Cyberstrike Agent

The cyberstrike agent is the default primary agent. It provides AI-powered offensive security testing with full tool access and can delegate to specialized subagents for domain-specific tasks.

Overview

When you run cyberstrike without specifying an agent, the cyberstrike agent starts automatically. It is a general-purpose offensive security agent designed to handle a wide range of tasks — from reconnaissance and vulnerability assessment to exploitation and reporting.

Agent Configuration

Launch the Agent

The cyberstrike agent is the default — it starts automatically when you launch:

cyberstrike

Switch agents anytime in the TUI with /agents or <leader>a.

Capabilities

The cyberstrike agent has access to all available tools and is not restricted to a specific security domain. It can:

• Perform web application security testing
• Conduct cloud infrastructure audits
• Execute network penetration testing
• Run automated scans with tools like Nuclei, Nmap, and SQLMap
• Browse and interact with web applications
• Read, write, and analyze files
• Ask clarifying questions when the task is ambiguous

Delegating to Specialized Agents

When a task requires deep domain expertise, the cyberstrike agent delegates to specialized subagents:

Delegation happens automatically based on the task. The web security pipeline (WSTG agents) is triggered when HTTP traffic is captured via HackBrowser or the Chrome Extension.

Permission Model

The cyberstrike agent uses the broadest permission set:

• All tools are allowed by default
• Can ask clarifying questions (question: allow)
• .env files require confirmation before reading
• External directory access outside the project requires confirmation
• User-configured deny rules in cyberstrike.json are always respected

Example Session

You: Test the web application at https://app.example.com for common vulnerabilities

Agent: I'll start with reconnaissance and then launch HackBrowser to crawl the app.

[Launching /hackbrowser against https://app.example.com...]
[Crawling 23 pages, capturing HTTP traffic...]
[Dispatching wstg-config-deploy for server misconfiguration checks...]
[Dispatching wstg-input-validation for injection testing...]

Found 3 medium-severity findings:
- Missing Content-Security-Policy header
- Server version disclosure in headers
- X-Frame-Options not set

[wstg-authentication testing login endpoint...]
⚠ FINDING: JWT Algorithm Confusion
Location: Authorization header
Severity: Critical (CVSS 9.8)

Configuration

Set as Default Agent

The cyberstrike agent is the default and requires no configuration. To explicitly set it:

{
  "default_agent": "cyberstrike"
}

Custom Instructions

instructions is a list of files (or globs) whose contents are appended to the system prompt — put your project context in a file and reference it:

{
  "instructions": ["AGENTS.md", "docs/security-context.md"]
}

Related Documentation

• WSTG Agent — Web security testing pipeline orchestrator
• Escalation Hunter — Cross-cutting correlation agent
• Triage Agent — Finding verification
• Custom Agents — Create your own agents