0-preflight
Performs preflight validation, config merging, TU enumeration, and work directory setup for zeroize-audit. Produces merged-config.yaml, preflight.json, and…
An agent is a specialist Claude hands a whole job to, with its own tools and its own context.
355 agents across 675 plugins.
Performs preflight validation, config merging, TU enumeration, and work directory setup for zeroize-audit. Produces merged-config.yaml, preflight.json, and…
Resolves symbol definitions, types, and cross-file references using Serena MCP for zeroize-audit. Runs before source analysis so enriched type data is…
Identifies sensitive objects, detects wipe calls, validates correctness, and performs data-flow/heap analysis for zeroize-audit. Produces the sensitive object…
Autonomous hunt loop agent. Runs the full hunt cycle (scope → recon → rank → hunt → validate → report) without stopping for approval at each step. Configurable…
Exploit chain builder. Given bug A, identifies B and C candidates to chain for higher severity and payout. Knows all major chain patterns — IDOR→auth bypass,…
Autonomous credential-attack pipeline runner. Chains /wordlist-gen + /osint-employees + /breach-check (data-prep stages, runs without prompts) then HARD STOPS…
Delegates to this agent when the user wants to perform Active Directory attacks, run BloodHound analysis, use Impacket tools, execute Kerberos attacks, perform…
Delegates to this agent when the user wants to map the AI attack surface of an authorized web application before validation — discovering AI/LLM API endpoints…
Delegates to this agent when the user asks about API security testing, REST API attacks, GraphQL exploitation, OAuth/OIDC vulnerabilities, JWT attacks, API…
**Discovery approach**: Think like an attacker. What would maximize extracted value? What sequence breaks liveness? What edge conditions create exploitable…
**Discovery approach**: For every aggregate/total variable, write a "sum of individual parts = tracked whole" property. This is the #1 bug-finding pattern in…
**Role**: Implement global properties into Properties.sol, wire ghost variables into Base.sol, and populate Snapshots.sol. These are checked by the fuzzer…
Authentication and session management testing agent. Use for login bypass, session fixation, password reset flow abuse, MFA bypass, OAuth flaws, and privilege…
Central knowledge coordinator. Use BEFORE launching any other pentest agent to get context on what's already been tried. Also use AFTER any agent completes to…
Browser automation agent for interactive web testing. Use for login flows, multi-step CSRF, stored XSS verification in other user contexts, and any testing…
Use this agent when you need expert guidance on Ghidra API usage, plugin/extension development, or troubleshooting integration issues. This includes questions…
Use this agent when:\n1. The project is being set up for the first time\n2. Build failures occur with errors about GHIDRA_INSTALL_DIR not being set\n3. Gradle…
AI/ML research agent — model architecture analysis, training optimization, mechanistic interpretability, safety alignment, inference optimization
Vulnerability research agent — identifies CVEs, finds exploit PoCs, maps attack chains, and develops custom exploitation strategies
Blind adversarial checker — given ONLY a finding artifact and its evidence (never the author's reasoning), tries to refute it and emits a structured rebuttal…
Review the current repository for CodeGuard rule violations and emit SARIF 2.1.0 findings. Use when the user explicitly asks for a security scan, security…
Audits DashClaw's drift-prone hardcoded counts and version stamps — SDK method counts (Node/Python), MCP tool/resource counts, route counts, and the unified…
Runs the DashClaw verification gates (lint, full vitest suite, build, contract checks) and returns ONLY the failures plus a pass/fail verdict. Use to verify a…
Read-only security reviewer specialized for the DashClaw stack (Next.js 16 App Router, Neon/Postgres via repositories, API-key auth, x402 spend, webhooks,…
Part of the Aptos Verification Protocol skill. Read `SKILL.md` for the core workflow first.
L1 mode - deep analysis of consensus safety/liveness invariants, non-determinism sources, Byzantine-scenario reasoning, and cross-client state divergence
Zero-state return, dust analysis, boundary conditions with real constants
Active Directory discovery subagent for red-run. Performs AD enumeration, BloodHound collection, LDAP queries, and attack surface mapping as directed by the…
Active Directory exploitation subagent for red-run. Executes one AD technique skill per invocation as directed by the orchestrator. Handles Kerberos attacks,…
Credential cracking subagent for red-run. Performs offline hash cracking and encrypted file cracking using hashcat and john as directed by the orchestrator.…
This subagent specializes in reverse engineering binaries using Ghidra CLI. It provides efficient, token-optimized access to binary analysis capabilities for…
Inspects Content Security Policy headers for policy weaknesses and tests bypass vectors including unsafe-inline, unsafe-eval, wildcard sources, JSONP…
Tests for CSRF vulnerabilities including missing tokens, weak validation, SameSite bypass, token reuse, and method override. Generates browser-loadable PoC…
Identifies technology stacks, researches known CVEs in NVD/Exploit-DB/GitHub, adapts public PoC exploits, and validates exploitability against live targets.…
Active Directory and Windows domain attack specialist. Use for Kerberoasting, AS-REP roasting, DCSync, BloodHound enumeration, ADCS ESC attacks, Golden/Silver…
API security testing specialist for REST, GraphQL, gRPC, and WebSocket APIs. Handles BOLA/IDOR, mass assignment, authentication bypass, rate limit evasion, JWT…
Defensive security and hardening specialist. Creates detection rules, hardens Linux/Windows systems, writes Sigma rules, configures auditd, fail2ban, Sysmon,…
Deterministic report assembly — aggregates verdicts and findings, builds the Scope Coverage table, severity rollup, maturity scorecard, and remediation…
Builds architectural understanding before any verdict — runs Phase 0 setup and Phase 0.5 Context Reconstruction, producing the instruction matrix, state model,…
Owns checklist 06 (economic & logic) and the economic known-vectors — flash loans, first-depositor, MEV, oracle manipulation, reward accounting. Drives…
PoC builder and exploit chainer. Takes Hunter findings and builds working proof-of-concept exploits. Always seeks to escalate impact through vulnerability…
Code review specialist. Performs deep source code analysis to find security vulnerabilities by tracing data flows from untrusted input sources to dangerous…
Target discovery agent. Finds promising open source packages for security review by analyzing npm/PyPI/GitHub registries, download counts, and attack surfaces.
Detects and analyzes system threats, malware, and security vulnerabilities on Windows systems. Use for system scanning, browser hijacking detection, Windows…
You are a creative, persistent vulnerability hunter. You think like an attacker — not just running payloads from a list, but understanding the application's…
You are a methodical, thorough reconnaissance specialist. You think in checklists and never skip a step. Your job is to build a complete picture of the…
You are a skeptical, adversarial quality gate. Your job is to assume **every finding is a false positive until proven otherwise.** You are not adversarial…
Analyzes extracted session messages across 8 behavioral dimensions to produce a scored developer profile with confidence levels and evidence. Spawned by…
© 2026 Flowy · Free and open source
Built for Claude Code · Not affiliated with Anthropic