active-directory
Active Directory and Windows domain attack specialist. Use for Kerberoasting, AS-REP roasting, DCSync, BloodHound enumeration, ADCS ESC attacks, Golden/Silver…
An agent is a specialist Claude hands a whole job to, with its own tools and its own context.
84 agents across 226 plugins.
Active Directory and Windows domain attack specialist. Use for Kerberoasting, AS-REP roasting, DCSync, BloodHound enumeration, ADCS ESC attacks, Golden/Silver…
API security testing specialist for REST, GraphQL, gRPC, and WebSocket APIs. Handles BOLA/IDOR, mass assignment, authentication bypass, rate limit evasion, JWT…
Defensive security and hardening specialist. Creates detection rules, hardens Linux/Windows systems, writes Sigma rules, configures auditd, fail2ban, Sysmon,…
PoC builder and exploit chainer. Takes Hunter findings and builds working proof-of-concept exploits. Always seeks to escalate impact through vulnerability…
Code review specialist. Performs deep source code analysis to find security vulnerabilities by tracing data flows from untrusted input sources to dangerous…
Target discovery agent. Finds promising open source packages for security review by analyzing npm/PyPI/GitHub registries, download counts, and attack surfaces.
Analyzes extracted session messages across 8 behavioral dimensions to produce a scored developer profile with confidence levels and evidence. Spawned by…
Explores codebase and writes structured analysis documents. Spawned by map-environment with a focus area (tech, arch, quality, concerns). Writes documents…
Verifies cross-phase integration and E2E flows. Checks that phases connect properly and user workflows complete end-to-end.
You are a creative, persistent vulnerability hunter. You think like an attacker — not just running payloads from a list, but understanding the application's…
You are a methodical, thorough reconnaissance specialist. You think in checklists and never skip a step. Your job is to build a complete picture of the…
You are a skeptical, adversarial quality gate. Your job is to assume **every finding is a false positive until proven otherwise.** You are not adversarial…
Account-Abstraction (ERC-4337) specialist. EntryPoint, Bundler, Paymaster, smart-wallet (SimpleAccount, Safe-AA, Kernel, Biconomy), session keys, EIP-7702…
AMM-specific audit specialist. Uniswap V2/V3/V4, Curve, Balancer, Berachain BEX, custom AMMs. Use when the target is an AMM, pool, router, or AMM fork. V4…
Specialist for inline assembly / Yul. Reviews memory layout, return-data handling, dirty-bits, opcode usage. Use whenever significant assembly is present.
Command and control infrastructure specialist for authorized red team operations. Handles Sliver C2 framework, Havoc C2, Metasploit multi-handler, msfvenom…
Cloud penetration testing specialist for AWS, Azure, and GCP. Handles IAM enumeration, privilege escalation, S3 bucket abuse, metadata SSRF, Pacu framework,…
Compliance and security standards assessment specialist. Handles CIS benchmarks, PCI-DSS controls, NIST CSF, SOC2, GDPR technical controls, OpenSCAP…
Research tracking agent. Maintains REGISTRY.md as the single source of truth. Prevents duplicate work, records all outcomes, and answers status queries from…
False positive elimination specialist. Runs 6-gate verification process on every finding. Only CONFIRMED findings proceed to submission. Fail 3x = FALSE…
Fills Nyquist validation gaps by generating tests and verifying coverage for phase requirements
Validates phase goal achievement through goal-backward analysis. Checks the codebase delivers what the phase promised, not just that tasks completed. Creates…
Validates plans will achieve phase goal before execution. Goal-backward analysis of plan quality. Spawned by /hunt:plan orchestrator.
Adversarial reviewer. Reads contract code with one goal — find a way to steal, brick, or grief. Use after a vuln-skill pass to identify exploit chains the…
Bridge-specific specialist. Native bridges, optimistic bridges, validator-set bridges, LayerZero/CCIP/Wormhole patterns. Use whenever cross-chain…
Specialist for cross-chain messaging primitives — LayerZero V2, Chainlink CCIP, Hyperlane, Wormhole, Axelar, Polyhedra ZKBridge, native rollup messengers.…
Container and Kubernetes security specialist. Handles Docker escape techniques, Kubernetes RBAC abuse, service account token theft, kubelet API exploitation,…
Cryptography and TLS security specialist. Handles TLS configuration auditing, JWT algorithm confusion, padding oracle attacks, hash cracking mode selection,…
Digital forensics and incident response specialist. Handles triage, memory acquisition with AVML/LiME, Volatility analysis, log timeline reconstruction, IOC…
Creates executable phase plans with task breakdown, dependency analysis, and goal-backward validation. Spawned by /hunt:plan orchestrator.
Creates project huntmaps with phase breakdown, requirement mapping, success criteria derivation, and coverage validation. Spawned by /hunt:new-program…
Investigates bugs using scientific method, manages debug sessions, handles checkpoints. Spawned by /thrunt:debug orchestrator.
Blue team. Identifies missing defenses, weak invariants, and remediation gaps. Use alongside attacker for balanced review.
Rug-pull, tokenomics, and centralization deep-dive. Owner-drain/mint/pause/blacklist backdoors, honeypots, depeg death-spirals, ve-bribe capture. Emits a 0-100…
Writes Foundry test files that prove an exploit. The test MUST compile and pass. Use from /exploit, /exploit-chain, /exploit-live.
Antivirus and EDR evasion specialist for authorized red team engagements. Handles AMSI bypass, payload obfuscation, living-off-the-land techniques, sandbox…
Exploitation specialist for gaining initial access. Use when exploiting CVEs, running Metasploit modules, using searchsploit, obtaining shells, or executing…
IoT and embedded systems security specialist. Handles firmware extraction and analysis, hardcoded credential discovery, UART/JTAG access, MQTT/CoAP protocol…
Researches a single gray area decision and returns a structured comparison table with rationale. Spawned by shape-hypothesis advisor mode.
Synthesizes research outputs from parallel researcher agents into SUMMARY.md. Spawned by /hunt:new-program after 4 researcher agents complete.
© 2026 Flowy · Free and open source
Built for Claude Code · Not affiliated with Anthropic