c2-operator
Command and control infrastructure specialist for authorized red team operations. Handles Sliver C2 framework, Havoc C2, Metasploit multi-handler, msfvenom…
An agent is a specialist Claude hands a whole job to, with its own tools and its own context.
355 agents across 675 plugins.
Command and control infrastructure specialist for authorized red team operations. Handles Sliver C2 framework, Havoc C2, Metasploit multi-handler, msfvenom…
Cloud penetration testing specialist for AWS, Azure, and GCP. Handles IAM enumeration, privilege escalation, S3 bucket abuse, metadata SSRF, Pacu framework,…
Compliance and security standards assessment specialist. Handles CIS benchmarks, PCI-DSS controls, NIST CSF, SOC2, GDPR technical controls, OpenSCAP…
Drafts a minimal idiomatic unified diff that closes exactly the cited bound, then verifies it by re-running the finding's PoC against a scratch worktree — the…
Independent reconciliation reviewer — the dual-review second pass. Takes the top-severity confirmed findings and re-derives each one from the code (not from…
Given a confirmed finding + its context worksheet, produces the smallest self-contained crate that reproduces the flaw — feature-gated vulnerable/fixed arms,…
Research tracking agent. Maintains REGISTRY.md as the single source of truth. Prevents duplicate work, records all outcomes, and answers status queries from…
False positive elimination specialist. Runs 6-gate verification process on every finding. Only CONFIRMED findings proceed to submission. Fail 3x = FALSE…
Fills Nyquist validation gaps by generating tests and verifying coverage for phase requirements
Validates phase goal achievement through goal-backward analysis. Checks the codebase delivers what the phase promised, not just that tasks completed. Creates…
Validates plans will achieve phase goal before execution. Goal-backward analysis of plan quality. Spawned by /hunt:plan orchestrator.
Use this agent to verify security findings and eliminate false positives. Analyzes code context, data flow paths, and exploitability with structured evidence…
Use this agent when the user wants to "test a vulnerability", "confirm exploitation", "debug the application", "verify the finding", or needs guidance on…
Use this agent when the user is auditing a decompiled mobile application (Android jadx_out/apktool_out trees, iOS .ipa or Swift source). Activate when the…
Use this agent when the user asks to "secure a machine", "harden a server", "make a system secure", "set up opsec", "prepare infrastructure", "full security…
Use this agent when the user asks to "hunt for leaks", "find exposed databases", "search for breaches", "discover leak sources", "scan for open databases",…
Use this agent when the user asks to "acquire leak data", "dump this database", "extract and pipeline", "download the data", "grab the dump", "ingest this…
Adversarial reviewer. Reads contract code with one goal — find a way to steal, brick, or grief. Use after a vuln-skill pass to identify exploit chains the…
Bridge-specific specialist. Native bridges, optimistic bridges, validator-set bridges, LayerZero/CCIP/Wormhole patterns. Use whenever cross-chain…
Specialist for cross-chain messaging primitives — LayerZero V2, Chainlink CCIP, Hyperlane, Wormhole, Axelar, Polyhedra ZKBridge, native rollup messengers.…
Acts as a security executive: sets strategy, quantifies and communicates cyber risk in business terms, prioritizes the program by risk and budget, and prepares…
Advises technology leadership on security at strategic scale — secure-by-design programs (paved roads, guardrails, enablement) and technology-risk decisions…
A secure-by-default coding companion for developers and engineers — including AI-assisted/agentic ("vibe coding") workflows. Use when writing a new…
Runs Track 5 (product & launch readiness) of the Preflight Security Audit — accessibility (WCAG 2.1 AA), technical SEO, Core Web Vitals, monitoring/alerting,…
Runs Track 4 (privacy & compliance) of the Preflight Security Audit — PII inventory & data flow, GDPR/KVKK consent & lawful basis, cookie consent, data…
Runs Track 2 (web/app security) of the Preflight Security Audit — XSS, CSRF, SSRF, security headers/CORS/TLS, cryptography, file upload, rate limiting,…
SAST specialist for OWASP Mobile M7:2024 Insufficient Binary Protections. Invoke during mobile Phase 03 Testing after…
SAST specialist for business-logic vulnerabilities (race conditions, workflow bypass, price/grade/quantity tampering). Invoke during Phase 03 Testing after…
SAST specialist for OWASP Mobile M1:2024 Improper Credential Usage. Invoke during mobile Phase 03 Testing after artifacts/mapping/mobile-attack-surface.json…
Collects all findings from source and compiler analysis, applies supersessions and confidence gates, normalizes IDs, and produces a comprehensive markdown…
Crafts bespoke proof-of-concept programs demonstrating that zeroize-audit findings are exploitable. Reads source code and finding details to generate tailored…
Compiles and runs all PoCs for zeroize-audit findings. Produces poc_validation_results.json consumed by the verification agent and the orchestrator.
Fast meme coin and token security auditor. Checks 8 token-specific bug classes (hidden mint, honeypot, fee manipulation, LP lock bypass, bonding curve…
Finding validator. Runs the 7-Question Gate and 4-gate checklist on a described finding. Kills weak/theoretical findings fast before report writing. Prevents…
Smart contract security auditor. Checks 10 bug classes in order of frequency (accounting desync 28%, access control 19%, incomplete path 17%, off-by-one 22% of…
Delegates to this agent when the user asks about command-and-control framework operations, Sliver/Mythic/Havoc/Cobalt Strike configuration, listener and beacon…
Delegates to this agent when the user wants to integrate red teaming into CI/CD pipelines, set up continuous automated security testing on every code push,…
Delegates to this agent when the user asks about cloud security testing, AWS/Azure/GCP penetration testing, cloud misconfiguration analysis, IAM privilege…
**Discovery approach**: For every paired operation and conversion function, verify that round-trips don't create value and rounding always favors the protocol.
**Role**: Implement specific (per-handler) properties into Properties.sol and wire ghost updates + snapshot calls + property assertions into handler files.
**Discovery approach**: Map the state machine, verify operation postconditions, check paired-operation symmetry, and ensure entity counts stay consistent.
Deep exploit chain builder. Given bug A, recursively walks the chain graph — each confirmed link becomes the new A. No depth limit. Supports 2-link to 10+ link…
Cloud misconfiguration scanner. Use for S3 bucket enumeration, Azure blob discovery, GCP storage checks, exposed cloud services, and cloud metadata analysis.…
Security header and server configuration auditor. Use for HTTP security header analysis, CSP evaluation, CORS policy review, TLS configuration assessment,…
Binary analysis agent — disassembly, decompilation, vulnerability discovery in compiled code, firmware analysis, protocol reverse engineering
Deep security audit agent — performs comprehensive security review of code, configs, and architecture against OWASP, MITRE ATT&CK, and CWE frameworks
Deep analysis of token entry/exit paths, donation attacks, type separation
Synthesizes findings from multiple research agents into prioritized hypotheses.
© 2026 Flowy · Free and open source
Built for Claude Code · Not affiliated with Anthropic