0xsteph/pentest-ai-agents
50 subagents
Subagent
_scope-guardTurn Claude Code into your offensive security research assistant. Specialized AI subagents for authorized penetration testing plan engagements, analyze recon, research exploits, build detections,…ad-attackerDelegates to this agent when the user wants to perform Active Directory attacks, run BloodHound analysis, use Impacket tools, execute Kerberos attacks, perform AD enumeration with CrackMapExec or…ai-reconDelegates to this agent when the user wants to map the AI attack surface of an authorized web application before validation — discovering AI/LLM API endpoints (including OpenAI-compatible APIs),…api-securityDelegates to this agent when the user asks about API security testing, REST API attacks, GraphQL exploitation, OAuth/OIDC vulnerabilities, JWT attacks, API enumeration, or web service penetration…attack-plannerDelegates to this agent when the user wants to correlate findings from multiple tools or agents, build multi-step attack chains, identify the optimal exploitation path through a network, prioritize…bizlogic-hunterDelegates to this agent when the user wants to test for business logic flaws, find workflow bypass vulnerabilities, detect price manipulation or payment tampering, identify race conditions in…bug-bountyDelegates to this agent when the user is working on bug bounty programs, submitting vulnerability reports to HackerOne or Bugcrowd, needs help with bug bounty methodology, wants to prioritize targets…c2-operatorDelegates to this agent when the user asks about command-and-control framework operations, Sliver/Mythic/Havoc/Cobalt Strike configuration, listener and beacon tuning, malleable C2 profiles, sleep…cicd-redteamDelegates to this agent when the user wants to integrate red teaming into CI/CD pipelines, set up continuous automated security testing on every code push, generate pipeline configurations for…cloud-securityDelegates to this agent when the user asks about cloud security testing, AWS/Azure/GCP penetration testing, cloud misconfiguration analysis, IAM privilege escalation, container security, Kubernetes…code-auditorDelegates to this agent when the user wants a secure-code review of application source — static analysis for injection, auth, secrets, deserialization, and OWASP issues; SAST tooling guidance…compliance-mapperDelegates to this agent when the user wants to map penetration-test findings to compliance frameworks — PCI DSS, NIST 800-53 / CSF, ISO 27001, CIS Controls, HIPAA, SOC 2 — produce control-gap…container-breakoutDelegates to this agent when the user asks about container escape, Docker breakout, Kubernetes pod escape, runc/containerd CVE exploitation, capability abuse, privileged container hunting, kubelet…credential-testerDelegates to this agent when the user asks about password attacks, credential testing, hash cracking, brute force methodology, default credential checks, password spraying, or needs help with tools…crypto-analyzerDelegates to this agent when the user wants to analyze cryptographic usage — weak algorithms or modes, key and IV/nonce management, TLS/certificate configuration, randomness quality, password…ctf-solverDelegates to this agent when the user is working on CTF challenges, capture the flag competitions, HackTheBox machines, TryHackMe rooms, or needs help with CTF methodology including web exploitation,…data-exfiltratorDelegates to this agent when the user wants to test exfiltration and DLP/egress controls during an authorized engagement — DNS tunneling, HTTPS/cloud-storage exfil, ICMP, protocol abuse, and staging…database-attackerDelegates to this agent when the user wants database-specific offensive testing on an authorized target — SQL and NoSQL injection depth, authenticated database enumeration, DBMS privilege escalation,…detection-engineerDelegates to this agent when the user asks about detection rules, SIEM queries, threat hunting, indicator analysis, log analysis, blue team detection for specific attack techniques, or creating…engagement-plannerDelegates to this agent when the user needs to plan a penetration test, define attack methodology, scope an engagement, map techniques to MITRE ATT&CK, or create a rules of engagement template.evasion-specialistDelegates to this agent when the user wants to test defensive evasion during an authorized red team or EDR-validation engagement — AV/EDR evasion, AMSI and ETW bypass, payload obfuscation, in-memory…exploit-chainerDelegates to this agent when the user wants to automatically chain isolated vulnerabilities into multi-step attack paths, pivot through a system from a low-severity finding to full compromise,…forensics-analystDelegates to this agent when the user asks about digital forensics, incident response, evidence acquisition, memory forensics, disk forensics, network forensics, timeline analysis, or chain of custodyiot-pentesterDelegates to this agent when the user wants authorized security testing of IoT/embedded devices — firmware extraction and analysis, hardware interfaces (UART/JTAG/SPI), radio protocols…lateral-movementDelegates to this agent when the user wants post-foothold lateral-movement strategy on an authorized engagement — pass-the-hash/ticket, remote execution (PsExec/WMI/WinRM/DCOM/SSH), token…llm-redteamDelegates to this agent when the user asks about LLM and AI system red teaming, prompt injection (direct and indirect), jailbreak techniques, RAG poisoning, model exfiltration, training data…malware-analystDelegates to this agent when the user asks about malware analysis, reverse engineering, binary analysis, disassembly, debugging, sandbox analysis, static analysis, dynamic analysis, or suspicious…mobile-pentesterDelegates to this agent when the user asks about mobile application security testing, Android pentesting, iOS pentesting, APK analysis, IPA analysis, mobile API testing, certificate pinning bypass,…network-attackerDelegates to this agent when the user wants layer-2/layer-3 offensive testing on an authorized internal network — LLMNR/NBT-NS/mDNS poisoning, ARP spoofing and MITM, NTLM relay, IPv6/mitm6 takeover,…opsec-anonymizerDelegates to this agent when the user asks about operator-side identity hygiene, source IP separation, traffic anonymization for authorized red team work, Tor and proxy chains, burner infrastructure…osint-collectorDelegates to this agent when the user asks about OSINT, reconnaissance, information gathering, target profiling, email harvesting, subdomain enumeration, social media recon, breach data, open source…password-auditorDelegates to this agent when the user wants to audit password posture — policy review against NIST 800-63B, password-storage/hashing review, breach-exposure checks, and lockout-safe password-spray…payload-crafterDelegates to this agent when the user asks about generating offensive payloads, building shellcode, working with msfvenom, packing or encoding payloads, building reverse shells, creating EDR-test…persistence-plannerDelegates to this agent when the user wants to plan and document persistence during an authorized red team engagement — host persistence (Windows/Linux), Active Directory persistence (golden/silver…phishing-operatorDelegates to this agent when the user asks about setting up phishing infrastructure, configuring Evilginx3 or GoPhish, adversary-in-the-middle credential capture, MFA token relay, domain lookalike…poc-validatorDelegates to this agent when the user wants to validate a vulnerability finding with a safe Proof of Concept, eliminate false positives from scan results, automatically generate and execute PoC…privesc-advisorDelegates to this agent when the user asks about privilege escalation techniques, local enumeration, Linux or Windows privilege escalation, container escape, or needs help escalating access on a…recon-advisorDelegates to this agent when the user pastes scan output (Nmap, Nessus, Nikto, masscan, etc.), asks about reconnaissance techniques, needs help with enumeration, wants to analyze an attack surface,…report-generatorDelegates to this agent when the user needs to write a penetration test report, compile findings into a document, create an executive summary, format technical findings, or produce any security…reverse-engineerDelegates to this agent when the user asks about static reverse engineering, working with Ghidra, Radare2, IDA, JadX, decompiling Android APKs, analyzing firmware with Binwalk, reading disassembly,…risk-scorerDelegates to this agent when the user wants to score and prioritize findings — build CVSS 3.1/4.0 vectors, enrich with EPSS and CISA KEV, adjust for business context and exploitability, and produce a…scada-attackerDelegates to this agent when the user wants authorized ICS/OT/SCADA security testing — Modbus/DNP3/S7comm/EtherNet-IP/OPC-UA protocol analysis, PLC/HMI/RTU enumeration, and Purdue-model attack-path…social-engineerDelegates to this agent when the user asks about social engineering, phishing campaigns, pretexting, vishing, physical social engineering, security awareness testing, or human-factor security…stig-analystDelegates to this agent when the user asks about STIG findings, security compliance, system hardening, GPO configurations, security baselines, or needs to document findings in STIG format including…swarm-orchestratorDelegates to this agent when the user wants to coordinate multiple pentest agents as a team, run a full automated red team engagement, orchestrate parallel reconnaissance and exploitation workflows,…threat-modelerDelegates to this agent when the user asks about threat modeling, attack surface analysis, STRIDE, DREAD, attack trees, data flow diagrams, trust boundaries, or security architecture reviewtraffic-analyzerDelegates to this agent when the user wants offline analysis of captured network traffic — dissecting pcaps, extracting credentials and artifacts, reconstructing sessions, identifying protocols and…vuln-scannerDelegates to this agent when the user wants to run vulnerability scans, identify CVEs in target systems, use tools like nuclei, nikto, or OpenVAS, parse vulnerability scan results, or prioritize…web-hunterDelegates to this agent when the user wants to perform web application penetration testing, run directory brute forcing with ffuf or gobuster, test for SQL injection, discover hidden endpoints, fuzz…wireless-pentesterDelegates to this agent when the user asks about wireless security testing, WiFi pentesting, WPA/WPA2/WPA3 attacks, Bluetooth security, wireless reconnaissance, rogue access points, evil twin…