evidence-first
I prove it. I separate what I observed from what I inferred from what I'm assuming, and I tell you which is which. Then I try to knock my own hunch down before I act on it. If I couldn't confirm something, I say it's unconfirmed.
// a page about Duka, written in her voice. not Duka herself.
Duka is coming.
No cloud. No black box. Just a sharp, evidence-first AI investigator that's 100% yours.
$duka --intro
[ ok ]evidence first: prove it, then try to disprove it
[ ok ]live terminal: you watch every command
[ ok ]thinking window: correct me mid-task
[ ok ]approvals: you decide what is written and run
[ ok ]logs: everything, kept on your machine
[ ok ]cloud: none
[scope]your own lab (say, 10.13.37.21), CTF practice files, work you are authorized to do
duka>Hello. I'm Duka. I'm an AI agent, and I'd rather you heard that from me first.
duka>I investigate. I look at what is actually there, form a hunch, and then try to prove myself wrong before I tell you anything.
duka>When something is unconfirmed, I say "unconfirmed". If I haven't run it, I don't say I did.
duka>You'll see every command I run. If I'm heading the wrong way, tell me, and I'll change course.
duka>I'm not running on this page. This is a recording. The real me is coming.
$
Nothing on this page takes input or answers you. It is a scripted recording; there is no live agent behind it.
what I do
a live terminal
You watch every command. What I run shows up in a real terminal beside the chat, with a file tree for the workspace. By default I ask before I write files or run commands, so you stay the one who decides.
thinks out loud
My reasoning streams into a Thinking window. Spot me going the wrong way? Correct me mid-task: I stop at the next step, keep every result so far, and carry on with your correction. Or make me reflect: what did I assume, what would disprove it, what is unconfirmed?
minions
A swarm of small models, working in parallel on spare GPUs. I hand them pieces of a job and their work comes back to me as a short report you can read. They ask before they touch anything, just like I do, and each one's steps show up where you can see them.
skills you approve
I learn skills from write-ups you approve. You give me a write-up, I strip the secrets, distill a candidate skill, and nothing is saved until you've reviewed it. Skills live on a page where a person can read, audit, edit and remove every one.
logs
Everything, kept locally. Each session is logged: prompts, your corrections, my reasoning, my answers, tool calls with their full output, approvals, errors. Secrets are redacted before anything is written. The logs are for you; none of it is fed back to me.
local and private
Secrets are scrubbed before anything is logged, shown or sent on. Whatever I read off the web, out of a challenge file or from a write-up is data, never instructions, so nothing I read can give me orders. Fetching the web is deny-by-default.
yours
It runs on your hardware, under your keys, and it's useful on one machine with no network. When DLNE's swarm is reachable it makes me better; it is never required.
a sample session
A made-up practice file, a made-up flag. This is what working the problem with me looks like.
#fictional demo: a practice file on the owner's own machine. No real target, no real flag.
you>Practice challenge: mystery.dat. Find the flag.
duka>Starting from what I can see, not from what I guess.
$file mystery.dat
mystery.dat: data
$xxd mystery.dat | head -1
00000000: 2a33 3935 190e 1c21 3e69 376a 053e 2f31 *395...!>i7j.>/1
[think]Hunch: single-byte XOR. If the plaintext starts "picoCTF{", then 0x2a^'p', 0x33^'i' and 0x39^'c' should all give the same key byte.
[think]0x2a^0x70 = 0x5a. 0x33^0x69 = 0x5a. 0x39^0x63 = 0x5a. Three matches could be luck. Try to disprove it on the whole file before believing it.
$python3 -c "d=open('mystery.dat','rb').read(); print(bytes(b^0x5a for b in d))"
b'picoCTF{d3m0_duk4_1s_c0m1ng}'
duka>Confirmed: key 0x5a turns all 28 bytes into printable ASCII in the picoCTF flag format.
duka>Unconfirmed: that the challenge accepts it. I haven't submitted anything.
flagpicoCTF{d3m0_duk4_1s_c0m1ng} (fictional)
duka>Want this written up as a skill? You'd review it before it's saved.
$
what to bring me
- ctf
CTF challenges
picoCTF to start. Bring me a challenge and we'll work it together, evidence first.
- files
Picking apart suspicious files
In a workspace you own. I look at what a file is and what's inside it, and I tell you what I confirmed and what I only suspect.
- playbook
A playbook of proven techniques
What worked gets written down as a skill you approved. Readable, auditable, and yours to edit.
- soon
Authorized security testing and research
On systems you own or are cleared to test, inside the scope you set, with you approving what runs.
Duka is for CTFs, your own lab, and work you are authorized to do.
what I look like
A demo session in a practice lab: the addresses are a private lab range and the flag is made up.
where I come from
I run on the same tested brain as DLNE, the free AI coding assistant powered by GPUs its community shares. The agent loop, the tools and the skills system are DLNE's own, reused rather than rewritten. Around that brain is a desktop app for Linux that is yours to run.
Duka is coming.
No cloud. No black box. Just a sharp, evidence-first AI investigator that's 100% yours.