Tests for SQL injection, NoSQL injection, and OS command injection across HTTP parameters, JSON bodies, and headers. Uses sqlmap for automated SQLi detection and curl for manual probing. Follows 4-phase workflow. Deployed by common-appsec-patterns skill coordinator.
Produces a short, triage-grade paper summary — Key Takeaways, Background, Main Idea & Summary, Critique. Invoked alongside metadata-extractor and finding-extractor during /paperloom:ingest. Returns JSON only; page assembly is handled by scripts/assemblepaper.py.
Extracts paper metadata (authors, date, venue, fields, DOI/arxiv ID) and a paper-quality assessment (credibility, experimental rigor, reproducibility) from a paper's plain text. Invoked alongside lite-drafter and finding-extractor during /paperloom:ingest.
Verbatim plan-to-beads converter using the bd CLI. Copies full implementation code, requirements, and exit criteria directly into each bead. Each bead is 100% self-contained - no plan back-references or external lookups needed.
Architectural Bug Investigation Agent. Deep investigation with line-by-line code analysis, produces fix plans with exact code changes, regression prevention, and verification criteria. Plans work with any executor (loop or swarm).
Use to estimate the token usage, agent-compute time, and (only when a cost snapshot grounds it) the dollar cost of a task BEFORE it runs — given a target (raw task text, a slicing record, a single slice, or a spec), reads MODELROUTING.md and the latest observability/costs/ snapshot, applies the cost-estimation…
Use this agent when verifying constraints from HARNESS.md against code — running deterministic tools or performing agent-based reviews. Examples: Context: CI needs to check PR constraints user: "Run the harness constraint checks on this PR" assistant: "I'll use the harness-enforcer agent to verify all PR-scoped…
Use when starting any new feature, fix, improvement, or refactoring task — receives a plain-English task description and coordinates the full pipeline from spec update through to merged PR and closed issue.
Implement a SPECIFIC, well-defined plan or plan-step with Codex. Use ONLY when the user has a written plan, plan-step, named files, or acceptance criteria to execute ("execute this via codex", "implement this plan", "/codex:execute", or a --plan file is in context). Do NOT use when the user is stuck/exploring (use…
Delegate a SPECIFIC, well-defined implementation task or plan step to Cursor in agent mode on the Auto model. Cursor is the fast lane for mechanical writing — long file writes (200+ lines), pattern-following across many files, bulk refactors. Supports autonomous multi-step runs via --until-done. Pair with…
Delegate read-only EXTERNAL web/documentation research to Cursor. Use when the user wants current library/API/docs research, "what's the current way to…", or to compare approaches — and you'd rather not spend Claude's context on web reading. Cursor runs read-only (ask mode) with web search + fetch and returns findings…
Takes one self-contained story from plan to commit or PR on its own branch, with tests and a self-review. Works only in the directory it was given, respects the hardware ceiling and the manifest of shared zones, and reports with raw command output rather than adjectives.
Independent quality control on another agent's work - reads the whole diff, runs its OWN verification rather than trusting the author's report, and returns APPROVE, REVISED or CHANGES-REQUESTED with executable counterexamples. May fix what it finds, which forfeits APPROVE. Never reviews its own code.
Fast, cheap reconnaissance over a repo, its documentation, its data or external sources, changing nothing. Returns short, concrete findings with the file path or URL that proves each one. Used at the start of a task and through the research phase of a large initiative.
Read-only swarm team member. Spawned by swarm via the Agent tool. Tools restricted to read and research only — no Edit, Write, or NotebookEdit. Operational guidance comes from the briefing template at spawn time.
Ephemeral read-only reviewer for the independent review loop's Swarm fallback. Spawned by the team lead via the Agent tool for a single review round — never a team member. Tools restricted to read-only — no Edit, Write, or NotebookEdit. Identity, steer, diff scope, and output format come from the spawn prompt.