36 tagged blue team, measured the same way as everything else here.
Browse within: ai-security 28Autonomous Agents 27bug-bounty 27cybersecurity 9
Agent Claude Code
Active Directory and Windows domain attack specialist. Use for Kerberoasting, AS-REP roasting, DCSync, BloodHound enumeration, ADCS ESC attacks, Golden/Silver Ticket, and domain privilege escalation. Triggers on: kerberoast, AS-REP, bloodhound, DCSync, golden ticket, ADCS, ESC, domain controller, LDAP, GPO, AD, domain…
Agent Claude Code
API security testing specialist for REST, GraphQL, gRPC, and WebSocket APIs. Handles BOLA/IDOR, mass assignment, authentication bypass, rate limit evasion, JWT attacks, GraphQL introspection abuse, API enumeration, and OWASP API Top 10. Triggers on: API, REST, GraphQL, gRPC, WebSocket, BOLA, IDOR, mass assignment, API…
Agent Claude Code
Password cracking and credential attack specialist. Use when working with password hashes, hash cracking, wordlist attacks, credential analysis, or password auditing. Triggers on: password, hash, crack, hashcat, john, wordlist, NetNTLMv2, Kerberoast, NTLM, bcrypt, credential, ASREP, JWT crack, mask attack, rule…
lucasrosati/claude-security-agents
Agent
Defensive security specialist. Use to apply vulnerability fixes, security hardening, security headers implementation, rate limiting, and automated security tests. Works on top of red-team-scanner reports.
lucasrosati/claude-security-agents
Agent
Offensive security specialist. Use for vulnerability analysis, codebase pentesting, and OWASP Top 10 security report generation.
Agent Claude Code
Reviews schema, config, migration, prompt, and preset changes for drift against this repo's contract sources of truth (src/database/models.py, src/config/workflowconfigschema.py, docs/contracts/.md). Use PROACTIVELY before committing any change that touches models.py, workflowconfigschema.py, scripts/migrate…
Agent Claude Code
Adversarial security review of changes touching authentication, authorization, audit logging, session/CSRF handling, scraper ingestion (SSRF surface), deserialization (pickle/joblib/yaml), or SQL construction. Use PROACTIVELY before committing changes in src/web/ auth/session code, auditservice, scraper/OCR ingestion…
Agent Cursor
Design and product context authority for Huntable CTI Studio. Responds to getdesigncontext and similar requests from ui-designer and other agents. Use proactively when any agent requests design context, brand guidelines, or design system details.
Agent
Detection-engineering agent — writes Sigma rules, translates to SPL/KQL/EQL, validates via test harness (atomic-red-team / MITRE Caldera / lab replay), with ATT&CK coverage mapping and false-positive discipline. Delivers ready-to-deploy rules plus test evidence per rule.
Agent
Attack-surface reconnaissance agent — subdomain enumeration, passive OSINT (Shodan/Censys/crt.sh), port scanning (nmap/masscan/naabu), tech fingerprinting (httpx/wappalyzer), and asset inventory. Produces a scope-mapped surface report for downstream exploit-chain and web-exploit-triage work.
Agent
STRIDE and LINDDUN threat-modeling agent for a service, feature or integration. Builds a DFD, enumerates threats per element, ranks mitigations and flags residual risk.
Agent
This guide provides instructions for creating cs- prefixed agents that orchestrate the USAP skill packages.