Claude-AgentHunter

Pentest AI agents — and prove both the findings and the absences. A skill bundle plus a runnable engine for red-teaming LLM agents: chatbots, RAG assistants, tool-calling copilots, MCP servers, and autonomous ReAct agents · 24 skills (23 hunt + methodology) · 4 detection arms · 24/24 lab gates · 7 target environments · FN 0 over 949 field runs · loads into Claude Code, OpenCode, Hermes, Codex CLI and AntiGravity.

Built by Sachin Sharma — Bug Hunting & GenAI Security Research.

---

Sibling to Claude-BugHunter — same shape, different quarry. BugHunter hunts web apps; Claude-AgentHunter hunts the agents themselves.

24 skills   ·   4 detection arms   ·   24/24 lab gates   ·   7 target environments   ·   FN 0 over 949 runs

What is this

A drop-in skill bundle for the Claude Code skills system (and OpenCode, Hermes, Codex CLI, AntiGravity). Install once and the harness stops guessing at agent security and starts running a disciplined pentest: it fingerprints the target agent, picks the right hunt-agent-* skills by surface, runs their stdlib-only probes, scores the traces with a 4-arm engine, and gates every finding so a fluent answer never ships as a leak and a silent probe never ships as “clean”. Describe the target in plain English and the relevant skills auto-load — no invocation by name. The whole flow runs as one command, /hunt-agent, or stage by stage (see Commands).

Why it exists

An agent generates text; it does not retrieve state. That creates two failure modes a web pentest never has to worry about, and Claude-AgentHunter is built around catching both:

• A fluent answer looks identical to a real leak → the False-Positive gate.
• A silent probe looks identical to a secure target → the Negative-Result gate.

The second one is the hard one. Across this project’s own development, ten probe defects each reported a compromise as clean — a similarity gate that scored a real leak 0.03, an HTTP 500 counted as a refusal that buried a confirmed bypass, a token floor that hid the forgery that leaked the flag. Every one looked like a passing test. Both gates live in engine/gates.py and ship in every skill.

How the skills work

Each skill is skills//SKILL.md — Agent-Skills markdown with frontmatter (name, description, sources, validated_against, report_count — the count of in-house field-validated reports behind the skill, 0 for reference-only). Harnesses topic-match on the description; describing your test in plain English loads the relevant skills, no explicit invocation. Unlike static methodology skills, each one carries a Runnable Probe that executes against a live agent and a # LETHAL WHEN: line tying its output to the gate. Catalog: docs/skills.md.

The engine (what connects and merges)

engine/ is the deterministic core. It normalises any target into one trace shape (engine/adapters/), runs four complementary detection arms over it, and gates the result:

No arm is sufficient alone. Taint is 64/64 on one suite and 0/39 on another. A target is clean only when all arms agree and their controls fired.

python3 engine/score.py agentdojo   --baselines d1,d2

Commands

The pipeline runs end to end as /hunt-agent, or one stage at a time:

Install

git clone https://github.com/elementalsouls/Claude-AgentHunter && cd Claude-AgentHunter
./scripts/install.sh --all          # detects Claude Code, OpenCode, Hermes, Codex, AntiGravity
./scripts/install.sh --claude       # or one harness

Or as a Claude Code plugin — namespaced, no copy, updates on version bump:

/plugin marketplace add elementalsouls/Claude-AgentHunter
/plugin install claude-agenthunter@elementalsouls

Runs on multiple agent harnesses

The skills are plain Agent Skills — the same SKILL.md format that Claude Code · OpenCode · OpenAI Codex CLI · Hermes Agent · Google AntiGravity all load. One command installs them everywhere:

# macOS / Linux
./scripts/install.sh --all
# Windows (PowerShell)
pwsh ./scripts/install.ps1 -All

--all detects the installed harnesses and copies the skills to each path. The full knowledge layer (24 skills) ports to all five; the slash commands and the engine/ + lab/ tooling stay Claude-Code / standalone by design.

Proof it works — lab/ and field/

• lab/ — 24 deterministic exploit gates (python3 lab/run_lab.py), no model, no API key. Each encodes a vulnerability class and its control; [CONFIRMED] means re-runnable, not “the model said so”.
• field/ — evidence from live/benchmark targets: AgentDojo (4 suites, 949 runs, FN 0), DVMCP (10/10), DVLA (ReAct forgery → SQL chain), InjecAgent (arm D 7/7 indirect), a real MCP target, ARKX.

Documentation

• USAGE.md — the workflow, the engine, the lab, field evidence, end to end.
• INSTALL.md — plugin + copy install across five harnesses.
• docs/skills.md — the 23 hunt-agent skills catalog (+ the ai-agent-methodology orchestrator = 24 total).
• docs/THREAT-MODEL.md · docs/COVERAGE-MATRIX.md · docs/RESEARCH-2026.md · docs/DEFENSES-AND-DETECTION.md · docs/REFERENCES.md
• CONTRIBUTING.md · CHANGELOG.md

Authorized use only

For testing agents you own or are explicitly authorized to assess. The probes send live payloads and the lab targets are intentionally vulnerable. See SECURITY.md.