This configuration is compatible with FastGPT v4.17.0.
What this category of data looks like
Data for this category primarily comes from target systems, public vulnerability databases, automated scanner results, and manual verification records from red team engineers. Updates follow the timeline of individual penetration test projects or major version iterations of target systems. Associated daily documents include test authorization letters, penetration test reports, vulnerability reproduction records, and rectification suggestions. Data fields include vulnerability ID, reproduction path, risk rating, impact scope, and repair plan. Data scale changes dynamically based on project complexity.
What constraints these characteristics impose on the "workflow orchestration" link
Since data sources include automated scan results and manual verification records, workflows must support mixed calls of tool nodes and manual approval nodes to avoid missing vulnerabilities from single data sources. Project-level update rhythms require workflow variables to bind the current project's authorization scope and target asset information to prevent cross-project data confusion. The presence of multiple types of associated documents requires workflows to support parsing and associating multiple input sources, and to include a pre-check link to confirm the validity of test authorization letters and prevent legal authorization disputes. The time-consuming nature of vulnerability verification and rating links requires workflows to support parallel processing between nodes and breakpoint resumption.
How to set the configuration
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
variables | Bind project ID, authorization validity period, target asset list | Restrict the workflow to only process test tasks within the current authorization scope to prevent unauthorized operations |
| Loop body condition setting | Terminate when the verified vulnerabilities field is non-empty | Match nodes completed by red team engineers' manual verification, aligning with penetration test verification processes |
| Tool call parameter filling | Map input content to the vulnerability IDs of the first 3 scan results | Ensure accurate target data is passed during tool calls to avoid parameter misalignment |
| Node timeout setting | 600 seconds | Cover the conventional time required for manual verification and vulnerability analysis, preventing the entire workflow from being interrupted due to single-node stuck |
| Failure handling node | Trigger authorization letter verification retry and alarm notifications | Supplement pre-check and exception notification logic for scenarios where test authorization expires |
| Result output format | Match the field structure of penetration test reports | Ensure results generated by the workflow can be directly imported into subsequent report generation links |
Three Common Mistakes
- Symptom: The loop body fails to terminate according to the specified conditions, and runs more times than expected during execution. Cause: The trigger logic of the loop body condition was not configured correctly, and the verification rules for the corresponding field were not bound.
- Symptom: The workflow returns normal results during local preview, but returns empty data after being published as a login-free window. Cause: The project-level
variablesconfiguration that the workflow depends on was not set as a shared variable, causing necessary parameters to fail to be read after publishing. - Symptom: The parameters passed during tool calls do not match expectations, and the target vulnerability cannot be located. Cause: The user's input content was not correctly mapped to the target field of the tool call, resulting in parameter misalignment.
How to Confirm the Configuration is Correct
- Manually trigger the workflow, pass simulated test authorization letter data, and check whether the pre-check node normally intercepts invalid authorization.
- After configuring the loop body condition, insert test data containing the
verified vulnerabilitiesfield, and verify whether the loop body automatically terminates when the conditions are met. - Publish the workflow to the login-free environment, call the test interface, and check whether the parameters are correctly passed to the tool node.
- View the workflow running logs, confirm that the timeout setting of each node did not trigger abnormal interruptions, and that the result output format meets the preset report field requirements.
The values provided here are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.