attack
Route an attack vector to the appropriate specialist agent — usage: /project:attack <target> <vector>
A command is the one you type. It runs exactly when you ask it to, and never before.
98 commands across 241 plugins.
Route an attack vector to the appropriate specialist agent — usage: /project:attack <target> <vector>
Start a new engagement for a target — verifies scope, creates evidence directories, and launches recon agent
List makoto's integrity pattern catalog (read-only)
Query NVD and OSV.dev for existing CVEs. Usage: /check-nvd <package-name>. Shows CVE count, severity breakdown, and recent fixes.
Take a confirmed vulnerability pattern and find the same bug in similar packages. Usage: /cross-pollinate (run after confirming a finding).
Run the 6-gate false positive elimination process on the current finding. Usage: /fp-check (run from a target directory with findings).
Hardstop - Pre-execution safety layer for shell commands. Shows status and help.
Test for a specific vulnerability class against target endpoints using curated payloads.
Full security audit of a Solidity/Vyper/Rust contract or directory. Runs the entire vuln-skills library and dispatches DeFi specialist subagents based on…
Audit only the git diff vs main (or specified base). Optimized for PR review.
Deep audit — same as /audit but spawns more parallel subagents, runs multi-pass review, and chases exploit chains across files.
Open the subscribetome dashboard to view and manage API keys and subscriptions
Scan .env files for existing API keys to import into subscribetome
Show the subscribetome inventory — API keys, subscriptions, and monthly spend
Apply code-level fixes for ALL validated findings, one at a time — modifies the target repository's source code
Apply a code-level fix for a finding from /vantage:scan-diff's commit/PR/MR scan — modifies the target repository's source code
Apply a code-level fix for one validated finding by id (e.g. F-001) — modifies the target repository's source code
Incident response workflow — triage, evidence collection, timeline, and IOC extraction
Post-exploitation workflow after getting shell access — privesc, credential harvest, lateral movement
Generate a professional penetration test report from all evidence files
Full CVE hunting pipeline. Usage: /hunt <package-name>. Orchestrates all agents: registry check, clone, code review, PoC build, validation, and report…
Find targets in a category. Usage: /recon <category>. Examples: /recon csv-parsers, /recon template-engines, /recon archive-libs.
Query or update the research registry. Usage: /registry [query]. Examples: /registry stats, /registry check lodash, /registry list in-progress.
Define and authorize the target scope for a penetration testing engagement. This is the **mandatory first step** — all other commands refuse to run without an…
Display the engagement progress dashboard. Read-only — does not modify any state files.
Run the 6-gate strict quality gate on unvalidated findings.
Audit third-party dependencies — resolve installed versions, cross-reference known-vulnerable releases, and flag vendored code that has diverged from upstream.
Diff two Rugproof audit reports (before vs after) to track regressions — what's new, what's fixed, and whether the grade moved.
Pull past public audits (Code4rena, Sherlock, Spearbit, etc.) for a deployed contract or known protocol.
Scan only the changed files in a single commit or PR/MR for newly introduced vulnerabilities (fast incremental check, not a full pipeline run)
Run the full mobile SAST pipeline (phases 01-06) against this repository — Android, iOS, React Native, or Flutter
© 2026 Flowy · Free and open source
Built for Claude Code · Not affiliated with Anthropic