Evaluator Agent — Development agent for Claude Code
Tests one attack surface for vulnerabilities — spawned per-surface with injected context from the orchestrator.
How to install Evaluator Agent
Installs to ~/.claude/agents/vmihalis-hacker-bob-evaluator-agent.md
mkdir -p ~/.claude/agents && curl -fsSL https://raw.githubusercontent.com/vmihalis/hacker-bob/HEAD/.claude/agents/evaluator-agent.md -o ~/.claude/agents/vmihalis-hacker-bob-evaluator-agent.md Restart Claude Code, or start a new session, for it to be picked up.
What Evaluator Agent does
name: evaluator-agent description: Tests one attack surface for vulnerabilities — spawned per-surface with injected context from the orchestrator tools: Bash, Read, Grep, Glob, mcp__hacker-bob__bob_ingest_sarif, mcp__hacker-bob__bob_read_static_analysis_index, mcp__hacker-bob__bob_record_candidate_claim, mcp__hacker-bob__bob_list_candidate_claims, mcp__hacker-bob__bob_repo_docker_run, mcp__hacker-bob__bob_repo_check, mcp__hacker-bob__bob_read_session_nucleus, mcp__hacker-bob__bob_write_wave_
Alternatives in Development
- Recon Ranker — Attack surface ranking agent 4.5k ★
- Review Workflow Context Budget — Reviews workflow machinery for context-window budget on three axes: always-loaded surface, load-on-demand disc 432 ★
- .github/workflows/redteam.yml — name: Continuous Red Team Assessment on: push: branches: [main, develop] pull_request: branches: [main] schedu 213 ★
Full documentation available on GitHub
View Source RepositoryRelated Agents
Evaluator Evm Agent
EVM smart-contract vulnerability evaluator — spawned per smart_contract surface, scaffolds and runs Foundry te
Evaluator Svm Agent
SVM (Solana) smart-contract vulnerability evaluator — spawned per smart_contract surface with chain_family=svm
Vulpine Orchestrator
Top-level entrypoint for a Vulpine run. Invoke with a git repository URL and optional commit hash. Runs the 8-
Exploit Chainer
Delegates to this agent when the user wants to automatically chain isolated vulnerabilities into multi-step at
Sstack Exceptional Conditions Attacker
Exceptional-conditions lens attacker. Tests fail-open paths, diagnostic leakage, and cascading failures. Invok
Ssrf Hunter
Active SSRF hunter for an ingested program. Consumes webvuln-surface injection points (ssrf_likely params + UR
Related Skills
Hunt Sqli
Active SQL injection hunt for an ingested program. Consumes webvuln-surface seeds + optional auth-context, tes
Security Audit Review
Performs deep security audits on any codebase — finds vulnerabilities, exploits, and attack vectors. Supports
Surface
Show ranked attack surface for a target from its recon manifest + hunt memory. Deterministic backing is cbh su