Testing & Debugging for Claude Code

Pull every in-scope asset for a bug bounty program across HackerOne, Bugcrowd, Intigriti, YesWeHack, and Immunefi in one shot. Uses bbscope when authenticated, otherwise the public bounty-targets-data dump. Output is one host per line, ready to feed into /recon. Usage: /scope-aggregate <program-handle> [--platform h1|bc|it|ywh|imf|all]

Password spray with hard guards — typed-hostname confirmation, lockout warning, audit log. Modes: http-form (custom login page), oauth (password grant), o365 + okta (via TREVORspray). Default delay 30min/round + 60s jitter. Usage /spray <url> --mode <mode> --users <file> --passes <file>

Show ranked attack surface for a target based on recon output + hunt memory. Invokes recon-ranker agent. Usage: /surface target.com

Scan subdomains for takeover candidates (dangling CNAMEs to GitHub Pages, S3, Heroku, Shopify, etc.). Wraps dnsReaper (best signal) and subjack (fast Go fallback). With no scanner installed, runs a built-in fingerprint grep over a curated set of providers. Usage: /takeover <subdomains-file> | /takeover --recon <recon-dir>

Meme coin and token security scan — checks for rug pull vectors (hidden mint, honeypot, fee manipulation, LP lock bypass, authority retention, bonding curve exploits, fake renounce, sandwich amplification). Runs automated token_scanner.py + manual 8-class audit. Usage: /token-scan <contract_path_or_dir> [--chain solana]

Quick 7-Question Gate triage on a finding before writing a report. Kills N/A submissions before they happen. Faster than /validate — for quick go/no-go decisions. Usage: /triage

Validate a finding — runs 7-Question Gate + 4-gate checklist. Kills weak findings before report writing. Prevents N/A submissions that hurt validity ratio. Usage: /validate

Smart contract security audit — runs through 10 bug class checklist (accounting desync, access control, incomplete path, off-by-one, oracle errors, ERC4626, reentrancy, flash loan, signature replay, proxy/upgrade). Applies pre-dive kill signals first. Generates Foundry PoC template for confirmed findings. Usage: /web3-audit <contract.sol>

Build a new application from a plain-English description using Shipwright's autonomous 9-phase pipeline

Developer agent — implements features based on technical design, follows TDD patterns, and produces clean, tested code

Pair programming mode — step-by-step collaboration with 5 confirmation checkpoints for learning and sensitive operations

Spawn a Codex reviewer agent against a specific PR

Triage pull request CI results and review feedback with slop-mop

Run slop-mop's fast iterative development validation loop

Verify the TLS Radar plugin's connection and configuration

Run a free SSL/TLS scan on a domain (no account required)

> Scan for accessibility issues with WCAG 2.1/2.2 compliance and screen reader...

Test your multi-agent system with a sample task, showing agent handoffs,...

Trigger full repository health analysis

Analyze code coverage metrics and identify untested code

DESCRIPTION_PLACEHOLDER

Analyze network latency and request patterns

Analyze logs for performance insights

Comprehensive security audit for REST and GraphQL APIs

Implement database audit logging

Find Databricks queries paying the Photon DBU premium while silently falling back to the Spark engine, and surface the plan seam + UDF-rewrite fix.

Cross-browser testing across browsers, devices, and cloud providers

Build CI/CD pipelines

> Validate API contracts with consumer-driven testing and OpenAPI validation

Create intelligent alerting rules

Create load test scenarios and scripts

Create a mock API server for testing

Create API monitoring dashboard

> Compare database schemas and generate safe migration scripts with rollback...

> Database testing with test data setup, transaction rollback, and schema...

Scan a job's code and JARs for the Databricks Runtime upgrade landmines (DBR-14 CWD 500MB cap, DBR-15.1 JDK-11 removal) before bumping the runtime.

> Detect and resolve database deadlocks with automated monitoring

Debug API failures using OpenAPI specs and HTTP logs

Detect performance bottlenecks in application