ALL agents dispatched by this command MUST use in the subagent dispatch tool call.
Full security assessment on: $ARGUMENTS
Phase 0: Brain Briefing
uv run python3 ../../tools/brain.py init (if first run)uv run python3 ../../tools/brain.py brief $ARGUMENTSuv run python3 ../../tools/scope_check.py $ARGUMENTS
Phase 1: Recon (skip already-discovered assets)
Launch recon agent with brain context. Focus on discovering NEW subdomains and services beyond what's already known.
Phase 2: Scanning (skip exhausted areas)
Launch IN PARALLEL, each with brain context about what's been scanned before:
vuln-scanner — skip known false positives, focus new hostsconfig-auditor — check if previously noted misconfigs are fixedjs-analyzer — focus on new/changed JS files
Record all results to the brain after each agent returns.
Phase 3: Targeted Testing (brain-guided)
Based on Phase 2 + brain knowledge, selectively launch ONLY agents targeting UNTESTED or ACTIVE vectors:
xss-hunter ONLY on endpoints not marked exhaustedapi-audit ONLY on newly discovered or untested endpoints auth-tester ONLY if new auth flows found
Record all results to the brain.
Phase 4: Reporting
uv run python3 ../../tools/dedup_findings.py --scan-dir scans/ --db findings.json --statsuv run python3 ../../tools/brain.py status- Launch
poc-builder for each confirmed finding
- Launch
report-writer with full brain context
uv run python3 ../../tools/brain.py log "Full scan completed on $ARGUMENTS"
Top-Tier Fullscan Standard
A full scan must leave a defensible coverage ledger.
- Start with the crown jewels: auth, tenant data, billing, admin, integrations, uploads, webhooks, exports, AI/tool surfaces, and source/repo exposure.
- For each phase, record both positives and negatives. "Scanned" is invalid unless it names tools, targets, timestamps, and skipped areas.
- Do not let scanner output dominate. Use scanners to find leads, then spend human-grade effort on state changes, authorization boundaries, and parser differentials.
- Before reporting, run
/correlate or /chain on all confirmed and partial findings. Single low bugs should not escape the scan if a plausible chain remains.
- Final output must contain: confirmed findings, killed false positives, exhausted high-value paths, untested residual risk, and the next best command.
1---2name: fullscan-23description: Full security assessment with brain coordination. Multi-phase, skips known-exhausted areas, builds on prior knowledge.4---56ALL agents dispatched by this command MUST use in the subagent dispatch tool call.78Full security assessment on: $ARGUMENTS910## Phase 0: Brain Briefing111. `uv run python3 ../../tools/brain.py init` (if first run)122. `uv run python3 ../../tools/brain.py brief $ARGUMENTS`133. `uv run python3 ../../tools/scope_check.py $ARGUMENTS`1415## Phase 1: Recon (skip already-discovered assets)16Launch `recon` agent with brain context. Focus on discovering NEW subdomains and services beyond what's already known.1718## Phase 2: Scanning (skip exhausted areas)19Launch IN PARALLEL, each with brain context about what's been scanned before:20- `vuln-scanner` — skip known false positives, focus new hosts21- `config-auditor` — check if previously noted misconfigs are fixed22- `js-analyzer` — focus on new/changed JS files2324Record all results to the brain after each agent returns.2526## Phase 3: Targeted Testing (brain-guided)27Based on Phase 2 + brain knowledge, selectively launch ONLY agents targeting UNTESTED or ACTIVE vectors:28- `xss-hunter` ONLY on endpoints not marked exhausted29- `api-audit` ONLY on newly discovered or untested endpoints 30- `auth-tester` ONLY if new auth flows found3132Record all results to the brain.3334## Phase 4: Reporting351. `uv run python3 ../../tools/dedup_findings.py --scan-dir scans/ --db findings.json --stats`362. `uv run python3 ../../tools/brain.py status`373. Launch `poc-builder` for each confirmed finding384. Launch `report-writer` with full brain context395. `uv run python3 ../../tools/brain.py log "Full scan completed on $ARGUMENTS"`4041## Top-Tier Fullscan Standard4243A full scan must leave a defensible coverage ledger.44451. Start with the crown jewels: auth, tenant data, billing, admin, integrations, uploads, webhooks, exports, AI/tool surfaces, and source/repo exposure.462. For each phase, record both positives and negatives. "Scanned" is invalid unless it names tools, targets, timestamps, and skipped areas.473. Do not let scanner output dominate. Use scanners to find leads, then spend human-grade effort on state changes, authorization boundaries, and parser differentials.484. Before reporting, run `/correlate` or `/chain` on all confirmed and partial findings. Single low bugs should not escape the scan if a plausible chain remains.495. Final output must contain: confirmed findings, killed false positives, exhausted high-value paths, untested residual risk, and the next best command.
h-mmer