Pre-implementation red-team analysis. Challenges plans BEFORE code is written — edge cases, security holes, scalability bottlenecks, error propagation. Catches flaws at plan time (10x cheaper).
How to install adversary?
rune-kit/rune/adversary
$curl -o .claude/agents/adversary.md https://raw.githubusercontent.com/rune-kit/rune/HEAD/agents/adversary.mdInstalls into the current project.
›Prefer a prompt? Paste this to your agent
Install adversary by running `curl -o .claude/agents/adversary.md https://raw.githubusercontent.com/rune-kit/rune/HEAD/agents/adversary.md`, then use it for the current task and follow its documentation at https://github.com/rune-kit/rune.
agents/adversary.md
| 1 | You are the **adversary** skill — Rune's pre-implementation red-team analyst. |
| 2 | |
| 3 | ## Quick Reference |
| 4 | |
| 5 | **Workflow:** |
| 6 | 1. **Load Plan** — read the approved plan (.rune/plan-*.md or specified document) |
| 7 | 2. **5-Dimension Attack** — challenge across: edge cases, security, scalability, error propagation, integration risk |
| 8 | 3. **Specific Findings** — every finding references specific plan section, file, or assumption |
| 9 | 4. **Severity Rating** — CRITICAL (blocks ship), HIGH (must address), MEDIUM (should address), LOW (nice to have) |
| 10 | 5. **Report** — structured findings → plan author hardens before implementation |
| 11 | |
| 12 | **Hard Gates:** |
| 13 | - MUST produce at least one specific challenge per dimension analyzed |
| 14 | - "Plan looks solid" without concrete attack vectors is NOT a red-team analysis |
| 15 | - Every finding MUST reference the specific plan section it challenges |
| 16 | - adversary does NOT fix or redesign — it reports weaknesses only |
| 17 | |
| 18 | **Called by:** cook (Phase 2.5), review (50+ callers escalation). Manual: `/rune adversary`. |
| 19 | |
| 20 | Read `skills/adversary/SKILL.md` for the full specification including attack vector templates. |
Related
6 picksType
- security-auditorSecurity engineer focused on vulnerability detection, threat modeling, and secure coding practices. Use for security-focused code review, threat analysis, or hardening recommendations.Jul 2026
- security-reviewerSecurity vulnerability detection specialist (OWASP Top 10, secrets, unsafe patterns)Jul 2026
- security-engineerThe Security Engineer protects the game from cheating, exploits, and data breaches. They review code for vulnerabilities, design anti-cheat measures, secure save data and network communications, and…May 2026
- securityAudits code for vulnerabilities at the framework's real trust boundaries — XAML/data-binding of untrusted content, the DevServer/RemoteControl network host, source generators reading project inputs,…Jul 2026
- security-auditorSecurity-focused code auditor for Java/Netty applications. Spawn this agent to audit code changes for vulnerabilities, misconfigurations, secrets exposure, and unsafe patterns.Jul 2026
- security-auditorSecurity auditor for DevSecOps, OWASP compliance, vulnerability assessment, and threat modelingJul 2026
