Allen (@swackhamer) builds tools for cybersecurity and cyber threat intelligence and has recently focused on AI development. The flagship is OxiDex, a memory-safe Rust reimplementation of ExifTool for pipelines that scan untrusted files. Around it: Claude and Codex plugins, a from-scratch Tuya protocol implementation, and macOS utilities explicit about what runs as root. Written in Rust, Python, and Swift.
OxiDex docs · Plugin marketplace · All repositories
File scanners such as Strelka shell out to ExifTool: Strelka routes Office, PDF, LNK, SWF, and image files to ScanExiftool, which runs exiftool -j and parses the JSON. ExifTool has publicly documented vulnerabilities, including CVE-2021-22204 (code execution from a crafted DjVu image; fixed in 12.24 and listed in CISA's Known Exploited Vulnerabilities Catalog) and CVE-2022-23935 (command injection through a crafted filename; fixed in 12.38). OxiDex was written to replace that step: a memory-safe extractor for untrusted input, with ExifTool-compatible arguments and -j output, and parsers meant to be read, tested, and extended.
Measured: 16,684 tag definitions; 77.5% extraction conformance against ExifTool 13.59 across 126 format families (coverage report); 3.7-9.7x faster than Perl ExifTool on the project's published benchmarks. GPL-3.0 licensed.
- Built for triage: PE executables (imports, exports, Rich header, version info, and Authenticode signer details read without validating the signature), ELF and Mach-O binaries, LNK shortcuts, PCAP/PCAP-NG captures, ZIP/RAR archives, and Office documents (authorship and revision metadata); optional Magika content-based type detection.
- Built to deploy: an ExifTool-compatible command-line tool (
-j,--csv, recursive-r); static musl Linux binaries (x86_64, arm64); Developer ID-signed and notarized macOS builds; a Windows build; a multi-arch Docker image; a Rust library (API reference); a C ABI with a cbindgen-generated header (FFI reference); and a reference Python binding. - Built to be verified:
unsafekept out of the format parsers; libFuzzer fuzz harnesses for PDF, MP4, FLAC, and MP3;cargo auditinside the required Lint & Audit status check; SHA-pinned GitHub Actions; pinned ExifTool (.exiftool-version) as CI's differential-test oracle. - Built with an autonomous AI harness: "the fleet" runs parallel LLM workers in separate git worktrees to patch parsers for tags that ExifTool reports and OxiDex misses. Each candidate must pass an ordered gate stack (apply, build, re-comparison against ExifTool, structural and gap-count gates, targeted tests, duplicate check, reviewer model, full test suite) before commit. Results: 67 tag gaps closed with per-commit evidence across 13 formats; figures that could not be measured are labeled not measured. Where ExifTool's tag tables hold the answer, OxiDex extracts that data mechanically (27,747 entries in 1.3 seconds) rather than spending roughly 112 model calls per delivered tag.
Each plugin ships to Claude and Codex from one source tree. Together: 12 skills, 3 lifecycle hooks, and a 15-tool remote MCP server, installable from the ai-plugin-marketplace repository.
| Project | What it does |
|---|---|
| Vale AI plugin Guide |
Vale with bundled Google style rules: three lifecycle hooks, four prose skills, and a checker that never edits files. CI smoke-tests it against real Claude Code and Codex clients. |
| Token Max Guide · Evidence |
Report-only token audit of sessions and projects; it installs no hooks. Every finding is labeled measured, estimated, or hypothesis; actionable ones include a copyable fix prompt. |
| Trakt MCP Guide · CI security |
Rust MCP server on Cloudflare Workers for Trakt history, recommendations, lists, and calendars. It runs its own OAuth 2.0 authorization server (S256 PKCE for public clients, trakt:read/trakt:write scopes); refresh cannot raise scope; every write needs write scope plus confirmed: true. Its CI runs CodeQL, OSV Scanner, and dependency audits on SHA-pinned GitHub Actions, plus a branch-protection check. |
| Project | What it does |
|---|---|
| tuya-re Protocol notes |
From-scratch Python implementation of Tuya's BLE v3 and LAN v3.3/v3.4 protocols, with framing verified against byte-exact golden vectors. Its SECURITY.md classifies every credential and documents rotation; CI runs gitleaks over the full history. After a one-time credential pull, commands never leave the LAN. |
| Battery Monitor Releases |
Swift menu bar app for battery health, USB-C Power Delivery, and thermal diagnostics. An optional root LaunchDaemon helper runs the privileged collectors; the UI never runs as root. Signed, notarized DMGs with SHA-256 checksums. |
| ram-monitor Releases |
Rust root LaunchDaemon that terminates the largest processes when used memory crosses a configurable threshold. Allowlist of critical daemons, dry-run mode, and signed, notarized, checksummed releases with documented codesign/spctl verification. |
- Use a tool: download an OxiDex prebuilt binary and run
oxidex -j sample.pdf; install the plugins from the plugin marketplace. - Ask a question or report a bug: open an issue on the relevant repository (for example, OxiDex issues); for bugs, include a reproducible example.
- Contribute: open an issue before anything beyond a focused fix, then follow the org contributing guide and OxiDex's contributing guide.
- Report a vulnerability: OxiDex (report privately), tuya-re, and the macOS tools accept private vulnerability reports; the org security policy covers the rest.