re.search(r'from pwn import', content))
+    has_requests = bool(re.search(r'import requests', content))
+    has_exploit = bool(re.search(r'def exploit\(', content))
+    has_frida = bool(re.search(r'frida|Java\.perform|Interceptor\.attach', content, re.I))
+
+    # Python lines
+    py_lines = 0
+    in_py = False
+    for line in lines:
+        if re.match(r'^```(?:python|py)\b', line.strip()):
+            in_py = True
+        elif line.strip() == '```' and in_py:
+            in_py = False
+        elif in_py:
+            py_lines += 1
+
+    words = len(re.sub(r'```.*?```', '', content, flags=re.DOTALL).split())
+
+    return {
+        'name': filepath.name, 'category': category, 'total': total,
+        'prose_ratio': prose_ratio, 'code_blocks': code_blocks, 'code_langs': code_langs,
+        'images': images, 'sections': sections, 'tech_hits': tech_hits,
+        'has_pwn': has_pwn, 'has_requests': has_requests, 'has_exploit': has_exploit,
+        'has_frida': has_frida, 'py_lines': py_lines, 'words': words,
+        'prose_lines': prose_lines, 'code_lines': code_lines
+    }
+
+def main():
+    files = list(DIR.glob("*.md"))
+    print(f"Analyzing {len(files)} challenge writeups...\n")
+    results = [analyze_file(f) for f in sorted(files)]
+
+    print("=" * 80)
+    print("CHALLENGE WRITEUP ANALYSIS")
+    print("=" * 80)
+
+    # Category breakdown
+    cats = Counter(r['category'] for r in results)
+    print("\n--- CATEGORIES ---")
+    for cat, count in cats.most_common():
+        avg_len = statistics.mean(r['total'] for r in results if r['category'] == cat)
+        avg_cb = statistics.mean(r['code_blocks'] for r in results if r['category'] == cat)
+        avg_pr = statistics.mean(r['prose_ratio'] for r in results if r['category'] == cat)
+        print(f"  {cat:20s}: {count:3d} writeups | avg {avg_len:5.0f} lines | "
+              f"avg {avg_cb:4.1f} code blocks | {avg_pr*100:4.1f}% prose")
+
+    # Structure
+    print("\n--- STRUCTURE ---")
+    totals = sum(r['total'] for r in results)
+    print(f"Total lines: {totals:,}, Avg: {totals/len(results):.1f}")
+    print(f"Total code blocks: {sum(r['code_blocks'] for r in results)}")
+    print(f"Total images: {sum(r['images'] for r in results)}")
+    print(f"Avg images/writeup: {sum(r['images'] for r in results)/len(results):.1f}")
+
+    # Prose ratio
+    print("\n--- PROSE RATIO ---")
+    avg_pr = statistics.mean(r['prose_ratio'] for r in results)
+    print(f"Average: {avg_pr*100:.1f}%")
+    for lo, hi, label in [(0,0.2,"<20%"), (0.2,0.4,"20-40%"), (0.4,0.6,"40-60%"), (0.6,1.01,">60%")]:
+        n = sum(1 for r in results if lo <= r['prose_ratio'] < hi)
+        print(f"  {label}: {n} ({n/len(results)*100:.1f}%)")
+
+    print("\nProse ratio by category:")
+    for cat, _ in cats.most_common():
+        ratios = [r['prose_ratio'] for r in results if r['category'] == cat]
+        if len(ratios) >= 3:
+            print(f"  {cat:20s}: {statistics.mean(ratios)*100:5.1f}% (n={len(ratios)})")
+
+    # Code languages
+    print("\n--- CODE LANGUAGES ---")
+    all_langs = Counter()
+    for r in results:
+        all_langs.update(r['code_langs'])
+    for lang, count in all_langs.most_common(15):
+        print(f"  {lang:15s}: {count:4d} blocks")
+
+    print("\nTop languages by category:")
+    for cat, _ in cats.most_common(10):
+        cat_langs = Counter()
+        for r in results:
+            if r['category'] == cat:
+                cat_langs.update(r['code_langs'])
+        top3 = ", ".join(f"{l}({c})" for l, c in cat_langs.most_common(3))
+        print(f"  {cat:20s}: {top3}")
+
+    # Techniques
+    print("\n--- TECHNIQUE MENTIONS ---")
+    all_tech = Counter()
+    for r in results:
+        all_tech.update(r['tech_hits'])
+    print("Top 30:")
+    for tech, count in all_tech.most_common(30):
+        files_with = sum(1 for r in results if tech in r['tech_hits'])
+        print(f"  {tech:25s}: {count:4d} mentions in {files_with:3d} files")
+
+    print("\nTechniques by category (top 5 per):")
+    for cat, _ in cats.most_common(10):
+        cat_tech = Counter()
+        for r in results:
+            if r['category'] == cat:
+                cat_tech.update(r['tech_hits'])
+        if cat_tech:
+            print(f"\n  {cat.upper()}:")
+            for tech, count in cat_tech.most_common(5):
+                print(f"    {tech:20s}: {count:3d}")
+
+    # Scripts
+    print("\n--- EXPLOIT SCRIPTS ---")
+    print(f"with pwntools: {sum(1 for r in results if r['has_pwn'])} ({sum(1 for r in results if r['has_pwn'])/len(results)*100:.1f}%)")
+    print(f"with requests: {sum(1 for r in results if r['has_requests'])} ({sum(1 for r in results if r['has_requests'])/len(results)*100:.1f}%)")
+    print(f"with def exploit(): {sum(1 for r in results if r['has_exploit'])} ({sum(1 for r in results if r['has_exploit'])/len(results)*100:.1f}%)")
+    print(f"with Frida: {sum(1 for r in results if r['has_frida'])} ({sum(1 for r in results if r['has_frida'])/len(results)*100:.1f}%)")
+
+    py_writeups = [r for r in results if r['py_lines'] > 0]
+    print(f"\nWriteups with Python code: {len(py_writeups)} ({len(py_writeups)/len(results)*100:.1f}%)")
+    if py_writeups:
+        total_py = sum(r['py_lines'] for r in py_writeups)
+        print(f"Total Python lines: {total_py:,}")
+        print(f"Avg Python lines (when present): {total_py/len(py_writeups):.1f}")
+        top_py = max(py_writeups, key=lambda r: r['py_lines'])
+        print(f"Most Python: {top_py['name']} ({top_py['py_lines']} lines)")
+
+    print(f"\nScript usage by category:")
+    for cat, _ in cats.most_common(10):
+        cat_results = [r for r in results if r['category'] == cat]
+        if len(cat_results) >= 3:
+            n = len(cat_results)
+            pwn = sum(1 for r in cat_results if r['has_pwn'])
+            req = sum(1 for r in cat_results if r['has_requests'])
+            fri = sum(1 for r in cat_results if r['has_frida'])
+            print(f"  {cat:20s} (n={n:3d}): pwn={pwn:2d} requests={req:2d} frida={fri:2d}")
+
+    # Words
+    total_words = sum(r['words'] for r in results)
+    print(f"\n--- WORD COUNT ---")
+    print(f"Total prose words: {total_words:,}")
+    print(f"Avg words/writeup: {total_words/len(results):.0f}")
+
+    # Length
+    print("\n--- LENGTH DISTRIBUTION ---")
+    for lo, hi, label in [(0,50,"<50"), (50,100,"50-100"), (100,200,"100-200"),
+                           (200,400,"200-400"), (400,800,"400-800"), (800,9999,">800")]:
+        n = sum(1 for r in results if lo <= r['total'] < hi)
+        bar = "█" * (n // 3)
+        print(f"  {label:>8s}: {n:3d} {bar}")
+
+    by_len = sorted(results, key=lambda r: r['total'], reverse=True)
+    print("\n5 longest:")
+    for r in by_len[:5]:
+        print(f"  {r['total']:5d} lines - {r['name']}")
+    print("5 shortest:")
+    for r in by_len[-5:]:
+        print(f"  {r['total']:5d} lines - {r['name']}")
+
+    # Common sections
+    print("\n--- COMMON SECTIONS ---")
+    all_sections = Counter()
+    for r in results:
+        all_sections.update(r['sections'])
+    for name, count in all_sections.most_common(15):
+        print(f"  {count:3d}x {name}")
+
+    print("\n" + "=" * 80)
+    print("DONE")
+
+if __name__ == "__main__":
+    main()