Testing & Debugging for Claude Code

One iteration of the IronClaw Reborn de-slop loop — take ONE Reborn crate, fan out parallel review sub-agents (thermo-nuclear quality, paranoid architect, interface/contract/invariants, test-coverage/wiring), synthesize, apply fixes/refactors/missing tests, open a PR. Stop.

Deep audit of the IronClaw crate for vulnerabilities, bugs, unfinished work, inconsistencies, and oversights

Run the full Rust quality gate (fmt, clippy, tests) before shipping changes

Trace a data flow or bug through the IronClaw codebase end-to-end

ESP-IDF v5.x RMT5 API expert for LED protocols, encoders, and multi-channel control

Automatically diagnose and fix PlatformIO board upload/monitor issues

Debug GitHub Actions build failures

Run health check on GitHub Actions workflow

Run code linting and formatting checks

Run test suite

Builds deep architectural context before vulnerability hunting

Searches Burp Suite project files for security analysis

Detects timing side-channels in cryptographic code

Identifies state-changing entry points in smart contracts

Scans Android APKs for Firebase security misconfigurations

Creates Semgrep rules with test-first methodology

Verifies code implements specification requirements

Finds similar vulnerabilities using pattern-based analysis

Check plugin integration for a skill and verify Command-Agent-Skill architecture

Check plugin integration for a skill and verify Command-Agent-Skill architecture

Check plugin integration for a skill and verify Command-Agent-Skill architecture

Configure VSCode httpYac extension for API testing

Complete workflow for creating, improving, and testing Agent Skills with all references and tools

Complete workflow for creating, improving, and testing Agent Skills with all references and tools

Complete workflow for creating, improving, and testing Agent Skills with all references and tools

Test and evaluate Agent Skill performance with benchmarks

Test and evaluate Agent Skill performance with benchmarks

Test and evaluate Agent Skill performance with benchmarks

Show which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from high-signal repos. Use to bootstrap a fresh box or audit which optional capabilities are wired in. Usage: /arsenal | /arsenal <tool-name>

Run autonomous hunt loop on a target — scope check → recon → rank surface → hunt → validate → report with configurable checkpoints. Usage: /autopilot target.com [--paranoid|--normal|--yolo]

HIBP k-anonymity check on a password wordlist. Enriches each password with its breach count, ranks DESC. Free API (no key), only first 5 chars of SHA-1 sent. Output -> <input>-ranked.txt. Usage /breach-check <wordlist> [--min-count N] [--max-count N] [--with-counts]

Probe a 403/401 endpoint with the most-paid bypass tricks (header injection, path encoding, method swap, WAF fingerprint, vendor-specific). Wraps byp4xx when installed; otherwise runs a built-in matrix of 38+ techniques. Usage: /bypass-403 <url> | /bypass-403 -l <urls-file>

Build an exploit chain — given bug A, finds B and C to combine for higher severity and payout. Knows common chain patterns: IDOR→ATO, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth. Usage: /chain

Sweep cloud assets for a target — public S3/Azure/GCP buckets via S3Scanner and cloud_enum, plus CloudFlare-bypassed origin IPs via CloudFail (or built-in DNS-history fallback). Use --keyword for storage discovery and --cf-bypass to find an origin IP behind CloudFlare. Usage: /cloud-recon --keyword <name> | /cloud-recon --cf-bypass <domain>

Active vulnerability hunt against a target by invoking tools/hunt.py (which calls vuln_scanner.sh against recon/<target>/). Auto-runs recon first if no recon dir exists. Usage: /hunt target.com

On-demand intelligence fetch for a target — CVEs, disclosed reports, new features. Wraps learn.py + hunt memory context. Usage: /intel target.com

Discover hidden HTTP parameters on a URL or list of URLs using Arjun (or x8 fallback). Hidden params are gold for IDOR, SSRF, LFI, redirect, and authorization bypass — often missed by automated scanners. Usage: /param-discover <url> | /param-discover -l <urls-file>

Pick up a previous hunt on a target — shows hunt history, untested endpoints, and memory-informed suggestions. Usage: /pickup target.com

Log current finding or successful pattern to hunt memory. Auto-fills from /validate output if available. Usage: /remember