ciso
Acts as a security executive: sets strategy, quantifies and communicates cyber risk in business terms, prioritizes the program by risk and budget, and prepares…
An agent is a specialist Claude hands a whole job to, with its own tools and its own context.
8,242 agents across 643 plugins.
Acts as a security executive: sets strategy, quantifies and communicates cyber risk in business terms, prioritizes the program by risk and budget, and prepares…
Advises technology leadership on security at strategic scale — secure-by-design programs (paved roads, guardrails, enablement) and technology-risk decisions…
A secure-by-default coding companion for developers and engineers — including AI-assisted/agentic ("vibe coding") workflows. Use when writing a new…
Review persona: senior software architect lens for any codebase. Use for architecture review or grading of a project's shape: folder structure and module…
Diagnoses CI pipeline failures. Parses build logs, identifies root causes across linting, testing, and deployment stages, and provides structured recovery…
Expert code review specialist with severity-rated feedback, logic defect detection, SOLID principle checks, style, performance, and quality strategy
Reduce unnecessary complexity while preserving behavior, validation, and readability.
Dispatched leaf for content-quality analysis — scores E-E-A-T (experience, expertise, authoritativeness, trust), readability, depth/thin-content, originality,…
Dispatched leaf for e-commerce SEO — audits product/category on-page signals, validates Product schema for merchant eligibility, and checks image and…
Dispatched leaf for generative-engine optimization — scores passage-level citability, counts structured-data blocks, reads the robots AI-crawler policy, checks…
Expert code review specialist. Proactively reviews code for quality, security, and maintainability. Use immediately after writing or modifying code. MUST BE…
Independent, read-only acceptance grader. Invoked at the end of a task to verify it is REALLY done. Default-FAIL — every criterion starts false and only flips…
GAN Harness — Evaluator agent. Tests the live running application via Playwright, scores against rubric, and provides actionable feedback to the Generator.
Бизнес-интервью с предпринимателем для извлечения требований и заполнения CLAUDE.md + domain-rules.yaml. Один-два вопроса за раз, бизнес-язык, без жаргона.
Критический Opus-ревьюер модели данных ПЕРЕД реализацией схемы БД / миграций / RLS в проекте пользователя. Fresh context, НЕ соглашается по умолчанию. Ищет…
Готовит бриф для Claude Design (claude.ai/design) по формуле C.R.O.P. (Context / Requirements / Output / Patterns). Плагин не рисует UI сам — готовит handoff.…
Drafts implementation plans for new features. MUST be invoked before any code implementation begins. Reads the user's prompt and any linked external docs as…
You are a specialized **Web Asset Producer** agent with deep expertise in generating production-ready visual assets for web development projects. Your role is…
Sub-agent that validates whether a downloaded PDF matches the expected metadata (author, title, year). Anti-homonymy check on page 1. Invoke when a manual page…
Sub-agent that performs exhaustive multi-source academic search (paper-search MCP across 22 platforms + optional NotebookLM + optional WebSearch). Returns…
Sub-agent that decides what to do with incomplete textbook references in the registry. Takes a JSON list of candidates (refs with year=0000 or title=empty,…
Use to resolve findings on an existing pull request - review comments, CI failures, and self-review findings - fixing code, updating tests, re-verifying gates,…
Use for high-signal review of a diff or pull request in any codebase, with emphasis on scope (PR intent), correctness, contract drift, security,…
Use for a focused security pass on a diff or pull request - authorization, secrets, input validation, data exposure, webhook verification, and OWASP-style…
Runs Track 5 (product & launch readiness) of the Preflight Security Audit — accessibility (WCAG 2.1 AA), technical SEO, Core Web Vitals, monitoring/alerting,…
Runs Track 4 (privacy & compliance) of the Preflight Security Audit — PII inventory & data flow, GDPR/KVKK consent & lawful basis, cookie consent, data…
Runs Track 2 (web/app security) of the Preflight Security Audit — XSS, CSRF, SSRF, security headers/CORS/TLS, cryptography, file upload, rate limiting,…
The `xhigh` rung of `cad-executor`; `bin/route.mjs` picks it, not the user.
The `low` rung of `cad-plan-checker` (goal-backward plan gate); `bin/route.mjs` picks it, not the user.
The `high` rung of `cad-plan-checker`; `bin/route.mjs` picks it, not the user.
Stage 1 peer code reviewer focused on memory safety, modern C++ idioms, and undefined behavior.
Stage 1 peer code reviewer focused on idiomatic Go, error handling, and concurrency patterns.
Stage 1 peer code reviewer focused on JVM idioms, Spring/Android patterns, and null safety.
You are a security auditor focused on protecting API keys, preventing credentials leaks, and securing Webhook entry points.
Invoke after a developer commit to run build, test, and lint and emit a BMAD-style PASS/CONCERNS/FAIL gate verdict as JSON. Read-only; never modifies code.
SAST specialist for OWASP Mobile M7:2024 Insufficient Binary Protections. Invoke during mobile Phase 03 Testing after…
SAST specialist for business-logic vulnerabilities (race conditions, workflow bypass, price/grade/quantity tampering). Invoke during Phase 03 Testing after…
SAST specialist for OWASP Mobile M1:2024 Improper Credential Usage. Invoke during mobile Phase 03 Testing after artifacts/mapping/mobile-attack-surface.json…
Use as the top-level orchestrator at the start of any new app project, or when the user wants strategic direction, scope decisions, prioritization tradeoffs,…
© 2026 Flowy · Free and open source
Built for Claude Code · Not affiliated with Anthropic