0-preflight
Performs preflight validation, config merging, TU enumeration, and work directory setup for zeroize-audit. Produces merged-config.yaml, preflight.json, and…
An agent is a specialist Claude hands a whole job to, with its own tools and its own context.
200 agents across 361 plugins.
Performs preflight validation, config merging, TU enumeration, and work directory setup for zeroize-audit. Produces merged-config.yaml, preflight.json, and…
Resolves symbol definitions, types, and cross-file references using Serena MCP for zeroize-audit. Runs before source analysis so enriched type data is…
Identifies sensitive objects, detects wipe calls, validates correctness, and performs data-flow/heap analysis for zeroize-audit. Produces the sensitive object…
Inspects Content Security Policy headers for policy weaknesses and tests bypass vectors including unsafe-inline, unsafe-eval, wildcard sources, JSONP…
Tests for CSRF vulnerabilities including missing tokens, weak validation, SameSite bypass, token reuse, and method override. Generates browser-loadable PoC…
Identifies technology stacks, researches known CVEs in NVD/Exploit-DB/GitHub, adapts public PoC exploits, and validates exploitability against live targets.…
Active Directory and Windows domain attack specialist. Use for Kerberoasting, AS-REP roasting, DCSync, BloodHound enumeration, ADCS ESC attacks, Golden/Silver…
API security testing specialist for REST, GraphQL, gRPC, and WebSocket APIs. Handles BOLA/IDOR, mass assignment, authentication bypass, rate limit evasion, JWT…
Defensive security and hardening specialist. Creates detection rules, hardens Linux/Windows systems, writes Sigma rules, configures auditd, fail2ban, Sysmon,…
Detects and analyzes system threats, malware, and security vulnerabilities on Windows systems. Use for system scanning, browser hijacking detection, Windows…
PoC builder and exploit chainer. Takes Hunter findings and builds working proof-of-concept exploits. Always seeks to escalate impact through vulnerability…
Code review specialist. Performs deep source code analysis to find security vulnerabilities by tracing data flows from untrusted input sources to dangerous…
Target discovery agent. Finds promising open source packages for security review by analyzing npm/PyPI/GitHub registries, download counts, and attack surfaces.
Analyzes extracted session messages across 8 behavioral dimensions to produce a scored developer profile with confidence levels and evidence. Spawned by…
Explores codebase and writes structured analysis documents. Spawned by map-environment with a focus area (tech, arch, quality, concerns). Writes documents…
Verifies cross-phase integration and E2E flows. Checks that phases connect properly and user workflows complete end-to-end.
You are a creative, persistent vulnerability hunter. You think like an attacker — not just running payloads from a list, but understanding the application's…
You are a methodical, thorough reconnaissance specialist. You think in checklists and never skip a step. Your job is to build a complete picture of the…
You are a skeptical, adversarial quality gate. Your job is to assume **every finding is a false positive until proven otherwise.** You are not adversarial…
Use this agent when the user asks to "understand the application", "map the codebase", "analyze the architecture", "identify trust boundaries", "map user…
Autonomous attack vector exploration agent that hypothesizes novel attack vectors, tests them against the codebase, and iterates. Use when the standard scan…
Use this agent when the user asks to "review code for security", "find vulnerabilities", "security audit", "analyze for security issues", or when exploring a…
Account-Abstraction (ERC-4337) specialist. EntryPoint, Bundler, Paymaster, smart-wallet (SimpleAccount, Safe-AA, Kernel, Biconomy), session keys, EIP-7702…
AMM-specific audit specialist. Uniswap V2/V3/V4, Curve, Balancer, Berachain BEX, custom AMMs. Use when the target is an AMM, pool, router, or AMM fork. V4…
Specialist for inline assembly / Yul. Reviews memory layout, return-data handling, dirty-bits, opcode usage. Use whenever significant assembly is present.
Pinned known-good config shapes the 8 writers target, with the official source + retrieval date. The MEDIUM/LOW (volatile) surfaces carry a **live-verification…
Builds and operationalizes AI safety — turning safety assessments into shipped safeguards: safety evals in CI/CD, guardrail integration, monitoring and drift…
Senior AI safety reviewer for an end-to-end SAFETY assessment of a model or feature — harm modeling, safety evaluation, responsible red-teaming, bias/…
Coordinates defensive operations end to end — detection engineering, incident response, threat hunting, and threat intelligence — using threat-informed…
Runs Track 3 (AI/LLM security) of the Preflight Security Audit — prompt injection (direct + indirect), LLM output handling, sensitive-info disclosure,…
Runs Track 1 (the 20 code-core passes) of the Preflight Security Audit — injection, auth, authz/IDOR, secrets, error handling, concurrency, resources, N+1,…
Runs Track 6 (verification & false-positive filter) of the Preflight Security Audit. Re-checks every raw finding against the code, rejects unprovable ones,…
SAST specialist for API-layer vulnerabilities: JWT attacks, GraphQL introspection/batching abuse, mass assignment, BFLA. Invoke during Phase 03 Testing after…
SAST specialist for authentication vulnerabilities (login/session/MFA/SSO bypass, weak password reset, JWT/session flaws). Invoke during Phase 03 Testing after…
SAST specialist for authorization vulnerabilities: IDOR, BOLA, BFLA, privilege escalation, mass assignment. Invoke during Phase 03 Testing after…
Performs source-level zeroization analysis for Rust crates in zeroize-audit. Generates rustdoc JSON for trait-aware analysis and runs token-based dangerous API…
Performs per-TU compiler-level analysis (IR diff, assembly, semantic IR, CFG) for zeroize-audit. One instance runs per translation unit, enabling parallel…
Performs crate-level MIR and LLVM IR analysis for Rust in zeroize-audit. A single instance runs per crate (unlike 3-tu-compiler-analyzer which runs one per…
Performs comprehensive domain reconnaissance including passive and active subdomain discovery (subfinder, amass, certificate transparency), port scanning…
Tests for SQL injection, NoSQL injection, and OS command injection across HTTP parameters, JSON bodies, and headers. Uses sqlmap for automated SQLi detection…
Discovers REST API endpoints, GraphQL schemas, SOAP/WSDL services, WebSocket connections, and API documentation (Swagger/OpenAPI/Postman). Enumerates versioned…
Command and control infrastructure specialist for authorized red team operations. Handles Sliver C2 framework, Havoc C2, Metasploit multi-handler, msfvenom…
© 2026 Flowy · Free and open source
Built for Claude Code · Not affiliated with Anthropic