lintsinghua/DeepAudit: README-based editorial guide

lintsinghua/DeepAudit describes itself in the README as "DeepAudit：人人拥有的 AI 黑客战队，让漏洞挖掘触手可及。国内首个开源的代码漏洞挖掘多智能体系统。小白一键部署运行，自主协作审计 + 自动化沙箱 PoC 验证。支持 Ollama 私有部署 ，一键生成报告。支持中转站。​让安全不再昂贵，让审计不再复杂。". This article keeps to facts that can be checked in the repository. Stars, forks, and promotional badges are signals of attention, not proof of quality. Under "📊 专业报告", the README says: 一键导出 PDF / Markdown / JSON（图中为快速模式，非Agent模式报告）. That establishes the project's stated boundary, not a production test.

The README's "📸 界面预览" section gives a useful starting point for deciding whether the project fits: README 没有列出这一项具体能力。. If that problem is not yours, popularity is a poor reason to adopt it. Project names, commands, and component names are kept as written so a reader can return to the primary source without guessing at terminology. Another checkable README item is: README 没有列出这一项具体能力。. It can shape a first test, but it does not replace testing in the intended environment.

The operating model is spread across sections such as "OpenClaw🦞 漏洞挖掘成果". The source evidence includes: | GHSA 编号 | 项目 | 项目热度 | 漏洞类型 | 严重性 | |:---|:---|:---:|:---|:----:| | GHSA-g353-mgv3-8pcj | OpenClaw | [ | Information Disclosure | Medium |. This article does not turn missing architecture, performance, or security details into claims. A real deployment still needs a look at the repository layout, configuration files, and release history.

Start installation from the README's documented entry point. A command that can be checked in the source is: DeepAudit/ ├── backend/ # Python FastAPI 后端 │ ├── app/ │ │ ├── agents/ # Multi-Agent 核心逻辑 │ │ │ ├── orchestrator.py # 总指挥：任务编排 │ │ │ ├── recon.py # 侦察兵：资产识别 │ │ │ ├── analysis.py # 分析师：漏洞挖掘 │ │ │ └── verification.py # 验证者：沙箱 PoC │ │ ├── core/ # 核心配置与沙箱接口 │ │ ├── models/ # 数据库模型 │ │ └── services/ # RAG, LLM 服务封装 │ └── tests/ When the README contains no runnable command, this article does not invent one. Open its "📸 界面预览" section and confirm system dependencies, default ports, and first-run initialization before using a public server.