check-nvd
Query NVD and OSV.dev for existing CVEs. Usage: /check-nvd <package-name>. Shows CVE count, severity breakdown, and recent fixes.
A command is the one you type. It runs exactly when you ask it to, and never before.
523 commands across 665 plugins.
Query NVD and OSV.dev for existing CVEs. Usage: /check-nvd <package-name>. Shows CVE count, severity breakdown, and recent fixes.
Take a confirmed vulnerability pattern and find the same bug in similar packages. Usage: /cross-pollinate (run after confirming a finding).
Run the 6-gate false positive elimination process on the current finding. Usage: /fp-check (run from a target directory with findings).
Upload and analyze a suspicious binary file using the remote Dr. Binary MCP tools
Detect browser hijacking including homepage changes, search engine modifications, and malicious extensions
Monitor active network connections and detect suspicious network activity
Test for a specific vulnerability class against target endpoints using curated payloads.
Generate tests for a completed phase based on Evidence Review criteria and implementation
Hardstop - Pre-execution safety layer for shell commands. Shows status and help.
Print the gitleaks release sha256 for a version, formatted for direct paste into a GitHub Actions workflow or `agent-guard setup --install`. Pass an optional…
Run a deterministic one-shot secret scan over the repository's pending changes (staged content, unstaged worktree edits, and untracked files; gitignored paths…
[experimental] Auto-remediate verified findings by generating patches and optionally creating a PR
[experimental] Create a custom Semgrep detection rule from a confirmed vulnerability pattern
[stable] Compare security posture between two git refs to find new/fixed vulnerabilities and track regression
Show guardrails status, switch modes, set token cap, or view the audit log. Usage: /guardrails [status|log|strict|relaxed|audit|reset|policy|tokencap]
Full static analysis workflow — PE headers, strings, disassembly, classification
API security audit — REST, GraphQL, JWT analysis, parameter discovery
Archive or list previous engagement snapshots
Launch the AKA web dashboard in your browser (reads your local store)
List installed AKA detection packs, versions, and available updates
Full security audit of a Solidity/Vyper/Rust contract or directory. Runs the entire vuln-skills library and dispatches DeFi specialist subagents based on…
Audit only the git diff vs main (or specified base). Optimized for PR review.
Deep audit — same as /audit but spawns more parallel subagents, runs multi-pass review, and chases exploit chains across files.
Run a compliance gap-assessment for a framework, tie gaps to risk, and produce findings + remediation.
Build a board/executive security brief — strategy, quantified risk, and a board-ready deck.
Run a threat-informed defense cycle for a technique or threat — coverage check, hunt, detection, and purple-team validation.
Open the subscribetome dashboard to view and manage API keys and subscriptions
Show the subscribetome inventory — API keys, subscriptions, and monthly spend
Apply code-level fixes for ALL validated findings, one at a time — modifies the target repository's source code
Apply a code-level fix for a finding from /vantage:scan-diff's commit/PR/MR scan — modifies the target repository's source code
Apply a code-level fix for one validated finding by id (e.g. F-001) — modifies the target repository's source code
Safely analyzes and cleans up local git branches and worktrees, categorizing them as merged, squash-merged, superseded, or active work before deleting anything.
Probe a 403/401 endpoint with the most-paid bypass tricks (header injection, path encoding, method swap, WAF fingerprint, vendor-specific). Wraps byp4xx when…
Build an exploit chain — given bug A, finds B and C to combine for higher severity and payout. Knows common chain patterns: IDOR→ATO, SSRF→cloud metadata,…
© 2026 Flowy · Free and open source
Built for Claude Code · Not affiliated with Anthropic