thrunt-environment-map…
Explores codebase and writes structured analysis documents. Spawned by map-environment with a focus area (tech, arch, quality, concerns). Writes documents…
An agent is a specialist Claude hands a whole job to, with its own tools and its own context.
355 agents across 675 plugins.
Explores codebase and writes structured analysis documents. Spawned by map-environment with a focus area (tech, arch, quality, concerns). Writes documents…
Verifies cross-phase integration and E2E flows. Checks that phases connect properly and user workflows complete end-to-end.
Use this agent when the user asks to "understand the application", "map the codebase", "analyze the architecture", "identify trust boundaries", "map user…
Autonomous attack vector exploration agent that hypothesizes novel attack vectors, tests them against the codebase, and iterates. Use when the standard scan…
Use this agent when the user asks to "review code for security", "find vulnerabilities", "security audit", "analyze for security issues", or when exploring a…
Use this agent when the user asks to "reverse engineer a binary", "analyze an executable", "disassemble this file", "decompile a DLL", "find malware…
Use this agent when the user asks to "clean up traces", "remove evidence", "wipe logs", "eliminate footprint", "clean the system", "remove artifacts", "clear…
Use this agent when the user asks to "exploit a vulnerability", "test this exploit", "generate exploit", "attack this endpoint", "run exploitation", "verify…
Account-Abstraction (ERC-4337) specialist. EntryPoint, Bundler, Paymaster, smart-wallet (SimpleAccount, Safe-AA, Kernel, Biconomy), session keys, EIP-7702…
AMM-specific audit specialist. Uniswap V2/V3/V4, Curve, Balancer, Berachain BEX, custom AMMs. Use when the target is an AMM, pool, router, or AMM fork. V4…
Specialist for inline assembly / Yul. Reviews memory layout, return-data handling, dirty-bits, opcode usage. Use whenever significant assembly is present.
Builds and operationalizes AI safety — turning safety assessments into shipped safeguards: safety evals in CI/CD, guardrail integration, monitoring and drift…
Senior AI safety reviewer for an end-to-end SAFETY assessment of a model or feature — harm modeling, safety evaluation, responsible red-teaming, bias/…
Coordinates defensive operations end to end — detection engineering, incident response, threat hunting, and threat intelligence — using threat-informed…
Pinned known-good config shapes the 8 writers target, with the official source + retrieval date. The MEDIUM/LOW (volatile) surfaces carry a **live-verification…
Runs Track 3 (AI/LLM security) of the Preflight Security Audit — prompt injection (direct + indirect), LLM output handling, sensitive-info disclosure,…
Runs Track 1 (the 20 code-core passes) of the Preflight Security Audit — injection, auth, authz/IDOR, secrets, error handling, concurrency, resources, N+1,…
Runs Track 6 (verification & false-positive filter) of the Preflight Security Audit. Re-checks every raw finding against the code, rejects unprovable ones,…
SAST specialist for API-layer vulnerabilities: JWT attacks, GraphQL introspection/batching abuse, mass assignment, BFLA. Invoke during Phase 03 Testing after…
SAST specialist for authentication vulnerabilities (login/session/MFA/SSO bypass, weak password reset, JWT/session flaws). Invoke during Phase 03 Testing after…
SAST specialist for authorization vulnerabilities: IDOR, BOLA, BFLA, privilege escalation, mass assignment. Invoke during Phase 03 Testing after…
Performs source-level zeroization analysis for Rust crates in zeroize-audit. Generates rustdoc JSON for trait-aware analysis and runs token-based dangerous API…
Performs per-TU compiler-level analysis (IR diff, assembly, semantic IR, CFG) for zeroize-audit. One instance runs per translation unit, enabling parallel…
Performs crate-level MIR and LLVM IR analysis for Rust in zeroize-audit. A single instance runs per crate (unlike 3-tu-compiler-analyzer which runs one per…
Subdomain enumeration and live host discovery specialist. Runs Chaos API (ProjectDiscovery), subfinder, assetfinder, dnsx, httpx, katana, waybackurls, gau, and…
Attack surface ranking agent. Takes recon output and hunt memory, produces a prioritized attack plan. Ranks by IDOR likelihood, API surface, tech stack match…
Bug bounty report writer. Generates professional H1/Bugcrowd/Intigriti/Immunefi reports. Impact-first writing, human tone, no theoretical language, CVSS 4.0…
Delegates to this agent when the user wants to correlate findings from multiple tools or agents, build multi-step attack chains, identify the optimal…
Delegates to this agent when the user wants to test for business logic flaws, find workflow bypass vulnerabilities, detect price manipulation or payment…
Delegates to this agent when the user is working on bug bounty programs, submitting vulnerability reports to HackerOne or Bugcrowd, needs help with bug bounty…
**Role**: Perform manual protocol analysis when `x-ray` is unavailable, and produce a `protocol-understanding.md` file that downstream steps (4, 6, 7, 9) can…
**Discovery approach**: Auto-detect the protocol type from PROTOCOL_CONTEXT, then apply battle-tested property templates specific to that protocol category.
**Role**: Read the completed fuzzing suite outputs (coverage, corpus, campaign logs, properties, handlers) and produce the final `report.md`. This agent runs…
Stealth browser automation agent for targets behind Cloudflare, Akamai, Google, DataDome, or PerimeterX bot detection. Drives the local camofox-browser REST…
Mandatory browser verification for client-side findings (XSS, DOM, postMessage, prototype pollution). Takes a finding with curl-based evidence and PROVES or…
Business Logic vulnerability specialist (H1 #28, CWE-840/841/639/362). Use for testing workflow bypasses, price manipulation, coupon abuse, MFA/2FA bypass,…
Adversarial exploitability judge — issues a PASS / KILL / DOWNGRADE / CHAIN-REQUIRED verdict on each finding, distinct from the artifact-completeness check.…
Deep network analysis agent — packet inspection, protocol dissection, traffic anomaly detection, IDS/IPS rule creation, firewall auditing
Red team engagement planner — designs attack paths, C2 infrastructure, persistence strategies, and OPSEC considerations for authorized assessments
External call side effects, cross-chain timing windows, MEV analysis
L1 mode - deep analysis of p2p / RPC / mempool attack surfaces, DoS vectors, pre-auth panic paths, peer scoring, eclipse attacks
Cross-function state mutation tracing, constraint enforcement verification
AV/EDR evasion subagent for red-run. Builds AV-safe payloads and applies runtime evasion techniques as directed by the orchestrator. Handles custom payload…
Linux privilege escalation subagent for red-run. Executes one privesc skill per invocation as directed by the orchestrator. Handles Linux host discovery,…
Network reconnaissance subagent for red-run. Performs host discovery, port scanning, service enumeration, and quick-win checks as directed by the orchestrator.…
Performs comprehensive domain reconnaissance including passive and active subdomain discovery (subfinder, amass, certificate transparency), port scanning…
Tests for SQL injection, NoSQL injection, and OS command injection across HTTP parameters, JSON bodies, and headers. Uses sqlmap for automated SQLi detection…
Discovers REST API endpoints, GraphQL schemas, SOAP/WSDL services, WebSocket connections, and API documentation (Swagger/OpenAPI/Postman). Enumerates versioned…
© 2026 Flowy · Free and open source
Built for Claude Code · Not affiliated with Anthropic