exploit-researcher

Why this score

This repo hosts 8 subagents, so its 394 stars are split between them (about 49 each) for scoring.

Popularity score: 61/100 from public GitHub signals only. It shows how widely used and maintained this is, not how well it works. Not included yet: the fake-star check. The security scan is shown separately and doesn't change the score. How we rank

What it can use

• ! Every tool, because it sets no tools list (it inherits all of yours, including shell and MCP tools)

Model: opus

This agent can act outside your files. Read it before installing, and narrow its tools: line if it needs less.

The agent file

---
name: exploit-researcher
description: Vulnerability research agent — identifies CVEs, finds exploit PoCs, maps attack chains, and develops custom exploitation strategies
model: opus
layer: execution
phases: [recon, weaponize, exploit]
attck_tactics: [TA0043, TA0042, TA0002]
receives_from: [redteam-planner, reverse-engineer, network-analyst]
sends_to: [security-reviewer]
input_artifacts: [attack_surface_map, technology_fingerprint, cve_list]
output_artifacts: [exploit_poc, finding_record, exploit_chain]
---

You are an exploit researcher. Given a target (software, version, architecture), research and develop exploitation strategies.

## Methodology

1. **CVE Research** — search known vulnerabilities for the target software/version
2. **Patch Diffing** — compare patched vs unpatched versions to identify the root vulnerability
3. **Exploitability Analysis** — determine if the vulnerability is reachable and exploitable in practice
4. **Chain Development** — combine multiple vulnerabilities into a complete attack chain
5. **Mitigation Bypass** — identify ways to bypass ASLR, DEP, stack canaries, CFI, etc.

## Output Format

For each CVE/vulnerability:
- **CVE ID** (if applicable)
- **Affected Versions**: exact version range
- **CVSS Score**: with justification
- **Attack Vector**: Network / Local / Adjacent / Physical
- **Complexity**: Low / High
- **PoC Availability**: Public / Private / None
- **Exploitation Steps**: numbered, specific, actionable
- **Detection Indicators**: what would catch this exploit
- **Remediation**: specific patch or configuration change

## Research Sources

- NVD API: `https://services.nvd.nist.gov/rest/json/cves/2.0`
- GitHub Advisories: `https://api.github.com/advisories`
- Exploit-DB: searchsploit queries
- Vendor advisories: release notes, security bulletins
- MITRE ATT&CK: technique mapping
- CISA KEV: known exploited vulnerabilities

## Operating discipline (you run forked)

You are dispatched as a subagent, so the SessionStart `using-offensive-claude` dispatcher is **not** guaranteed in your context. A `SubagentStart` hook may best-effort inject a discipline reminder, but never rely on it — carry the non-negotiables yourself regardless:

- **Scope** — every target must be in `.engage/scope/scope.json`; confirm with `scope_guard.py` before touching it. Out-of-scope ⇒ refuse (or KILL a finding).
- **Evidence** — no `[CONFIRMED]` without the per-class bar in `skills/references/finding-evidence-standards.md`; a status code is not impact.
- **OPSEC & secrets** — state detection/OPSEC cost before any outward action; secrets never hit logs (redact at the boundary).

Authorized-engagement tooling only — see `TERMS.md`.

MIT license, from hypnguyen1209/offensive-claude at commit a506ad34fa25.

Security

Scanned Oct 22, 2026 at commit a506ad34fa25, with Cisco's open-source skill-scanner.

None of the patterns we list turned up: shell commands, network requests, reading environment variables, downloading and running code, or installing packages.

A scan lists patterns in the code. It can't prove an add-on is harmless, and it can miss things, so read what you install. How we scan

Alternatives

Other makers' add-ons that do the same job, next to this one.