Security for Claude Code

Runs one assigned rust-review cluster task and writes finding files to the run's output directory. Spawned by the rust-review skill orchestrator only.

Evaluates APIs, configurations, and library interfaces for misuse resistance and footgun potential. Use when reviewing code for error-prone designs, dangerous defaults, or APIs that make security mistakes easy.

Performs full specification-to-code compliance analysis for blockchain audits. Use when verifying that smart contract implementations correctly match their formal specifications or whitepapers.

Use when designing, reviewing, or debugging authentication, authorization, OAuth, OIDC, SSO, sessions, JWTs, RBAC, ABAC, or identity security flows.

Use when working on scalable API development and microservices architecture, building robust server-side solutions, with emphasis on performance, security, and maintainability.

Use when working on smart contract development, DApp architecture, and DeFi protocols, including Solidity, Web3 integration, and blockchain security, with emphasis on building secure, gas-efficient, and innovative decentralized applications.

Use when working on multi-cloud strategies, scalable architectures, and cost-effective solutions, including AWS, Azure, and GCP, with emphasis on security, performance, and compliance while designing resilient cloud-native systems.

Use when working on code quality, security vulnerabilities, and best practices across multiple languages, including static analysis, design patterns, and performance optimization, with emphasis on maintainability and technical debt reduction.

Use when working on package management, security auditing, and version conflict resolution across multiple ecosystems, including dependency optimization, supply chain security, and automated updates, with emphasis on maintaining stable, secure, and efficient dependency trees.

Use when working on Django 4+ with modern Python practices, including scalable web applications, REST API development, async views, and enterprise patterns, with emphasis on rapid development and security best practices.

Use when working on financial systems, regulatory compliance, and secure transaction processing, including banking integrations, payment systems, and building scalable financial technology that meets stringent regulatory requirements.

Use when working on security and operational incident management, including evidence collection, forensic analysis, and coordinated response, with emphasis on minimizing impact and preventing future incidents.

Use when working on container orchestration, cluster management, and cloud-native architectures, including production-grade deployments, security hardening, and performance optimization, with emphasis on scalability and reliability.

Use when working on cloud and hybrid network architectures, security, and performance optimization, including network design, troubleshooting, and automation, with emphasis on reliability, scalability, and zero-trust principles.

Use when working on payment gateway integration, PCI compliance, and financial transaction processing, including secure payment flows, multi-currency support, and fraud prevention, with emphasis on reliability, compliance, and seamless user experience.

Use when working on comprehensive security assessments, compliance validation, and risk management, including security frameworks, audit methodologies, and compliance standards, with emphasis on identifying vulnerabilities and ensuring regulatory adherence.

Use when working on DevSecOps, cloud security, and compliance frameworks, including security automation, vulnerability management, and zero-trust architecture with emphasis on shift-left security practices.

Use when working on infrastructure as code, multi-cloud provisioning, and modular architecture, including Terraform best practices, state management, and enterprise patterns, with emphasis on reusability, security, and automation.

Autonomous hunt loop agent. Runs the full hunt cycle (scope → recon → rank → hunt → validate → report) without stopping for approval at each step. Configurable checkpoints (--paranoid, --normal, --yolo). Uses scope_checker.py for deterministic scope safety on every outbound request. Logs all requests to audit.jsonl. Use when you want systematic coverage of a target's attack surface.

Exploit chain builder. Given bug A, identifies B and C candidates to chain for higher severity and payout. Knows all major chain patterns — IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth, prompt injection→IDOR, subdomain takeover→OAuth redirect. Use when you have a low/medium finding that needs a chain to be submittable.

Autonomous credential-attack pipeline runner. Chains /wordlist-gen + /osint-employees + /breach-check (data-prep stages, runs without prompts) then HARD STOPS before /spray (live attack stage requires human go/no-go). Designed so the user only types the target once instead of orchestrating four separate commands. Reports back with stats at each stage and a structured go/no-go decision package before spray.

Subdomain enumeration and live host discovery specialist. Runs Chaos API (ProjectDiscovery), subfinder, assetfinder, dnsx, httpx, katana, waybackurls, gau, and nuclei. Produces prioritized attack surface for a target. Use when starting recon on a new target domain.

Attack surface ranking agent. Takes recon output and hunt memory, produces a prioritized attack plan. Ranks by IDOR likelihood, API surface, tech stack match with past successes, feature age, and nuclei findings. Use after recon to decide what to test first.

Bug bounty report writer. Generates professional H1/Bugcrowd/Intigriti/Immunefi reports. Impact-first writing, human tone, no theoretical language, CVSS 4.0 calculation included. Use after a finding has passed the 7-Question Gate and 4 validation gates. Never generates reports with "could potentially" language.

Fast meme coin and token security auditor. Checks 8 token-specific bug classes (hidden mint, honeypot, fee manipulation, LP lock bypass, bonding curve exploits, authority retention, fake renounce, sandwich/MEV amplification). Runs token_scanner.py for automated red flag detection. Covers EVM (Solidity) and Solana (Rust/Anchor) tokens. Use for any token audit, rug pull assessment, or pre-investment security check.

Finding validator. Runs the 7-Question Gate and 4-gate checklist on a described finding. Kills weak/theoretical findings fast before report writing. Prevents N/A submissions. Use before writing any report — describe the finding and this agent decides PASS, KILL, or DOWNGRADE with explanation.

Smart contract security auditor. Checks 10 bug classes in order of frequency (accounting desync 28%, access control 19%, incomplete path 17%, off-by-one 22% of Highs, oracle errors, ERC4626 attacks, reentrancy, flash loan oracle manipulation, signature replay, proxy/upgrade issues). Applies pre-dive kill signals first. Use for any Solidity/Rust contract audit or to check if a DeFi target is worth hunting.

Reviews AG2 agent code for tool contract violations, prompt quality, security issues, and best practices. Invoke after creating or modifying AG2 agents.

The Watcher of the business team. Tatillon legal-minded thinker. Considers compliance, tax, contracts, jurisdictions, and the thousand ways a good idea becomes a lawsuit.

QA Engineer and Security Auditor agent for code review, security auditing, testing verification, compliance checking, dead code detection, and quality gates. Use after any code changes or before releases.

Performs deep code review checking architecture compliance, code quality, security issues, and best practices adherence

The Watcher of the dev team. The SRE/security mind with a twist. Thinks about second-order effects, failure modes nobody plans for, and what happens when things go sideways at 3am.

Reviews source files for bugs, security issues, and code quality problems. Produces structured REVIEW.md with severity-classified findings. Spawned by /gsd:code-review.

Verifies threat mitigations from PLAN.md threat model exist in implemented code. Produces SECURITY.md. Spawned by /gsd:secure-phase.

Runs a Codex-powered read-only code review using a SOTA GPT model. Use as a second-opinion reviewer alongside Claude's own review for PRs, contentious diffs, or security-sensitive changes. Useful precisely because it's a different model family — it catches different classes of issues than Claude does.

Audits and implements AI safety layers including content filtering, PII detection, bias mitigation, and LLM guardrails. Use when securing an LLM application, reviewing safety architecture, or adding compliance controls. Trigger with \"audit ai safety\", \"add safety guardrails\".

Run compliance gap analyses for SOC2, GDPR, HIPAA, and ISO 27001, then produce stage-appropriate remediation plans and policy drafts. Use when preparing for a compliance audit or framework adoption. Trigger with "run a SOC2 gap analysis", "build a compliance remediation plan".

Design MITRE ATT&CK-mapped detection rules, CIS-benchmarked hardening playbooks, and SOC triage procedures to reduce attacker dwell time. Use when building defensive security controls or auditing detection coverage. Trigger with "design detection rules", "write a hardening playbook".

Monitor cross-chain bridge activity, analyze security models, detect exploits, and compare route fees across Wormhole, Stargate, Hop, and canonical L2 bridges. Use when tracking a pending bridge transfer, assessing TVL risk, or investigating unusual bridge behavior. Trigger with \"monitor bridge\", \"analyze bridge security\".