Agent
Claude Code agents for Security
Flowy lists 424 subagents for Security, and the most-starred are dependency-review (from the 22,851-star nemoclaw plugin), 0-preflight (from the 7,851-star trailofbits-skills plugin) and 1-mcp-resolver (from the 7,851-star trailofbits-skills plugin). The newest push among those Security subagents, on October 28, 2026, went to the trailofbits-skills plugin.
dependency-review 0-preflight Agent0-preflight
Performs preflight validation, config merging, TU enumeration, and work directory setup for zeroize-audit. Produces…
@trailofbitsInstall Agent1-mcp-resolver Agent1-mcp-resolver
Resolves symbol definitions, types, and cross-file references using Serena MCP for zeroize-audit. Runs before source analysis so…
@trailofbitsInstall Agent2-source-analyzer Agent2-source-analyzer
Identifies sensitive objects, detects wipe calls, validates correctness, and performs data-flow/heap analysis for zeroize-audit.…
@trailofbitsInstall Agentautopilot Agentautopilot
Autonomous hunt loop agent. Runs the full hunt cycle (scope → recon → rank → hunt → validate → report) without stopping for…
@awarexoneInstall Agentchain-builder Agentchain-builder
Exploit chain builder. Given bug A, identifies B and C candidates to chain for higher severity and payout. Knows all major chain…
@awarexoneInstall Agentcredential-hunter Agentcredential-hunter
Autonomous credential-attack pipeline runner. Chains /wordlist-gen + /osint-employees + /breach-check (data-prep stages, runs…
@awarexoneInstall Agentautopilot Agentautopilot
Autonomous hunt loop agent. Runs the full hunt cycle (scope → recon → rank → hunt → validate → report) without stopping for…
@shuvonsecInstall Agentchain-builder Agentchain-builder
Exploit chain builder. Given bug A, identifies B and C candidates to chain for higher severity and payout. Knows all major chain…
@shuvonsecInstall Agentcredential-hunter Agentcredential-hunter
Autonomous credential-attack pipeline runner. Chains /wordlist-gen + /osint-employees + /breach-check (data-prep stages, runs…
@shuvonsecInstall AgentSELF-TEST AgentSELF-TEST
This document verifies that the `jwx-dev-v4:guide` skill enables an answering agent to navigate the **scattered** documentation…
@lestrrat-goInstall Agentcompanion-template-sync Agentcompanion-template-syn…
Pull newest GitHub Actions versions from companion repos back into `.companions/templates/`. Dependabot updates each companion…
@lestrrat-goInstall Agentcompanions Agentcompanions
Extension modules under `github.com/jwx-go/*` (asmbase64, compsig, ed448, es256k, examples, jwkfetch, jwxfilter, jwxmigrate,…
@lestrrat-goInstall Agentad-attacker Agentad-attacker
Delegates to this agent when the user wants to perform Active Directory attacks, run BloodHound analysis, use Impacket tools,…
@0xstephInstall Agentai-recon Agentai-recon
Delegates to this agent when the user wants to map the AI attack surface of an authorized web application before validation —…
@0xstephInstall Agentapi-security Agentapi-security
Delegates to this agent when the user asks about API security testing, REST API attacks, GraphQL exploitation, OAuth/OIDC…
@0xstephInstall Agentadversarial-profit-maximizer Agentadversarial-profit-max…
**Discovery approach**: Think like an attacker. What would maximize extracted value? What sequence breaks liveness? What edge…
@pashovInstall Agentconservation-auditor Agentconservation-auditor
**Discovery approach**: For every aggregate/total variable, write a "sum of individual parts = tracked whole" property. This is…
@pashovInstall Agentglobal-property-implementer Agentglobal-property-implem…
**Role**: Implement global properties into Properties.sol, wire ghost variables into Base.sol, and populate Snapshots.sol. These…
@pashovInstall Agentauth-tester Agentauth-tester
Authentication and session management testing agent. Use for login bypass, session fixation, password reset flow abuse, MFA…
@h-mmerInstall Agentbrain Agentbrain
Central knowledge coordinator. Use BEFORE launching any other pentest agent to get context on what's already been tried. Also use…
@h-mmerInstall Agentbrowser-agent Agentbrowser-agent
Browser automation agent for interactive web testing. Use for login flows, multi-step CSRF, stored XSS verification in other user…
@h-mmerInstall Agentghidra-api-expert AgentAuto-invokedghidra-api-expert
Use this agent when you need expert guidance on Ghidra API usage, plugin/extension development, or troubleshooting integration…
@cyberkaidaInstall Agentreva-setup-installer AgentAuto-invokedreva-setup-installer
Use this agent when:\n1. The project is being set up for the first time\n2. Build failures occur with errors about…
@cyberkaidaInstall Agentexecutioner Agentexecutioner
Optional Sanhedrin fallback verifier. Decomposes a draft into check-worthy claims, checks high-trust durable Vestige evidence,…
@samvallad33Install Agentlateral-thinker Agentlateral-thinker
Subconscious subagent that surfaces cross-disciplinary structural parallels from the Vestige memory graph. Invoked by the…
@samvallad33Install Agentsynthesis-composer Agentsynthesis-composer
Optional decision helper that turns Vestige retrievals into concise recommendations. Use for high-stakes technical choices,…
@samvallad33Install Agentclean-implementer Agentclean-implementer
Use this agent when you need to implement a design, feature, or refactor code with an emphasis on clean architecture,…
@provosInstall Agentfeature-architect Agentfeature-architect
Use this agent when designing new features, planning component interfaces, defining type hierarchies, or architecting…
@provosInstall Agentpython-code-simplifier Agentpython-code-simplifier
Simplifies and refines Python code for clarity, consistency, and maintainability while preserving all functionality. Focuses on…
@trailofbitsInstall Agentfinding-verifier Agentfinding-verifier
Read-only adversarial verifier for ONE candidate security finding. Given the candidate (title, location, trace, evidence, claimed…
@briiirussellInstall Agentagent-01-decompiler Agentagent-01-decompiler
你是微信小程序反编译专家，负责将小程序包反编译为可读源码，并生成完整的文件资产清单。 **重点**：用户提供的目录下可能有多个子目录（每个子目录对应不同的小程序或子包），你必须对所有子目录逐一检测和反编译，不得遗漏。
@sssmmmwwwInstall Agentagent-02-secret-scanner Agentagent-02-secret-scanne…
你是安全敏感信息分析专家，负责基于 **Python 脚本预扫描的结果**（`raw_secrets.json`），对微信小程序中发现的敏感信息进行**智能分析、误报过滤、上下文判断和风险评级**。
@sssmmmwwwInstall Agentagent-03-endpoint-miner Agentagent-03-endpoint-mine…
你是微信小程序接口分析专家，负责基于 **Python 脚本预扫描的结果**（`raw_endpoints.json`），对提取到的接口进行**智能关联分析**：BaseURL 与路径片段的语义关联、接口去重与规范化、HTTP…
@sssmmmwwwInstall Agentai-researcher Agentai-researcher
AI/ML research agent — model architecture analysis, training optimization, mechanistic interpretability, safety alignment,…
@hypnguyen1209Install Agentexploit-researcher Agentexploit-researcher
Vulnerability research agent — identifies CVEs, finds exploit PoCs, maps attack chains, and develops custom exploitation…
@hypnguyen1209Install Agentfinding-checker Agentfinding-checker
Blind adversarial checker — given ONLY a finding artifact and its evidence (never the author's reasoning), tries to refute it and…
@hypnguyen1209Install AgentAGENT AgentAGENT
Review the current repository for CodeGuard rule violations and emit SARIF 2.1.0 findings. Use when the user explicitly asks for…
@cosai-oasisInstall Agentdashclaw-drift-auditor Agentdashclaw-drift-auditor
Audits DashClaw's drift-prone hardcoded counts and version stamps — SDK method counts (Node/Python), MCP tool/resource counts,…
@ucsandmanInstall Agentdashclaw-gate-runner Agentdashclaw-gate-runner
Runs the DashClaw verification gates (lint, full vitest suite, build, contract checks) and returns ONLY the failures plus a…
@ucsandmanInstall Agentdashclaw-security-reviewer Agentdashclaw-security-revi…
Read-only security reviewer specialized for the DashClaw stack (Next.js 16 App Router, Neon/Postgres via repositories, API-key…
@ucsandmanInstall Agentadvanced Agentadvanced
Part of the Aptos Verification Protocol skill. Read `SKILL.md` for the core workflow first.
@plamentsvInstall Agentdepth-consensus-invariant Agentdepth-consensus-invari…
L1 mode - deep analysis of consensus safety/liveness invariants, non-determinism sources, Byzantine-scenario reasoning, and…
@plamentsvInstall Agentdepth-edge-case Agentdepth-edge-case
Zero-state return, dust analysis, boundary conditions with real constants
@plamentsvInstall Agentsecurity-reviewer Agentsecurity-reviewer
Specialized agent for comprehensive code security reviews
@backbay-labsInstall Agentad-discovery-agent Agentad-discovery-agent
Active Directory discovery subagent for red-run. Performs AD enumeration, BloodHound collection, LDAP queries, and attack surface…
@blacklanternsecurityInstall Agentad-exploit-agent Agentad-exploit-agent
Active Directory exploitation subagent for red-run. Executes one AD technique skill per invocation as directed by the…
@blacklanternsecurityInstall Agentcredential-cracking-agent Agentcredential-cracking-ag…
Credential cracking subagent for red-run. Performs offline hash cracking and encrypted file cracking using hashcat and john as…
@blacklanternsecurityInstall Agent
Questions
What is the best Security subagent for Claude Code?
By the GitHub stars of the plugin each ships in (Flowy does not rate quality), the best Security subagent for Claude Code is dependency-review (from the 22,851-star nemoclaw plugin), ahead of 0-preflight (from the 7,851-star trailofbits-skills plugin) and 1-mcp-resolver (from the 7,851-star trailofbits-skills plugin).
How many Security subagents are there?
Flowy lists 424 subagents for Security, and this page draws the top 48 Security subagents.
Security in other kinds
Other subagent categories
- Development5,722
- Agent Orchestration1,436
- AI & Agents809
- Automation687
- Testing280
- Content233
- Marketing192
- Productivity191
- Monitoring143
- Writing128
- Product103
- Skill Authoring93
- Research91
- Design74
- Agent Workspaces72
- Data72
- Agent Memory67
- Documentation61
- Mobile59
- Business57
- Operations54
- Finance47
- Machine Learning41
- Education39
- Cloud & Infrastructure38
- Legal29
- MCP Servers25
- Code Generation22
- Code Review21
- Spec-Driven Development18
- Databases16
- Backend11
- SEO10
- Video & Audio10
- Debugging9
- Deployment9
- Frontend9
- Career8
- Data Science6
- Presentations6
- Sales6