security-verifier
Writes and runs PoC tests to verify hypotheses. Returns CONFIRMED or FALSE_POSITIVE.
An agent is a specialist Claude hands a whole job to, with its own tools and its own context.
355 agents across 675 plugins.
Writes and runs PoC tests to verify hypotheses. Returns CONFIRMED or FALSE_POSITIVE.
Password spraying subagent for red-run. Executes credential spraying against any authentication service (AD, web forms, SSH, etc.) as directed by the…
Pivoting and tunneling subagent for red-run. Sets up network tunnels through compromised hosts to reach internal subnets. Handles SSH tunnels, sshuttle,…
Deep analysis subagent for red-run. Analyzes custom applications, binaries, and scripts that standard technique skills could not crack. Performs source code…
Runs active directory and file brute-forcing using ffuf, gobuster, feroxbuster, nikto, and dirsearch to discover directories, files, backup files,…
Discovers JavaScript-rendered pages, SPA client-side routes, dynamically-loaded scripts, AJAX-triggered endpoints, and hidden features invisible to standard…
Identifies and catalogs all dependencies, frameworks, libraries, and versions across backend and frontend stacks. Generates a Software Bill of Materials (SBOM)…
Container and Kubernetes security specialist. Handles Docker escape techniques, Kubernetes RBAC abuse, service account token theft, kubelet API exploitation,…
Cryptography and TLS security specialist. Handles TLS configuration auditing, JWT algorithm confusion, padding oracle attacks, hash cracking mode selection,…
Digital forensics and incident response specialist. Handles triage, memory acquisition with AVML/LiME, Volatility analysis, log timeline reconstruction, IOC…
Builds the pre-review threat model before any verdict — asset inventory, actor x capability table, and trust-boundary map — reconstructed from the code and the…
Walks in-scope files item-by-item against the gated checklists and phase-triggered known-vectors, recording an explicit verdict for every item and routing…
Creates executable phase plans with task breakdown, dependency analysis, and goal-backward validation. Spawned by /hunt:plan orchestrator.
Creates project huntmaps with phase breakdown, requirement mapping, success criteria derivation, and coverage validation. Spawned by /hunt:new-program…
Investigates bugs using scientific method, manages debug sessions, handles checkpoints. Spawned by /thrunt:debug orchestrator.
Use this agent when the user asks to "fix the vulnerability", "patch the code", "remediate the issue", "secure coding recommendation", or needs help with Phase…
Use this agent when the user wants to "write an exploit", "create a PoC", "develop proof of concept", "automate the attack", or needs help creating exploit…
Use this agent when the user asks to "create a threat model", "analyze threats", "STRIDE analysis", "what are the threats", "threat modeling", "identify attack…
Use this agent when the user asks to "run recon", "enumerate a target", "do reconnaissance", "scan subdomains", "map the attack surface", "discover endpoints",…
Blue team. Identifies missing defenses, weak invariants, and remediation gaps. Use alongside attacker for balanced review.
Rug-pull, tokenomics, and centralization deep-dive. Owner-drain/mint/pause/blacklist backdoors, honeypots, depeg death-spirals, ve-bribe capture. Emits a 0-100…
Writes Foundry test files that prove an exploit. The test MUST compile and pass. Use from /exploit, /exploit-chain, /exploit-live.
When Claude should delegate to this agent. Describe the end-to-end task it owns (e.g. "Run a full LLM security assessment of a feature, from threat model to…
Runs governance, risk & compliance work — framework gap-assessments (SOC 2 / ISO 27001 / PCI / HIPAA / GDPR / NIST), security risk assessment and the risk…
Senior AI security reviewer for an end-to-end assessment of an LLM / RAG / agentic feature — from threat model through OWASP LLM Top 10 and prompt-injection…
SAST specialist for vulnerable dependencies (SCA against known CVEs), scoped to Medium-Critical impact only. Invoke during Phase 03 Testing as a repo-wide task…
Applies code-level remediation for a validated SAST finding (web or mobile). Invoked explicitly by /vantage:fix-issue <finding-id> (one finding), /vantage:fix…
SAST specialist for server-side injection (command injection, SSTI, SSRF, path traversal, XXE, LDAP injection), scoped to Medium-Critical impact only. Invoke…
Verifies that each zeroize-audit PoC actually proves the vulnerability it claims to demonstrate. Reads PoC source code, finding details, and original source to…
Generates runtime validation test harnesses (C tests, MSAN, Valgrind targets) for confirmed zeroize-audit findings. Produces a Makefile for automated test…
Models attacker perspectives and builds exploit scenarios for HIGH RISK code changes. Use when differential review identifies high-risk changes that need…
Delegates to this agent when the user wants a secure-code review of application source — static analysis for injection, auth, secrets, deserialization, and…
Delegates to this agent when the user wants to map penetration-test findings to compliance frameworks — PCI DSS, NIST 800-53 / CSF, ISO 27001, CIS Controls,…
Delegates to this agent when the user asks about container escape, Docker breakout, Kubernetes pod escape, runc/containerd CVE exploitation, capability abuse,…
**Role**: Merge outputs from 5 specialized invariant discovery agents into a consolidated property plan that maps to the Fizz harness architecture.
Finding correlation engine. Use AFTER multiple agents have reported findings to discover attack chains. Combines individual findings into higher-impact chains…
CORS Misconfiguration specialist (H1 #58). Use for testing cross-origin resource sharing policies, origin reflection, null origin bypass, and…
CSRF specialist (H1 #57). Use for testing state-changing actions without proper token validation, SameSite cookie bypass, and CSRF in JSON/API endpoints.
Web application discovery subagent for red-run. Performs web application enumeration, technology fingerprinting, and vulnerability identification as directed…
Web application exploitation subagent for red-run. Executes one web technique skill per invocation as directed by the orchestrator. Handles injection testing,…
Windows privilege escalation subagent for red-run. Executes one privesc skill per invocation as directed by the orchestrator. Handles Windows host discovery,…
Synthesizes outputs from all four mapping agents (software-catalog, directory-scanner, api-discovery, javascript-mapper) into a unified attack surface report.…
On-demand PayloadsAllTheThings fetcher. Use when a pentest agent needs full payloads not in local payloads/ files. Input: PATT category name (see URL Map).…
Executes specific vulnerability tests. Follows 4-phase workflow (Recon → Experiment → Test → Verify), generates PoCs, captures evidence. Specialized by attack…
Antivirus and EDR evasion specialist for authorized red team engagements. Handles AMSI bypass, payload obfuscation, living-off-the-land techniques, sandbox…
Exploitation specialist for gaining initial access. Use when exploiting CVEs, running Metasploit modules, using searchsploit, obtaining shells, or executing…
IoT and embedded systems security specialist. Handles firmware extraction and analysis, hardcoded credential discovery, UART/JTAG access, MQTT/CoAP protocol…
Researches a single gray area decision and returns a structured comparison table with rationale. Spawned by shape-hypothesis advisor mode.
© 2026 Flowy · Free and open source
Built for Claude Code · Not affiliated with Anthropic