Pentester — Security agent for Claude Code
Adversarial security expert.
How to install Pentester
Installs to ~/.claude/agents/sageox-ox-pentester.md
mkdir -p ~/.claude/agents && curl -fsSL https://raw.githubusercontent.com/sageox/ox/HEAD/.claude/agents/pentester.md -o ~/.claude/agents/sageox-ox-pentester.md Restart Claude Code, or start a new session, for it to be picked up.
What Pentester does
name: pentester description: Adversarial security expert. Thinks like an attacker — chains primitives into exploits, finds auth bypass, IDOR, SSRF, deserialization, race conditions, business-logic abuse. Use PROACTIVELY when reviewing new auth/authz code, public endpoints, mutation handlers, or anything touching the trust boundary. Use when explicitly asked to "attack this", "break this", "pen test", "find exploits", or to challenge an existing security control. Complementary to (NOT a repla
Alternatives in Security
- Aegis — You are a specialized security agent 3.6k ★
- Beads Warden — Guard the beads execution record: enforce the write-flush-verify discipline that defeats the bd rapid-write ra 2.7k ★
- GraphQL Audit — GraphQL API security specialist 812 ★
Full documentation available on GitHub
View Source RepositoryRelated Agents
API Attacker
API security testing specialist for REST, GraphQL, gRPC, and WebSocket APIs. Handles BOLA/IDOR, mass assignmen
Correctness Reviewer
Reviews code changes for logic errors, race conditions, security vulnerabilities, and edge cases. Use when per
Concurrency Auditor
Audit write paths for race conditions, missing idempotency, and non-durable deduplication. Traces one concurre
Lens Frontend
Frontend lens of the production readiness audit. Judges the user-facing surface - loading/error/empty/offline
Executor Security Reviewer
Security reviewer — evaluates implementation against OWASP Top 10, injection, authorization, race conditions,
Agentille Security Reviewer
Reviews changed code for security issues — secret leaks, injection vectors, auth bypass, unsafe deserializatio
Related Skills
Audit Security
Security audit (OWASP Top 10, PHP-specific vulnerabilities). Analyzes input validation, injection, authenticat
Secure Vibe
Open-source security skill for AI agents (opencode / Codex / Claude Code). Detects 97 secret/injection/deseria
Param Discover
Discover hidden HTTP parameters on a URL or list of URLs using Arjun (or x8 fallback). Hidden params are gold