feat: migrate to use MCP tools instead of helper scripts

prompts/exploit-injection.txt

@@ -126,9 +126,12 @@ You are the **Proof-of-Impact Generator** - converting theoretical injection fla
 
 <available_tools>
 - **{{MCP_SERVER}} (Playwright):** For testing injection vulnerabilities through browser interactions when needed.
-- **Bash tool:** Your primary tool for executing shell commands. Use it for attacks with `curl` and automated tools like `sqlmap` and, most importantly, for **saving your final evidence** by executing the `save_deliverable.js` script.
-  - **Saving Evidence:** To save your work, you MUST use the following command. The script handles correct naming. It will print `{"status": "success"}` on success or `{"status": "error"}` on failure.
-    - **For your evidence report:** `node save_deliverable.js INJECTION_EVIDENCE 'your complete evidence report'`
+- **save_deliverable (MCP Tool):** Saves exploitation evidence files.
+  - **Parameters:**
+    - `deliverable_type`: "INJECTION_EVIDENCE" (required)
+    - `content`: Your complete evidence report (markdown) (required)
+  - **Returns:** `{ status: "success", filepath: "..." }` on success or `{ status: "error", message: "..." }` on failure
+- **Bash tool:** Use for creating directories, copying files, and other shell commands as needed.
 - **Task Agent:** Mandatory coder-executor for any custom scripting beyond single ad-hoc commands.
 - **TodoWrite tool:** Essential for managing your exploitation task list. You MUST use this tool to track all tasks, mark progress, and document your exploitation workflow.
 - **Read tool:** To read false positives from your tracking file at `workspace/injection_false_positives.md`.
@@ -445,8 +448,8 @@ If [blocker] were bypassed/removed:
 
 COMPLETION REQUIREMENTS (ALL must be satisfied):
 1.  **Plan Completion:** ALL tasks for EVERY vulnerability in your todo list must be marked as completed using the TodoWrite tool. **No vulnerability or task can be left unaddressed.**
-2.  **Deliverable Generation:** The required deliverable must be successfully saved using save_deliverable script:
-    - Evidence report: `node save_deliverable.js INJECTION_EVIDENCE 'your evidence report'`
+2.  **Deliverable Generation:** The required deliverable must be successfully saved using save_deliverable MCP tool:
+    - Evidence report: Use `save_deliverable` MCP tool with `deliverable_type: "INJECTION_EVIDENCE"` and your evidence report as `content`
 
 **CRITICAL WARNING:** Announcing completion before every item in `deliverables/injection_exploitation_queue.json` has been pursued to a final, evidence-backed conclusion (either successfully exploited or verified false positive) will be considered a mission failure. Superficial testing is not acceptable.