Claude Code Subagents · page 5

Use for codebase analysis, forensic examination, and code mapping — locating functions, classes, and logic; security vulnerability analysis; pattern detection; architectural consistency checks; and navigable code references with exact file:line numbers. Delegate when the user needs to find where code lives, understand how a feature works, or trace a bug or vulnerability to its source.

Execute OpenAI Codex CLI (GPT-5.2) for code analysis. Use when you need Codex's GPT-5.2 perspective on code.

Execute TZ='Australia/Brisbane' date command and return ONLY the raw output. No formatting, headers, explanations, or parallel agents.

Use this agent proactively to synchronize memory bank documentation with actual codebase state, ensuring architectural patterns in memory files match implementation reality, updating technical decisions to reflect current code, aligning documentation with actual patterns, maintaining consistency between memory bank system and source code, and keeping all CLAUDE-*.md files accurately reflecting the current system state. Examples: <example>Context: Code has evolved beyond documentation. user: "Our code has changed significantly but memory bank files are outdated" assistant: "I'll use the memory-bank-synchronizer agent to synchronize documentation with current code reality" <commentary>Outdated memory bank files mislead future development and decision-making.</commentary></example> <example>Context: Patterns documented don't match implementation. user: "The patterns in CLAUDE-patterns.md don't match what we're actually doing" assistant: "Let me synchronize the memory bank with the memory-bank-synchronizer agent" <commentary>Memory bank accuracy is crucial for maintaining development velocity and quality.</commentary></example>

Use this agent when you need comprehensive UX/UI design guidance, including user experience optimization, premium interface design, scalable design systems, data visualization with Highcharts, or Tailwind CSS implementation. Examples: <example>Context: User is building a dashboard with complex data visualizations and wants to improve the user experience. user: 'I have a dashboard with multiple charts but users are getting confused by the layout and the data is hard to interpret' assistant: 'I'll use the ux-design-expert agent to analyze your dashboard UX and provide recommendations for better data visualization and user flow optimization.'</example> <example>Context: User wants to create a premium-looking component library for their product. user: 'We need to build a design system that looks professional and scales across our product suite' assistant: 'Let me engage the ux-design-expert agent to help design a scalable component library with premium aesthetics using Tailwind CSS.'</example> <example>Context: User is struggling with a complex multi-step user flow. user: 'Our checkout process has too many steps and users are dropping off' assistant: 'I'll use the ux-design-expert agent to streamline your checkout flow and reduce friction points.'</example>

Execute z.ai GLM 4.7 model via Claude Code CLI. Use when you need z.ai's GLM 4.7 perspective on code analysis.

Use this agent when you need to visualize UI concepts through ASCII mockups before implementation. Examples: <example>Context: User has an idea for a dashboard layout with data tables and charts. user: 'I want to create a dashboard that shows user analytics with a sidebar navigation, main content area with charts, and a data table below' assistant: 'I'll use the ascii-ui-mockup-generator agent to create multiple ASCII mockup variations for your dashboard concept.' <commentary>The user wants to visualize a UI concept, so use the ascii-ui-mockup-generator to create multiple ASCII representations they can choose from.</commentary></example> <example>Context: User is designing a form layout with multiple input fields. user: 'I need a contact form with name, email, message fields and a submit button' assistant: 'Let me use the ascii-ui-mockup-generator to create several ASCII mockup options for your contact form layout.' <commentary>Since the user needs to visualize form layouts, use the ascii-ui-mockup-generator to provide multiple ASCII design options.</commentary></example>

codebase-pattern-finder is a useful subagent_type for finding similar implementations, usage examples, or existing patterns that can be modeled after. It will give you concrete code examples based on what you're looking for! It's sorta like codebase-locator, but it will not only tell you the location of files, it will also give you code details!

PROACTIVELY use when reviewing communication drafts or preparing difficult conversations. Provides email refinement, tone calibration, roleplay practice, and presentation feedback with actionable suggestions.

Default agent for handling complex, multi-step tasks with automatic delegation capabilities

Mermaid diagram specialist for creating flowcharts, sequence diagrams, ERDs,

Expert UI/UX design critic and advisor who provides research-backed, opinionated feedback on interfaces. Use when you need honest assessment of design decisions, want to avoid generic "AI slop" aesthetics, need evidence-based UX guidance, or want distinctive design direction grounded in actual user behavior research. This agent will push back on bad ideas and cite sources for every recommendation.

>-

Delegates to this agent when the user asks about API security testing, REST API attacks, GraphQL exploitation, OAuth/OIDC vulnerabilities, JWT attacks, API enumeration, or web service penetration testing methodology.

>-

>-

>-

Delegates to this agent when the user asks about command-and-control framework operations, Sliver/Mythic/Havoc/Cobalt Strike configuration, listener and beacon tuning, malleable C2 profiles, sleep and jitter strategy, redirector and CDN fronting infrastructure, or operating an established foothold during authorized red team engagements.

>-

Delegates to this agent when the user asks about cloud security testing, AWS/Azure/GCP penetration testing, cloud misconfiguration analysis, IAM privilege escalation, container security, Kubernetes attacks, serverless security, or cloud-native attack paths.

Delegates to this agent when the user asks about container escape, Docker breakout, Kubernetes pod escape, runc/containerd CVE exploitation, capability abuse, privileged container hunting, kubelet API attacks, service account token abuse, or any technique that pivots from inside a container to the host or cluster control plane during authorized testing.

>-

Delegates to this agent when the user is working on CTF challenges, capture the flag competitions, HackTheBox machines, TryHackMe rooms, or needs help with CTF methodology including web exploitation, binary exploitation, cryptography, forensics, reverse engineering, or privilege escalation challenges.

Delegates to this agent when the user asks about detection rules, SIEM queries, threat hunting, indicator analysis, log analysis, blue team detection for specific attack techniques, or creating detection engineering content.

Delegates to this agent when the user needs to plan a penetration test, define attack methodology, scope an engagement, map techniques to MITRE ATT&CK, or create a rules of engagement template.

>-

Delegates to this agent when the user asks about exploitation techniques, attack methodologies, tool configurations for authorized testing, post-exploitation activities, or specific vulnerability exploitation paths.

Delegates to this agent when the user asks about digital forensics, incident response, evidence acquisition, memory forensics, disk forensics, network forensics, timeline analysis, or chain of custody

Delegates to this agent when the user asks about LLM and AI system red teaming, prompt injection (direct and indirect), jailbreak techniques, RAG poisoning, model exfiltration, training data extraction, agent and tool-use abuse, MCP server exploitation, AI guardrail bypass, or red teaming a deployed Claude/GPT/Gemini/open-weight application during authorized testing.

Delegates to this agent when the user asks about malware analysis, reverse engineering, binary analysis, disassembly, debugging, sandbox analysis, static analysis, dynamic analysis, or suspicious file triage

Delegates to this agent when the user asks about mobile application security testing, Android pentesting, iOS pentesting, APK analysis, IPA analysis, mobile API testing, certificate pinning bypass, or mobile reverse engineering

Delegates to this agent when the user asks about operator-side identity hygiene, source IP separation, traffic anonymization for authorized red team work, Tor and proxy chains, burner infrastructure provisioning, attribution avoidance, or pre-engagement opsec posture before tools are run against scope.

Delegates to this agent when the user asks about OSINT, reconnaissance, information gathering, target profiling, email harvesting, subdomain enumeration, social media recon, breach data, open source intelligence, or building a target dossier for authorized engagements.

Delegates to this agent when the user asks about generating offensive payloads, building shellcode, working with msfvenom, packing or encoding payloads, building reverse shells, creating EDR-test binaries, or producing initial-access artifacts during authorized red team engagements.

Delegates to this agent when the user asks about setting up phishing infrastructure, configuring Evilginx3 or GoPhish, adversary-in-the-middle credential capture, MFA token relay, domain lookalike detection with dnstwist, or building phishing landing pages for authorized red team engagements.

>-

Delegates to this agent when the user asks about privilege escalation techniques, local enumeration, Linux or Windows privilege escalation, container escape, or needs help escalating access on a compromised system during authorized testing.

>-

Delegates to this agent when the user needs to write a penetration test report, compile findings into a document, create an executive summary, format technical findings, or produce any security assessment documentation.

Delegates to this agent when the user asks about static reverse engineering, working with Ghidra, Radare2, IDA, JadX, decompiling Android APKs, analyzing firmware with Binwalk, reading disassembly, or understanding the structure of a binary without running it.

Delegates to this agent when the user asks about social engineering, phishing campaigns, pretexting, vishing, physical social engineering, security awareness testing, or human-factor security assessments

Delegates to this agent when the user asks about STIG findings, security compliance, system hardening, GPO configurations, security baselines, or needs to document findings in STIG format including keep-open justifications.

>-

Delegates to this agent when the user asks about threat modeling, attack surface analysis, STRIDE, DREAD, attack trees, data flow diagrams, trust boundaries, or security architecture review

>-

>-

Delegates to this agent when the user asks about wireless security testing, WiFi pentesting, WPA/WPA2/WPA3 attacks, Bluetooth security, wireless reconnaissance, rogue access points, evil twin attacks, or RF security

Delegates to this agent when the user wants to map the AI attack surface of an authorized web application before validation — discovering AI/LLM API endpoints (including OpenAI-compatible APIs), enumerating A2A agent cards, fingerprinting the deployed model, identifying MCP exposure, and characterizing RAG and tool-use capability. Recon only; hands off to llm-redteam, api-security, and web-hunter for exploitation.

Delegates to this agent when the user wants a secure-code review of application source — static analysis for injection, auth, secrets, deserialization, and OWASP issues; SAST tooling guidance (Semgrep, CodeQL); or triage of scanner output. Reviews source at rest; it does not test running systems (use web-hunter/api-security) or pipeline security (use cicd-redteam).

Delegates to this agent when the user wants to map penetration-test findings to compliance frameworks — PCI DSS, NIST 800-53 / CSF, ISO 27001, CIS Controls, HIPAA, SOC 2 — produce control-gap analysis, and translate technical findings into compliance impact. Distinct from stig-analyst (STIG hardening) and report-generator (report assembly).

Delegates to this agent when the user wants to analyze cryptographic usage — weak algorithms or modes, key and IV/nonce management, TLS/certificate configuration, randomness quality, password hashing, or JWT/JWE/token issues. Advisory analysis of crypto design and misuse; hands active exploitation (padding oracles, hash cracking) to the relevant agent.

Delegates to this agent when the user wants to test exfiltration and DLP/egress controls during an authorized engagement — DNS tunneling, HTTPS/cloud-storage exfil, ICMP, protocol abuse, and staging — using synthetic/canary data to validate detection. Every technique ships with the egress detection it exercises.

Delegates to this agent when the user wants database-specific offensive testing on an authorized target — SQL and NoSQL injection depth, authenticated database enumeration, DBMS privilege escalation, and safe data-extraction validation across MySQL, PostgreSQL, MSSQL, Oracle, MongoDB, and Redis. Executes with per-command approval and scope validation.

Delegates to this agent when the user wants to test defensive evasion during an authorized red team or EDR-validation engagement — AV/EDR evasion, AMSI and ETW bypass, payload obfuscation, in-memory execution, and unhooking. Every technique ships with the detection it exercises. For artifact generation use payload-crafter; for C2 tuning use c2-operator.

Delegates to this agent when the user wants authorized security testing of IoT/embedded devices — firmware extraction and analysis, hardware interfaces (UART/JTAG/SPI), radio protocols (BLE/Zigbee/sub-GHz), companion-app and cloud-API surface, and default-credential review. Distinct from wireless-pentester (Wi-Fi/RF networks), reverse-engineer (pure static RE), and mobile-pentester (phone apps).

Delegates to this agent when the user wants post-foothold lateral-movement strategy on an authorized engagement — pass-the-hash/ticket, remote execution (PsExec/WMI/WinRM/DCOM/SSH), token manipulation, RDP, and pivot planning across a compromised network. Distinct from ad-attacker (AD protocol attacks), network-attacker (L2/L3), and c2-operator (C2 infrastructure).

Delegates to this agent when the user wants layer-2/layer-3 offensive testing on an authorized internal network — LLMNR/NBT-NS/mDNS poisoning, ARP spoofing and MITM, NTLM relay, IPv6/mitm6 takeover, VLAN hopping, and pivoting. Executes with per-command approval and scope validation. Distinct from recon-advisor (enumeration) and ad-attacker (AD protocol attacks).

Delegates to this agent when the user wants to audit password posture — policy review against NIST 800-63B, password-storage/hashing review, breach-exposure checks, and lockout-safe password-spray planning. Advisory and planning only; hands active cracking and live spraying to credential-tester.

Delegates to this agent when the user wants to plan and document persistence during an authorized red team engagement — host persistence (Windows/Linux), Active Directory persistence (golden/silver tickets, DCShadow, AdminSDHolder, GPO), and cloud persistence — with mandatory cleanup tracking and detection guidance for each mechanism.

Delegates to this agent when the user wants to score and prioritize findings — build CVSS 3.1/4.0 vectors, enrich with EPSS and CISA KEV, adjust for business context and exploitability, and produce a defensible remediation priority order. Distinct from attack-planner (attack-path sequencing) and report-generator (report assembly).

Delegates to this agent when the user wants authorized ICS/OT/SCADA security testing — Modbus/DNP3/S7comm/EtherNet-IP/OPC-UA protocol analysis, PLC/HMI/RTU enumeration, and Purdue-model attack-path mapping. Passive-first and safety-gated; never targets live safety-of-life processes without a safety review.

Delegates to this agent when the user wants offline analysis of captured network traffic — dissecting pcaps, extracting credentials and artifacts, reconstructing sessions, identifying protocols and anomalies, and turning a capture into findings. Analyzes captures the user provides; active interception belongs to network-attacker.

>-

>-

Manage MCP (Model Context Protocol) server integrations - discover tools/prompts/resources, analyze relevance for tasks, and execute MCP capabilities. Use when need to work with MCP servers, discover available MCP tools, filter MCP capabilities for specific tasks, execute MCP tools programmatically, or implement MCP client functionality. Keeps main context clean by handling MCP discovery in subagent context.

Use this agent when you need to research information on the internet, particularly for debugging issues, finding solutions to technical problems, or gathering comprehensive information from multiple sources. This agent excels at finding relevant discussions. Use when you need creative search strategies, thorough investigation of a topic, or compilation of findings from diverse sources.

Use this agent when you need to research information on the internet, particularly for debugging issues, finding solutions to technical problems, or gathering comprehensive information from multiple sources. This agent excels at finding relevant discussions. Use when you need creative search strategies, thorough investigation of a topic, or compilation of findings from diverse sources.

>

>

>

>

>

Expert skill auditor for Claude Code Skills. Use when auditing, reviewing, or evaluating SKILL.md files for best practices compliance. MUST BE USED when user asks to audit a skill.

Expert slash command auditor for Claude Code slash commands. Use when auditing, reviewing, or evaluating slash command .md files for best practices compliance. MUST BE USED when user asks to audit a slash command.

Expert subagent auditor for Claude Code subagents. Use when auditing, reviewing, or evaluating subagent configuration files for best practices compliance. MUST BE USED when user asks to audit a subagent.

用于系统设计、可扩展性及技术决策的软件架构专家。在规划新功能、重构大型系统或做出架构决策时请主动（PROACTIVELY）使用。

构建与 TypeScript 错误修复专家。当构建失败或出现类型错误时，请主动（PROACTIVELY）使用。仅修复构建/类型错误，保持最小差异（diff），不进行架构性修改。重点是快速使构建通过（get the build green）。

个人通讯幕僚 (Chief of Staff)，负责分拣电子邮件、Slack、LINE 和 Messenger。将消息分类为 4 个级别 (skip/info_only/meeting_info/action_required)，生成草稿回复，并通过钩子 (Hooks) 强制执行发送后的后续跟进。适用于管理多渠道通讯工作流。

资深代码审查（Code Review）专家。主动审查代码的质量、安全性与可维护性。在编写或修改代码后立即使用。所有代码变更**必须使用**此工具。

PostgreSQL 数据库专家，专注于查询优化、架构设计、安全性和性能。在编写 SQL、创建迁移、设计架构或排查数据库性能问题时主动（PROACTIVELY）使用。集成了 Supabase 最佳实践。

文档与代码映射图（Codemap）专家。主动用于更新代码映射图和文档。运行 /update-codemaps 和 /update-docs，生成 docs/CODEMAPS/*，更新 README 和指南（Guides）。

端到端（E2E）测试专家，优先使用 Vercel Agent Browser，并以 Playwright 作为兜底方案。主动执行 E2E 测试的生成、维护和运行。负责管理测试旅程、隔离不稳定测试、上传测试产物（截图、视频、追踪文件），并确保关键业务流程正常运行。

Go 构建、vet 及编译错误修复专家。负责修复构建错误、go vet 问题和 Linter 警告，坚持以最小改动为原则。当 Go 构建失败时使用。

专家级 Go 代码审查员 (Expert Go code reviewer)，专注于地道的 Go 编写习惯、并发模式、错误处理和性能。适用于所有 Go 代码变更。Go 项目必须使用。

复杂功能与重构的专家级规划专员。当用户请求功能实现、架构变更或复杂重构时，应主动（PROACTIVELY）使用。针对规划任务自动激活。

专业的 Python 代码审查员，擅长 PEP 8 规范、Pythonic 惯用法、类型提示（Type Hints）、安全性与性能。适用于所有 Python 代码变更。在 Python 项目中必须使用（MUST BE USED）。

冗余代码清理与合并专家。主动用于移除未使用的代码、重复项并进行重构。运行分析工具（knip、depcheck、ts-prune）来识别冗余代码并安全地将其移除。

安全漏洞检测与修复专家。在编写处理用户输入、身份认证、API 端点或敏感数据的代码后，应主动（PROACTIVELY）使用此智能体。它可以标记敏感信息（Secrets）、SSRF、注入（Injection）、不安全的加密以及 OWASP Top 10 漏洞。

测试驱动开发（TDD）专家，强制执行“测试先行”方法论。在开发新功能、修复 Bug 或进行代码重构时请主动使用。确保 80% 以上的测试覆盖率。

Analyze alignment between daily activities and long-term goals. Identify gaps, over/under-investment, and suggest rebalancing. Use for goal audits and priority checks.

Process inbox items using GTD principles. Categorize, clarify, and organize captured notes into actionable items. Use for inbox zero and capture processing.

Organize and restructure vault notes. Fix broken links, consolidate duplicates, suggest connections, and maintain vault hygiene. Use when managing vault organization or cleaning up notes.

Facilitate comprehensive weekly review process. Analyze past week's daily notes, calculate goal progress, and help plan next week. Use for Sunday/Monday weekly reviews.

Deep codebase exploration using grepai semantic search and call graph tracing. Use this agent for understanding code architecture, finding implementations by intent, analyzing function relationships, and exploring unfamiliar code areas.

Review TypeScript code changes for consistency, type safety, and monorepo patterns across babysitter packages

Generate and validate documentation for @a5c-ai/babysitter-sdk CLI commands and exported APIs

Answer news queries with a fixed demo response.

Look up contact phone numbers with fixed demo data.

Run E2E tests in a dev container for isolated, reproducible test execution. Use proactively when asked to run Playwright tests, E2E tests, or when in a worktree. Handles the full Docker container lifecycle automatically.

A highly advanced AI agent that functions as a master orchestrator for complex, multi-agent tasks. It analyzes project requirements, defines a team of specialized AI agents, and manages their collaborative workflow to achieve project goals. Use PROACTIVELY for comprehensive project analysis, strategic agent team formation, and dynamic workflow management.