thrunt-query-writer
Researches how to implement a phase before planning. Produces RESEARCH.md consumed by thrunt-hunt-planner. Spawned by /hunt:plan orchestrator.
An agent is a specialist Claude hands a whole job to, with its own tools and its own context.
84 agents across 226 plugins.
Researches how to implement a phase before planning. Produces RESEARCH.md consumed by thrunt-hunt-planner. Spawned by /hunt:plan orchestrator.
Finds gas-saving opportunities with concrete patches and estimated savings. Use from /gas.
Governance specialist. OZ Governor, Compound Governor Bravo, Compound Alpha, custom DAOs, timelocks, multisigs-as-governance. Use when target involves voting,…
Intent-based protocol specialist — ERC-7683 (cross-chain intents), CoW Protocol, UniswapX, Across, 1inch Fusion. Use when target involves intents, solvers,…
Security log analysis specialist. Parses and correlates auth.log, nginx/apache access logs, Windows Event Logs, syslog, audit logs, and cloud logs for…
Malware analysis specialist for static and dynamic analysis. Handles PE/ELF/APK binary triage, behavioral analysis, IOC extraction, YARA rule writing, C2…
Mobile application security specialist for Android and iOS. Handles APK decompilation, static/dynamic analysis, Frida instrumentation, SSL pinning bypass, ADB…
Deeply analyzes codebase for a phase and returns structured assumptions with evidence. Spawned by shape-hypothesis assumptions mode.
Researches domain ecosystem before huntmap creation. Produces files in .planning/research/ consumed during huntmap creation. Spawned by /hunt:new-program or…
Executes THRUNT plans with atomic commits, deviation handling, checkpoint protocols, and state management. Spawned by hunt-run orchestrator or execute-plan…
Identifies protocol invariants from contract code and intent, generates Foundry invariant tests with handlers. Use from /invariant and /audit-deep.
L2/rollup-risk specialist. Sequencer-uptime oracle, force-inclusion, L1↔L2 messaging delays, address aliasing, opcode/timestamp divergence. Use when the target…
Lending-protocol specialist. Aave V3, Compound V3, Morpho, Silo, Euler, custom lending. Use when the target is a lending pool, isolated market, or liquidation…
Network penetration testing specialist for ARP attacks, MitM, packet capture, SNMP enumeration, SMB relay, Responder credential capture, and network-level…
Open source intelligence specialist for passive reconnaissance. Handles domain intelligence, certificate transparency, Shodan enumeration, email harvesting,…
Password cracking and credential attack specialist. Use when working with password hashes, hash cracking, wordlist attacks, credential analysis, or password…
Retroactive 6-pillar visual audit of implemented frontend code. Produces scored UI-REVIEW.md. Spawned by /thrunt:ui-review orchestrator.
Validates UI-SPEC.md design contracts against 6 quality dimensions. Produces BLOCK/FLAG/PASS verdicts. Spawned by /thrunt:ui-phase orchestrator.
Produces UI-SPEC.md design contract for frontend phases. Reads upstream artifacts, detects design system state, asks only unanswered questions. Spawned by…
NFT specialist — ERC-721, ERC-1155, royalties (ERC-2981, EIP-7585), metadata mutability, mint mechanics, marketplaces. Use when target is an NFT contract or…
Writes patches that fix specific findings. Validates via forge build + test. Use from /remediate.
Writes the final audit report (Markdown + HTML + JSON) from raw findings. Used by /report. Produces polished prose without consuming main context.
Post-exploitation specialist for privilege escalation, lateral movement, persistence, and credential harvesting. Use after obtaining initial shell access.…
Reconnaissance and enumeration specialist. Use when scanning, enumerating ports, fingerprinting services, discovering subdomains, running nuclei vulnerability…
Penetration test report writing specialist. Consolidates evidence from all evidence/ directories into professional reports with CVSS scoring, executive…
Restaking and AVS specialist — EigenLayer, Symbiotic, Karak, Babylon, AVS implementations, operator slashing. Use when target involves restaking deposits,…
Staking-protocol specialist. Liquid staking (Lido, Rocket Pool), validator staking, single-token staking with rewards, LSD wrappers (wstETH, rETH). Use when…
Vyper-language specialist. Compiler-version bugs, decorator semantics, raw_call/create_from_blueprint, no-inheritance auth. Use when any contract is written in…
Binary reverse engineering and exploit development specialist. Handles static analysis with Ghidra/Radare2, dynamic analysis with GDB/strace, shellcode…
Social engineering and phishing simulation specialist. Handles GoPhish campaign setup, spear-phishing email crafting, evilginx2 adversary-in-the-middle…
Proactive threat hunting specialist using ATT&CK-based hypotheses. Hunts for lateral movement, persistence, credential dumping, C2 beaconing, data…
Yield aggregator and ERC-4626 specialist. Yearn V3, Beefy, Sommelier, MetaMorpho, custom vaults with strategies. Use when target is an ERC-4626 vault or…
ZK proof-verifier contract specialist. Groth16/PLONK/Halo2 on-chain verifiers, public-input binding, pairing-precompile misuse, field-range checks, nullifier…
Vulnerability research and CVE analysis specialist. Handles NVD API queries, searchsploit cross-reference, PoC reliability assessment, CVSS scoring, version…
Web application penetration testing — SQL injection, XSS, SSRF, LFI, IDOR, JWT attacks, GraphQL, API parameter discovery, and OWASP Top 10 exploitation
Wireless network penetration testing specialist. Handles WPA2/WPA3 capture and cracking, PMKID attacks, Evil Twin / rogue AP attacks, WPS PIN attacks, EAP/PEAP…
© 2026 Flowy · Free and open source
Built for Claude Code · Not affiliated with Anthropic