Use this agent when you need a security review — finding exploitable vulnerabilities in authentication, untrusted-input handling, secrets, or dependencies. Recommended PROACTIVELY after changes to auth/authz, API endpoints, input parsing, file uploads or path handling, or cryptography. Not for general code quality…
Code reviewer and security auditor. Hunts for bugs, security holes, logic errors, edge cases, performance issues, and inconsistencies. Every finding with file path + line number. Use before every commit, deploy, or merge. Also handles deep security review (hardcoded secrets, injection, XSS, path traversal).
Active Directory exploitation subagent for red-run. Executes one AD technique skill per invocation as directed by the orchestrator. Handles Kerberos attacks, ADCS abuse, ACL exploitation, credential operations, lateral movement, and domain persistence. Use when the orchestrator needs to exploit an AD vulnerability.
Web application exploitation subagent for red-run. Executes one web technique skill per invocation as directed by the orchestrator. Handles injection testing, authentication bypass, file upload, deserialization, and all other web exploitation techniques. Use when the orchestrator needs to exploit a web vulnerability.
Windows privilege escalation subagent for red-run. Executes one privesc skill per invocation as directed by the orchestrator. Handles Windows host discovery, token impersonation, service/DLL abuse, UAC bypass, credential harvesting, and kernel exploits. Use when the orchestrator has shell access on a Windows host and…
Deep security + performance audit of a specific diff. Wraps /skill:security-hardening and /skill:performance-optimization (analysis phase only). Use when a change touches auth, untrusted input, secrets, webhooks, PII, or a latency/throughput budget — a focused, read-only risk pass that returns findings the parent…
Use this agent for implementation, modification, and execution tasks requiring security, authentication, authorization, encryption, vulnerabilities expertise. This agent has Security Expert's epistemic profile with calibrated confidence thresholds.
Security-sensitive implementation after approval - authentication and authorization, secrets handling, cryptography usage, input validation, hardening, dependency remediation. Give it only an approved, stable contract to execute; all pre-approval analysis belongs to the security-review role instead.
Use when a bundle-plugin needs systematic quality audit and security scan against the 10-category checklist. Dispatched by auditing for thorough automated assessment.
Agent "testing-pr-security" from icoretech/airbroke, covering testing, prs, and security, testing workflow, vitest contracts, what to test and security-sensitive areas.
This subagent specializes in reverse engineering binaries using Ghidra CLI. It provides efficient, token-optimized access to binary analysis capabilities for Claude Code and other AI agents.
A security and failure-mode reviewer that challenges a conclusion or design by looking for unsafe inputs, permission problems, race conditions, data loss, partial failures, and injection risks.
An AI agent described as an experienced hacker focused on reverse engineering, finding and exploiting vulnerabilities, analyzing malicious software, game security, and mobile security.
Use when a check or dimension in packages/cli/src/checks/ changes point values, thresholds, or is added/removed — verifies score.ts, maturity-model.md, measure-and-improve.md, and all fixtures/level-0..4 stay in sync before the change ships.
Expert agent for creating production-ready Azure API Management policy XML for authentication (OAuth, JWT, subscription keys), rate limiting, CORS, error handling, and transformations. Implements hybrid authentication and security best practices.
Distills a past security report into a reusable agentgg agent that catches the same anti-pattern if it recurs in this codebase.
194 5d agoA30 tokens
originalApache-2.0
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: