webspec-red-team

Plugin webspec-red-team from marketplace webspec-local in I-m-A-g-I-n-E/WebSpec. Commands read from the repo's manifest — 19 days ago.

Skills (1)

• attack-patterns

  Reference knowledge for all 10 MoltBook-class attack patterns with indicators of compromise, WebSpec defenses, and detection signatures. Use when you need to understand attack mechanics or verify defensive controls.

Slash commands (1)

• /webspec-red-team:red-team

  Launch a full WebSpec red team sweep — runs all 10 attack-category agents against the target and produces a consolidated security report.

Subagents (10)

• credential-exfil-prober

  Use this agent to test for silent credential theft vulnerabilities (weather-plugin-class). Verifies WebSpec permission scoping prevents skills from accessing resources outside their declared scope. Examples: <example> Context: User wants to verify skill permission boundaries user: "Check if any of o

• heartbeat-hijack-tester

  Use this agent to test for remote control plane hijacking vulnerabilities. Verifies NLP resolution constraints, confirmation thresholds, and three-way join enforcement that prevent unauthorized remote command execution. Examples: <example> Context: User wants to test control plane security user: "Te

• identity-spoof-tester

  Use this agent to test identity verification bypass vulnerabilities (88:1 bot-to-human ratio class). Validates the three-layer auth chain: platform OAuth, device-bound sessions, and per-invocation confirmation. Examples: <example> Context: User wants to test identity verification strength user: "Tes

• memory-poison-simulator

  Use this agent to test for time-shifted memory poisoning vulnerabilities. Verifies token expiration enforcement, session binding, and resistance to fragmented payload assembly across requests. Examples: <example> Context: User wants to test session token lifecycle user: "Test if our tokens properly

• origin-hijack-tester

  Use this agent to test for cross-origin and WebSocket hijacking vulnerabilities (CVE-2026-25253-class). Verifies WebSpec same-origin policy enforcement on subdomain boundaries and WebSocket connections. Examples: <example> Context: User wants to test WebSocket security user: "Check if our WebSocket

• prompt-injection-crafter

  Use this agent to validate METHOD tokenization against prompt injection attacks (2.6% bot-to-bot injection class). Tests Tier 1 tokenization and Tier 2 POS rotation. The core METHOD tokenization validator. Examples: <example> Context: User wants to test METHOD tokenization resilience user: "Test if

• rls-bypass-scanner

  Use this agent to scan for database access control bypass vulnerabilities (Supabase RLS-class). Tests whether subdomain isolation in WebSpec prevents leaked credentials from granting cross-service access. Examples: <example> Context: User wants to check if client-side code exposes database credentia

• skill-integrity-scanner

  Use this agent to bulk audit skill manifests and code for integrity issues (36.82% marketplace failure rate class). Validates registration schema compliance, OAuth scope accuracy, hardcoded secrets, and known malicious patterns. Examples: <example> Context: User wants to audit skill marketplace qual

• supply-chain-auditor

  Use this agent to audit skill/plugin supply chain integrity (ClawHavoc-class). Checks domain verification, well-known manifests, DNS TXT records, and scans for obfuscated payloads in skill code. Examples: <example> Context: User wants to verify skill/plugin authenticity user: "Audit our skill manife

• webhook-injection-tester

  Use this agent to test external hook and webhook paths for prompt injection via verb smuggling. Verifies METHOD tokenization applies to all inbound data channels including email, webhooks, and API responses. Examples: <example> Context: User wants to test webhook security against injection user: "Te

Similar plugins