Security Autopilots

agents-fleet ships a full-spectrum application security capability built from bundled workflows, a dedicated crew, and specialized roles + skills. This guide covers the security-crew and the three security autopilots.

Prerequisite reading: Security Model for the permission system, agent-type profiles, and override precedence.

---

Security Crew

The security-crew (src/skills/bundled/crews/security-crew.crew.md) is a hub-topology crew driven by the security-autopilot workflow. It defines 13 specialized security roles:

Role	Purpose
sec-recon-mapper	Maps the codebase's attack surface (entry points, trust boundaries, sinks)
sec-vuln-hunter	Senior appsec auditor that hunts one vulnerability class at a time
sec-triage-analyst	Dedupes and prioritizes findings, writes a triage summary
sec-exploit-poc-engineer	Writes local, sandboxed failing tests that prove findings
sec-fixer	Implements minimal, correct security fixes
sec-verifier	Re-runs PoCs and suites to confirm fixes resolve findings
sec-reporter	Writes the final security report with per-finding detail
sec-vm-validator	Owns Azure isolated-VM lifecycle: provision, detonate, capture evidence, teardown
sec-msrc-reporter	Produces the MSRC coordinated-disclosure report
sec-binary-analyst	Static reverse engineer for binary analysis
sec-fuzzing-engineer	Builds and runs coverage-guided fuzz harnesses in isolated VMs
sec-crash-triage-analyst	Triages fuzzing crashers and assesses exploitability

Activate the crew manually:

> /crew security-crew

Or let the autopilot workflows activate it automatically.

---

The Three Autopilots

/security-autopilot — defensive application security audit

/security-autopilot [target] [--ship] [--max-stage-visits <N>] [--legacy-workflow-dispatch]

Aliases: sec-audit, security-audit

A multi-stage, coordinator-per-stage workflow for defensive application security. Runs static analysis only — sandboxed PoCs against your own code, never touches live or third-party systems.

Stages:

1. recon — sec-recon-mapper maps the attack surface → recon.md
2. scan — fans out one sec-vuln-hunter per vulnerability class (injection, authz, secrets, supply-chain, crypto, deserialization, cicd, llm-agent) in parallel (max 4 concurrent) → findings.md
3. triage — sec-triage-analyst dedupes and prioritizes → triage.md
4. poc — sec-exploit-poc-engineer writes local PoCs for top findings → poc-results.md
5. fix — sec-fixer implements minimal fixes → fix-results.md
6. verify — sec-verifier re-runs PoCs + suites → verify-results.md
7. report — sec-reporter writes final report → report.md + SUMMARY.md
8. open-pr (when --ship) — commits fixes, pushes branch, opens PR

Flags:

Flag	Default	Description
target	"" (whole codebase)	What to audit — path, subsystem, or scope note
--ship	false	Open a PR with fixes (default: report only)
--max-stage-visits	20	Cap stage re-entries
--legacy-workflow-dispatch	off	Use the legacy LLM-driven path instead of sub-coord bridge

Phase timeout: 30 minutes (phaseTimeoutMs: 1800000).

Example:

> /security-autopilot src/providers
> /security-autopilot --ship

---

/security-binary-autopilot — binary analysis + fuzzing

/security-binary-autopilot <target> --subscription <isolated-sub-id> [--hours <n>] [--legacy-workflow-dispatch]

Aliases: binary-autopilot, sec-binary

Binary-analysis autopilot for authorized-scope reverse engineering and coverage-guided fuzzing. Uses isolated, disposable Azure VMs for fuzz execution — never production infrastructure.

Stages:

1. target-recon — sec-recon-mapper identifies the binary, version, attack surface → target-recon.md
2. static-re — sec-binary-analyst performs static reverse engineering + patch-diff → static-re.md + ranked fuzz-targets.txt
3. fuzz — fans out one sec-fuzzing-engineer per fuzz target (max 2 concurrent) in isolated Azure VMs → fuzz-results.md
4. triage — sec-crash-triage-analyst triages crashers, assesses exploitability → crash-triage.md
5. poc — sec-exploit-poc-engineer writes minimal impact-proving PoCs (never weaponized) → poc-results.md
6. msrc-report — sec-msrc-reporter produces MSRC-format report → msrc-report.md
7. disclosure-package — assembles final disclosure package

Flags:

Flag	Required	Default	Description
target	yes	—	Binary/component to analyze (authorized scope only)
--subscription	no	""	Isolated Azure lab/sandbox subscription id for fuzzing VMs
--hours	no	2	Fuzz duration in hours per target

Phase timeout: 60 minutes (phaseTimeoutMs: 3600000).

Safety guardrails:

• Fuzz stage refuses to provision without a confirmed isolated subscription
• VMs are provisioned with deny-all NSG, no public IP, isolated vnet/subnet
• Each VM has a TTL tag for guaranteed teardown
• Crasher PoCs prove impact only — never weaponized exploits

Example:

> /security-binary-autopilot "C:\target\binary.dll" --subscription 12345678-abcd-1234-efgh-000000000000 --hours 4

---

/security-disclosure-autopilot — coordinated disclosure

/security-disclosure-autopilot [target] --subscription <isolated-sub-id> [--scope diff|full] [--fix] [--no-teardown] [--legacy-workflow-dispatch]

Aliases: sec-disclose, msrc-autopilot

End-to-end coordinated-disclosure autopilot: recon → scan → triage → local PoC → isolated Azure VM detonation + evidence capture → MSRC-format report → optional fix → disclosure package. Uses MSRC coordinated disclosure only — all evidence is hashed and timestamped for integrity.

Stages:

1. recon — maps authorized attack surface → recon.md
2. scan — per-class vulnerability hunting (8 classes, parallel) → findings.md
3. triage — deduplication and prioritization → triage.md
4. poc — local sandboxed PoCs → poc-results.md
5. vm-validate — sec-vm-validator provisions isolated Azure VM, detonates PoC, captures evidence (logs, screenshots, crash dumps) with hash + timestamp → vm-evidence.md
6. msrc-report — sec-msrc-reporter produces MSRC report from validated findings + VM evidence → msrc-report.md
7. fix (when --fix) — sec-fixer lands minimal remediations
8. verify (when --fix) — sec-verifier confirms fixes
9. disclosure-package — assembles complete disclosure package

Flags:

Flag	Default	Description
target	"" (whole codebase)	What to assess (authorized scope only)
--subscription	""	Isolated Azure subscription id for VM PoC validation
--scope	full	full = whole target; diff = changed surface only
--fix	false	Land remediations (default: disclosure-only)
--no-teardown	off	Keep the isolated Azure RG for follow-up forensics (flagged for manual deletion)

Phase timeout: 45 minutes (phaseTimeoutMs: 2700000).

Example:

> /security-disclosure-autopilot src/auth --subscription 12345678-abcd-1234-efgh-000000000000
> /security-disclosure-autopilot --scope diff --fix

---

Related Security Skills

The security autopilots compose from 17 bundled atomic skills (all prefixed sec-*):

Skill	What it covers
sec-authz-audit	Broken access control, IDOR, privilege escalation
sec-injection-audit	SQL, NoSQL, OS command, SSTI, path traversal, SSRF, XXE
sec-secrets-audit	API keys, tokens, credentials in code and git history
sec-supplychain-audit	Vulnerable packages, lockfile integrity, typosquatting
sec-crypto-audit	Weak algorithms, hardcoded keys, insecure randomness
sec-deserialization-audit	Insecure deserialization, prototype pollution
sec-cicd-audit	CI/CD pipeline security, GitHub Actions
sec-llm-agent-audit	Prompt injection, tool injection, RAG poisoning
sec-recon-attack-surface	Attack surface mapping methodology
sec-finding-report	Structured finding documentation (CWE, OWASP, MITRE)
sec-poc-authoring	Safe proof-of-concept authoring
sec-binary-static-analysis	Static RE of PE/ELF/Mach-O binaries
sec-crash-triage-exploitability	Crash triage and exploitability assessment
sec-fuzzing	Coverage-guided fuzzing harness building
sec-azure-vm-provisioning	Isolated Azure VM lifecycle
sec-vm-detonation	PoC detonation in isolated VMs
sec-msrc-report	MSRC coordinated-disclosure report format

See also: Bundled Skills reference, Security Model

---

Vendored Cybersecurity Skills Library

For broader offensive/defensive security research, agents-fleet vendors the 817-skill Anthropic Cybersecurity Skills library (Apache-2.0, 29 domains). This library is OFF by default and must be explicitly opted in — see the Cybersec Library reference for details.