A command is the one you type. It runs exactly when you ask it to, and never before.
523 commands across 665 plugins.
Post-mortem investigation for failed THRUNT workflows — analyzes git history, artifacts, and state to diagnose what went wrong
[beta] Application understanding + threat modeling - maps architecture, generates DFDs, performs STRIDE analysis
[beta] Trace data flow from sources to a specific sink with explicit evidence requirements
[stable] Verify findings with Joern plus code review and update the shared findings artifact
Network service enumeration — SMB, RPC, NetBIOS, LDAP
Search and view the findings database
Weaponize confirmed findings into validated exploit packages
Run forge coverage, identify untested branches, generate tests to close gaps.
Run Rugproof against the bundled vulnerable example contracts — first-run "wow moment".
Diff the contract against a canonical reference implementation (OZ, Solady, Uniswap V3, etc.) and flag suspicious deltas.
Triage a SOC alert end-to-end — validate, enrich, decide, and escalate or close with rationale.
Out-of-band orchestrator — confirm BLIND SSRF/XXE/SQLi/RCE/Log4Shell by correlating interactsh callbacks to the payload that fired them. Usage: /oob --payloads…
Gather employee names + email patterns for password spray prep. Pipeline theHarvester (search engines + CT logs) -> derive names from email local-parts ->…
Discover hidden HTTP parameters on a URL or list of URLs using Arjun (or x8 fallback). Hidden params are gold for IDOR, SSRF, LFI, redirect, and authorization…
Generate ISO 27001 certification roadmap from readiness through surveillance audits
Set up GitHub Actions CI/CD with OIDC for keyless AWS authentication — automatic deployment on every push to main.
Materialize, lint, and drift-check the engagement threat model
Insert urgent work as decimal phase (e.g., 72.1) between existing phases
Ingest recon files to build engagement context and extract findings
Manage persistent target intelligence across sessions
Resume or execute an opsec campaign with progress tracking
Mark a finding as a false positive (or accepted risk). Future audits won't re-report it.
Explain a finding in plain English, with examples. Optionally tailored to a beginner audience.
Generate a working Foundry PoC that exploits a specific finding. Compiles and passes.
Pick up a previous hunt on a target — shows hunt history, untested endpoints, and memory-informed suggestions. Usage: /pickup target.com
Capture reproducible PoC evidence for a finding — raw request/response, copy-paste curl, HAR, optional screenshot, and a report-ready evidence.md. Secrets…
Scan a host for open ports and flag the NON-HTTP services the HTTP-only recon pipeline can't see (SSH, databases, Redis, Docker API, RDP). Usage: /portscan…
Return ranked Google documentation references for a control or implementation topic.
Query AWS for compliance-relevant configuration across IAM, S3, CloudTrail, EBS, and emit findings conforming to the v1 contract.
Surface Claude's assumptions about a phase approach before planning
Interactive command center for managing multiple project or hunt phases from one terminal
Clean logs, metadata, and forensic traces from a target system
Assess and apply OS hardening measures — firewall, SSH, kernel params, services, MAC
Rotate MAC address, hostname, DNS, and network identity markers
Chain multiple findings into a single multi-step exploit. Produces a Foundry test that proves the chain works.
Generate an exploit against a *deployed* contract on a fork. Validates the exploit works on live state.
Run the full recon pipeline by invoking tools/recon_engine.sh — subdomain enum (subfinder + amass + crt.sh + wayback), httpx live host probing with tech…
Log current finding or research signal to hunt memory. Auto-fills from /validate output if available. Usage: /remember
© 2026 Flowy · Free and open source
Built for Claude Code · Not affiliated with Anthropic