claude-agenthunter

Plugin claude-agenthunter from marketplace elementalsouls in elementalsouls/Claude-AgentHunter. Commands read from the repo's manifest — 19 days ago.

Skills (24)

• ai-agent-methodology

  Master orchestrator for AI-agent red-team assessments — enterprise copilots, DevOps/SRE agents, RAG assistants, coding/IDE agents, MCP/A2A tool servers, autonomous workflow agents. Load at the START of any agent test, when facing a new agent target, or when unsure what to test next. Routes to the hu

• hunt-agent-auth-bypass

  Authorization bypass in AI-agent tools — role/persona claims, unverifiable named-credential exceptions, privilege fields inside attacker-supplied credential documents, privilege escalation via prompt injection, data-classification override, and 'I-am-the-admin' attacks against prompt-level access co

• hunt-agent-blind-exfil

  Extract data from AI-agent tools that execute but hide output — status-only, exit-code-only, or DLP-filtered. Characterize FIRST (visibility, allowlist, egress), then pick a channel: OOB DNS/HTTP, DLP-bypass via an unfiltered tool, boolean exit-code oracle, or timing. The channel that works is the o

• hunt-agent-browser-use

  Attacks specific to computer-use and browser agents — agents that see a screen/DOM and act by clicking, typing, and navigating (AI browsers like Comet/Atlas, ChatGPT Operator, Claude Computer-Use, RPA copilots). Covers indirect injection through rendered page content the agent reads as instructions,

• hunt-agent-brute-force

  Brute-force and rate-limiting weaknesses in AI-agent tools — PIN/token/password guessing with no lockout, and feedback oracles (correct-digit / too-high-low / Mastermind-style) that collapse the search space. Use when a tool accepts guesses and returns feedback without throttling.

• hunt-agent-config-poisoning

  The agent's OWN configuration, instruction, and settings files as an attack surface — CLAUDE.md / AGENTS.md / .cursorrules / copilot-instructions.md, .vscode/settings.json, .claude/settings.json, .cursor/mcp.json / .mcp.json, hooks, and allowlist/YOLO toggles. A repo, doc, or upstream agent plants i

• hunt-agent-crypto

  Cryptographic weaknesses in AI-agent tools that encrypt/decrypt/sign or mint tokens — ECB cut-and-paste and byte-at-a-time, padding oracles, missing MAC, hardcoded keys/predictable IVs. Use when an agent exposes crypto operations as tools.

• hunt-agent-deserialization

  Unsafe deserialization in AI-agent tools that parse structured data — YAML, pickle, JSON, XML, TOML — via tool parameters, AND poisoned model/dataset artifacts loaded from a hub (Hugging Face / registry pickle: torch.load, .pkl/.pt/.ckpt). Identify the runtime, pick the matching gadget, PROVE code e

• hunt-agent-guardrail-evasion

  Cross-cutting techniques for getting a payload past input/output guardrails — safety classifiers, refusal training, moderation filters, DLP. Encoding/obfuscation, Unicode-tag/ASCII smuggling, low-resource-language, adversarial suffixes (GCG), payload splitting/token smuggling, roleplay/refusal-suppr

• hunt-agent-hitl-bypass

  Defeating the human-in-the-loop approval gate — the last line of defense before a consequential agent action (payment, deploy, delete, email, privilege grant). Approval-summary manipulation (approve X, agent does Y), approval fatigue/batching, standing 'always-allow' scope creep, timeout-auto-approv

• hunt-agent-info-disclosure

  Information disclosure in AI-agent tools — log/diagnostic leakage, environment dumps via multi-step diagnostic chains, path traversal, arbitrary file import, and secret-in-context. Every tool that returns data is a potential leak; a returned 'secret' may be confabulated — verify.

• hunt-agent-mcp-exposure

  MCP (Model Context Protocol) exposure in AI agents: direct resource access, tool enumeration, missing auth, session/Origin issues, protocol-level abuse, and the delegated-identity OAuth flows an MCP proxy runs — confused-deputy auth-code theft, token passthrough, SSRF via OAuth metadata discovery, a

• hunt-agent-mcp-supply-chain

  Trust/supply-chain attacks on the MCP tool ecosystem an agent connects to — tool-description injection, rug-pull (tool mutates after approval), cross-server tool shadowing, line-jumping/name collision, confused-deputy via a malicious tool, token/consent theft, and injection delivered through tool RE

• hunt-agent-memory-poisoning

  Persistent poisoning of an AI agent's long-term memory / stored profile / writable knowledge — so injected content survives across sessions (and sometimes across users) and re-fires without re-injection. Covers direct memory-write injection, indirect auto-memorization, persistent exfil ('spAIware'),

• hunt-agent-multi-agent

  Cross-agent trust, privilege, and shared-state abuse in multi-agent systems, including A2A (Agent-to-Agent) protocol exposure. Confused-deputy across agents, privileged-tool reach via a 'clearance'/orchestrator agent, direct A2A/agent-card access, indirect prompt injection through shared context/mem

• hunt-agent-native-memory

  Memory-safety exploitation of the NATIVE program behind an agent tool — stack/heap overflow, pointer and length-field corruption, leaked addresses in tool output, and ret2shellcode/ROP through an MCP or function-calling interface. Use when a tool wraps a compiled binary, a legacy service, or any non

• hunt-agent-output-exfil

  Client-side data exfiltration through AI-agent OUTPUT rendered in a UI — zero-click markdown-image exfil, HTML/img-src injection, one-click hyperlink exfil, and CSP/allowlist bypass. The agent is induced (usually via prompt injection) to emit markup that the victim's client auto-fetches, leaking con

• hunt-agent-prompt-extraction

  Extract an AI agent's system prompt, tool contract, hidden instructions, and embedded secrets — and tell a real leak from a confabulation. Structural extraction (quote-the-Nth-sentence), guardrail-vs-filter distinction, and the run-twice reproducibility gate. Use to map what the agent knows/does bef

• hunt-agent-prompt-injection

  Prompt injection in AI agents — direct (chat box is the trust boundary), indirect (payload planted in data the agent later reads: docs, web pages, emails/tickets, RAG chunks, tool output), multimodal (image/audio/file, ASCII/Unicode-tag smuggling), and multi-turn jailbreaks (crescendo, many-shot, sk

• hunt-agent-race-condition

  TOCTOU / race conditions in AI-agent tools: double-spend, limit bypass, coupon reuse, privilege flip, inventory oversell — any stateful agent where check and commit aren't atomic. Fire operations in parallel (single-packet beats an LLM 'do it simultaneously' prompt) and PROVE the shared state change

• hunt-agent-rag

  Attacks on retrieval-augmented agents and their vector stores — knowledge/corpus poisoning, indirect injection via retrieved chunks, cross-tenant/access-control retrieval bypass (IDOR at the embedding layer), ranking manipulation, embedding inversion/membership inference, and citation spoofing. The

• hunt-agent-resource-abuse

  Unbounded-consumption / denial-of-wallet attacks on agents — forcing expensive token generation, recursive/agent-fan-out loops, unbounded context/retrieval, costly downstream tool calls, and shared-quota exhaustion that degrades service for other tenants. The finding is a MEASURED cost or availabili

• hunt-agent-time-gate

  Temporal-constraint bypass in AI-agent tools — future-dating, weekend/maintenance-window evasion, rate-reset manipulation. Time gates enforced as prompt instructions are not real time locks. A TOCTOU variant: cross-check hunt-agent-race-condition before double-reporting.

• hunt-agent-tool-injection

  Command/code injection in AI-agent tools — shell, Python/JS eval, SQL, SSRF via fetch tools. Covers separators, the newline bypass and the shell-vs-agent-extraction ambiguity that decides whether substitution fires, denylist bypass, the exit-code oracle, and the browser-vs-API gap. The agent lies ab

Slash commands (5)

• /claude-agenthunter:characterize-agent

  Step 1 of an agent pentest — fingerprint the target before sending any payload. Maps visibility, tool allowlist, egress, oracle semantics, auth/tenancy. Never probe before this. Usage: /characterize-agent <target>

• /claude-agenthunter:hunt-agent

  Start an agent pentest. Fingerprint the target agent, select applicable hunt-agent skills, run their probes, score with the 4 detection arms, apply both gates, report only actioned findings.

• /claude-agenthunter:report-agent

  Write a submission-ready agent-pentest finding after it passes /validate-agent. Scores by the SINK reached (tool action / data / cross-tenant effect), not by what the model said. Usage: /report-agent

• /claude-agenthunter:score-agent

  Score captured agent traces with the 4 detection arms (A taint, B unrequested action, C output echo, D provenance) and apply both gates. A target is clean only when all arms agree AND their controls fired. Usage: /score-agent <runs_dir> <suite> [--baselines d1,d2]

• /claude-agenthunter:validate-agent

  Gate a single agent finding through the FP gate + Negative-Result gate before writing any report. Kills findings that are fluent text, not retrieved state. Run before /report-agent. Usage: /validate-agent

Similar plugins