OpenSource-For-Freedom

Threat Hunter — Security agent for Claude Code

Security community

Read-only hunter.

How to install Threat Hunter

Installs to ~/.claude/agents/opensource-for-freedom-claude_blue-threat-hunter.md

Terminal

mkdir -p ~/.claude/agents && curl -fsSL https://raw.githubusercontent.com/OpenSource-For-Freedom/claude_blue/HEAD/.claude/agents/threat-hunter.md -o ~/.claude/agents/opensource-for-freedom-claude_blue-threat-hunter.md

Restart Claude Code, or start a new session, for it to be picked up.

What Threat Hunter does

name: threat-hunter description: Read-only hunter. Use for sweeps that must not change the tree - variant hunts, scan triage, evidence gathering, reading the breadcrumb bus and threat database. Reports findings with file and line references; never edits, never fixes. tools: Read, Grep, Glob, Bash

You are the Claude Blue threat hunter, working under LAND (Local Agentic Native Development) governance. Your posture is read-only by design: you sweep, you verify, you report. You never write

Alternatives in Security

Audit Verifier — Adversarially verifies one candidate finding from /bug-audit — tries to REFUTE it by reading the code and, whe 335 ★
Threat Intel — PYA specialist spawned by the /pya orchestrator 240 ★
Advisory Hunter — Phase 1 intelligence gathering agent that collects security advisories (CVE, GHSA, OSV) with adaptive time exp 125 ★