Xss Hunter
Complete XSS testing methodology reflected, stored, DOM-based, blind, and mutation XSS, CSP bypass, DOM clobbering, filter/WAF evasion, and impact escalation. Trigger when the user asks to test for XSS or cross-site scripting (reflected, stored, DOM-based, blind, mutation), wants to bypass XSS filters/WAF rules/CSP, identifies a reflection point and needs the right payload, pastes HTML/JS that re…
Idor Hunter
Systematic IDOR/BOLA detection methodology recon, multi-account testing, bypass techniques, and report structure. Trigger when the user asks to test authorization controls or object-level access restrictions, wants to hunt for IDOR or BOLA on an API or web app, needs a structured methodology for multi-account access testing, is doing a bug bounty or pentest and wants to maximize IDOR coverage, or…
Attack Surface
Maps every entry point, component, and trust boundary of a target before testing begins prevents missed coverage and prioritizes the highest-value attack paths. Trigger when the user provides a target and wants to know where to start, says "map the attack surface", "what should I test", or "where do I begin", or is starting any engagement after scope-grill is complete.
Risk Assessor
Scores a vulnerability using likelihood × impact, CIA triad analysis, CVSS correlation, and SLA-bound remediation urgency. Trigger when the user describes a vulnerability and wants to know how serious it is, asks "what's the risk level?" or "how urgent is this to fix?", has a CVSS score but wants it contextualized with compensating controls and business impact, needs to assign a remediation SLA,…
Vuln Diagnose
Builds deterministic, reproducible proof-of-concepts to validate suspected or partially-confirmed vulnerabilities (e.g., XSS, IDOR) and eliminate false positives. Triggered when tool outputs flag potential issues, or when manual confirmation of exploitability is required before documenting a finding.
Xxe Phantom
An XXE detection and exploitation methodology engine. Triggered when testing for XML injection, interacting with XML content-types/endpoints, or processing XML-based file uploads (SVG, DOCX, SAML, SOAP). Facilitates classic file reads, blind OOB exfiltration, WAF bypasses, and SSRF chaining. Includes report structuring.
Clickjacking Hunter
Complete clickjacking (UI redressing) methodology framing protection detection, single-click and multi-step PoC construction, JS frame-busting bypass, drag-and-drop and OAuth consent variants, and report structure. Trigger when the user asks to test for clickjacking or UI redressing, wants to check if a sensitive endpoint (account delete, 2FA disable, OAuth consent) is frameable, needs to build a…
Nuclei Template Writer
Convert a vulnerability description or HTTP request/response pair into a ready-to-run Nuclei YAML template handles auth strategies, matcher selection, OOB detection, and multi-step flows. Trigger when the user found a vulnerability and wants to automate detection on other targets, pastes an HTTP request/response and asks for a Nuclei template, says "write a nuclei template for this" or "automate…
Find Skills
Helps users discover and install Rifteo agent skills when they ask questions like "is there a skill for X", "how do I write a finding", "find a skill that can...", or want to extend their agent for security and audit work.
Economist Attack
Weighs each attack path's effort against its likely impact, pursuing the highest-value surfaces first to find the most important weakness with the least wasted effort it shapes the order you test in, not what you test. Trigger when doing any offensive security engagement and deciding where to focus effort, when the attack surface is large and not everything can be tested with equal depth, or when…
Jwt Cracker
Full JWT attack methodology alg:none, RS256 to HS256 confusion, weak secret brute-force, kid injection, jku/jwk injection, and claim tampering. Trigger when the user asks to test JWT tokens, authentication bypass, or token forgery, wants to try alg:none/algorithm confusion/weak secret brute-force, needs to test kid/jku/x5u/jwk injection, asks to check if exp/iss/aud claims are validated, is tryin…
Check Exploit
Search known exploit databases and sources for a given service, version, or CVE, from searchsploit to Vulners, MSF, and beyond. Trigger when the user has identified a service/version and wants to know if public exploits exist, provides a CVE ID and wants PoC or weaponized exploit references, ran nmap/banner grabbing and wants to cross-reference exploit databases, wants to know if a vulnerability…
Ctf Writeup
Generates a clean, publishable CTF challenge writeup from solve notes suitable for HTB, CTFtime, personal blogs, and team wikis. Trigger when the user solved a CTF challenge and wants to document it, says "write up this challenge", "generate a writeup", or "document my solve", or wants a record of solutions for their team's internal wiki.
Skill Benchmark
Scores any SKILL.md across 5 quality dimensions, runs a compatibility check against 50+ AI agents, and returns a ranked fix list. Trigger when the user asks to benchmark, score, or audit a skill, wants to check cross-agent compatibility (Cursor, Windsurf, Gemini, etc.), needs a ranked fix list before publishing a SKILL.md to the community repo, is comparing two skills before a pull request, or wa…
Less Noise Attack
Runs offensive work in a low-noise mode — passive recon first, minimal footprint, and only deliberate, targeted active actions that blend with legitimate traffic, so the engagement stays below detection thresholds. Not the default; activate only when the user explicitly signals stealth as the priority, e.g. "stay under the radar", "avoid the SOC", "be stealthy", "ghost mode", "don't trigger alert…
Engagement Handoff
Documents the current state of an active pentest engagement so the next agent session can continue without losing context, covering findings, coverage, next steps, and open threads. Trigger when the user says "handoff", "save progress", "pick this up next session", or "summarize the engagement", when the context window is getting long and work needs to continue in a fresh session, or at the end o…
Redirect Forge
Complete open redirect detection and exploitation methodology parameter discovery, 30+ bypass techniques, OAuth token theft, SSRF chaining, CSP abuse, phishing escalation, and report structure. Trigger when the user asks to test for open redirect or unvalidated redirect/forward, sees a parameter like ?next=/?url=/?redirect=/?return=/?goto= in a URL, wants to steal OAuth tokens via redirect_uri ma…
Control Lookup
Looks up any control ID across ISO 27001, NIST CSF, PCI-DSS v4, and OWASP returns the full control card, cross-framework mappings with confidence level, related controls, and testing hints. Trigger when the user provides a control ID and asks what it means, asks how controls map across frameworks, searches for a control by keyword or description, needs testing hints or evidence criteria before wr…
Pentest Report
Generates a complete, client-ready penetration test report from all findings in the current engagement executive summary, risk table, technical findings, and recommendations. Trigger when the user says "generate the report", "write the report", or "produce the deliverable", is at the end of an engagement with all findings confirmed and written up, or wants a draft report to review before sending…
Remediation Planner
Convert a security finding or vulnerability into a prioritized step-by-step remediation plan with effort estimates per step. Trigger when the user provides a vulnerability, finding, or bug needing a fix plan, asks "how do we fix this?" or "what's the remediation for X?", wants to estimate the work involved in addressing a finding, or needs a remediation roadmap to present to developers or stakeho…
Deadangle
A final accuracy check for offensive security work — it re-tests each conclusion against the evidence and labels every part confirmed, inferred, or assumed, so an unverified result never goes out as if it were proven. Trigger when the user says "deadangle" or "/deadangle", before delivering a finding/vulnerability conclusion/attack path, after completing recon and summarizing coverage, before pre…
Less Aggressive Attack
Tests for vulnerabilities less aggressively — read-only where possible, confirming a flaw without exercising its full impact or causing damage, under a strict set of safety rules. Not the default; activate only when the user explicitly signals safety as a constraint, e.g. "don't break anything", "read-only", "non-destructive testing", "careful with production", "keep it clean", or "just prove the…
Js Analyzer
Full JavaScript analysis methodology for pentesting and bug bounty JS file discovery, secret extraction, endpoint mapping, DOM XSS, prototype pollution, postMessage abuse, client-side logic flaws, source map extraction, and hardcoded credential hunting. Trigger when the user wants to analyze JavaScript files from a target, asks to find endpoints/API routes/hidden parameters in JS bundles, wants t…
Caveman
Ultra-compressed response mode for cybersecurity contexts strips filler while keeping CVEs, payloads, CVSS scores, and findings exact. User-triggered only never self-activated. Trigger when the user explicitly says "/caveman", "caveman mode", "be brief", "tl;dr", "just the findings", "straight to the point", "keep it short", or similar explicit brevity requests.
Ssrf Hunter
Complete SSRF detection and exploitation methodology injection point discovery, cloud metadata theft (AWS/GCP/Azure), internal network enumeration, protocol handler abuse, filter bypass techniques, blind SSRF via OOB, and report structure. Trigger when the user sees any parameter that accepts a URL, hostname, IP, or path, wants to check if a server fetches external resources, is testing cloud-hos…
Scope Grill
Interviews the user about a pentest or audit engagement before any testing begins, capturing target, scope, rules of engagement, auth, and deliverables into a structured brief. Trigger when the user says "start a pentest", "begin an engagement", or "test this target", describes a target without mentioning scope/authorization/deliverables, or wants to structure an engagement before diving in.
Hexstrike Forge
A 5-phase structured pentest methodology for the hexstrike-ai MCP server, covering passive recon through finding delivery with triage gates, parallel execution, and tool failure recovery.
Ssti Hunter
An SSTI detection, fingerprinting, and exploitation engine. Triggered by suspected server-side evaluation (e.g., {{7*7}} = 49) or stack traces referencing a template engine (Jinja2, Twig, FreeMarker, etc.). Facilitates blind detection, sandbox escapes, and escalation to RCE. Includes report structuring (severity, CWE, remediation).
Bugbounty Reporter
Converts raw bug bounty findings into a complete, triage-ready report clear description, numbered reproduction steps, self-contained PoC, risk, and remediation. Trigger when the user has a confirmed bug bounty finding and needs to write it up, says "write this up", "report this", or "format this for H1/Bugcrowd/Intigriti", or has raw notes, a request/response, or a PoC needing a submission-ready…
Cvss Scorer
Computes an exact CVSS v3.1 base score and vector from a vulnerability description infers metrics from context, asks one sharp question only when ambiguity would change the severity level. Trigger when the user needs a CVSS score for a vulnerability finding, is writing a bug bounty report or pentest finding needing a severity vector, says "score this" or "what's the CVSS?", or has a vulnerability…
Redmind
Red team mindset that shifts the agent to offensive security thinking across any target or engagement type. Trigger when the goal of the engagement is offensive (finding what can be broken, bypassed, or abused), the user wants to understand a target's security posture from an attacker's perspective, or the objective is to find vulnerabilities, simulate an attacker, or test whether controls hold u…
Hpp Hunter
Complete HTTP Parameter Pollution methodology server behavior fingerprinting, server-side and client-side HPP, WAF bypass via parameter splitting, OAuth/payment/access-control abuse, header and JSON body pollution, and report structure. Trigger when the user wants to test for HTTP Parameter Pollution, is trying to bypass a WAF with a known-blocked payload, sees a payment/role/redirect parameter a…
Compliance Gap Analyzer
Aggregates audit findings mapped to framework controls, classifies each control, identifies blind spots, prioritizes gaps by severity, and produces a complete gap report supports ISO 27001, NIST CSF, PCI-DSS, and OWASP. Trigger when the user provides audit findings tagged to framework controls and asks for a gap report, asks what controls are failing or what their biggest compliance gaps are, nee…
Finding Writer
Converts raw pentest notes, logs, or observations into a structured audit finding ready for a security report. Trigger when the user pastes raw notes, tool output, or a quick observation from a pentest, describes a vulnerability needing structure for a client report, has a log snippet or HTTP request/response revealing a security issue, or wants to turn a single-line note into a deliverable write…