recommend
The `recommend` slash command routes pentesting tasks to specialized agent roles by classifying the attack domain, selecting one or two appropriate agents from a catalog of twenty-plus specialists, clarifying scope constraints, providing concrete CLI commands rather than methodology, and flagging task-specific risks or pivots. Use it when beginning a new engagement phase or when uncertain which specialized agent best handles the current objective.
mkdir -p ~/.claude/commands && curl -fsSL https://raw.githubusercontent.com/0xSteph/pentest-ai-agents/HEAD/.claude/commands/recommend.md -o ~/.claude/commands/recommend.mdrecommend.md
You are routing a pentesting task to the right specialist agent. The user's task is below. User task: $ARGUMENTS Do this in order: 1. **Classify the task.** Identify the primary domain (recon, web, AD, cloud, mobile, wireless, social engineering, malware, RE, forensics, detection, planning, reporting, CTF) and any cross-cutting concerns. 2. **Pick the agent (or two).** From the catalog below, name the single best agent. If a second agent would meaningfully help, name it as a hand-off. Don't list more than two. 3. **State the assumed scope.** Restate the in-scope assets, environment type (lab, internal, external, bug bounty, CTF), and any rules of engagement constraints visible in the request. If scope is missing, ask one direct question to fill the gap. 4. **Give 3–5 concrete next commands.** Real CLI invocations with placeholders the user can fill (`<target>`, `<wordlist>`). Not methodology paragraphs. Not "consider running nmap" — just `nmap -sV --top-ports 1000 <target>`. 5. **Note one thing to watch for.** A common pitfall, OPSEC consideration, or pivot signal that's specific to this task. One sentence. Agent catalog (for routing): - engagement-planner — pentest scoping, ROE, MITRE-mapped phased plans - recon-advisor — Nmap/Nessus/BloodHound output analysis, target prioritization (Tier 2) - osint-collector — domain recon, email harvest, breach data, social profiling - exploit-guide — methodology for AD/web/cloud/post-ex (advisory) - privesc-advisor — Linux/Windows privilege escalation - cloud-security — AWS/Azure/GCP, IAM escalation, container escape, serverless - api-security — REST/GraphQL/WebSocket, JWT, OAuth, OWASP API Top 10 - mobile-pentester — Android/iOS, Frida, Objection, MASTG/MASVS - wireless-pentester — WPA/WPA2/WPA3, evil twin, 802.1X, Bluetooth - social-engineer — phishing strategy, pretexting, vishing methodology - phishing-operator — Evilginx, GoPhish, dnstwist, live campaign tooling - vuln-scanner — Nuclei, Nikto, Nmap NSE, RouterSploit (Tier 2) - web-hunter — ffuf, gobuster, sqlmap, dalfox, Commix (Tier 2) - credential-tester — Hydra, Hashcat, John, CrackMapExec, wordlist generation - attack-planner — multi-step attack chain construction with stealth/impact scoring - bug-bounty — HackerOne/Bugcrowd methodology, dedup, report writing - ad-attacker — BloodHound, Impacket, NetExec, Certipy, Kerberos abuse (Tier 2) - exploit-chainer — chain low-severity findings into full compromise (Tier 2) - poc-validator — generate and safely run PoC scripts to eliminate false positives (Tier 2) - payload-crafter — msfvenom, Donut, custom loaders, paired with detection content - reverse-engineer — Ghidra, JadX, Radare2, Binwalk, static analysis workflows - swarm-orchestrator — coordinates multiple agents in parallel - bizlogic-hunter — price manipulation, race conditions, authorization flaws (Tier 2) - cicd-redteam — GitHub Actions, GitLab CI, Jenkins pipeline security - detection-engineer — Sigma, Splunk SPL, Elastic KQL, Sentinel KQL rules - threat-modeler — STRIDE/DREAD, attack trees, data flow diagrams - forensics-analyst — evidence acquisition, memory/disk forensics, timeline - malware-analyst — triage, dynamic analysis, IOC extraction, YARA - stig-analyst — DISA STIG, GPO remediation, keep-open justifications - report-generator — pentest reports, executive summaries, CVSS, remediation - ctf-solver — HackTheBox, TryHackMe, PicoCTF, web/pwn/rev/crypto/forensics Output format: ``` **Primary agent**: <name> **Hand-off to (if any)**: <name or "none"> **Assumed scope**: <one sentence> **Next commands**: 1. <command> 2. <command> 3. <command> **Watch for**: <one sentence> ``` If the user's task is out of scope (mass targeting, unauthorized DDoS, attacks on third parties), say so directly and refuse to route. Do not invent fake authorization context.
>-
Delegates to this agent when the user asks about API security testing, REST API attacks, GraphQL exploitation, OAuth/OIDC vulnerabilities, JWT attacks, API enumeration, or web service penetration testing methodology.
>-
>-
>-
Delegates to this agent when the user asks about command-and-control framework operations, Sliver/Mythic/Havoc/Cobalt Strike configuration, listener and beacon tuning, malleable C2 profiles, sleep and jitter strategy, redirector and CDN fronting infrastructure, or operating an established foothold during authorized red team engagements.
>-
Delegates to this agent when the user asks about cloud security testing, AWS/Azure/GCP penetration testing, cloud misconfiguration analysis, IAM privilege escalation, container security, Kubernetes attacks, serverless security, or cloud-native attack paths.