FlipperAgent

Run sustained security assessment campaigns against targets using the Ralph Wiggum autonomous loop pattern. Use when asked to start, continue, or manage a pentest campaign.

Control a Flipper Zero and scan BLE targets for authorized security research. Use when asked to interact with Flipper hardware, scan BLE devices, or control RF/IR/NFC/RFID.

Start an autonomous pentest loop. Spawns fresh-context subagents for each phase. Use: /ralph-loop

BLE GATT exploitation methodology — scanning, enumeration, characteristic analysis, payload crafting, and write attacks against Bluetooth Low Energy devices

Run a sustained security assessment campaign — a real pentest, not a simulation

Credential testing methodology — default credential checking, password spraying, credential reuse, and OSINT for leaked credentials

Test default credentials against network services — SSH, HTTP, FTP, Telnet, MQTT, MySQL, PostgreSQL, Redis, MongoDB

Control ESP32 Marauder via serial — WiFi scanning, deauth, beacon spam, probe flood, raw commands

Network scanning via nmap — host discovery, port scanning, service/OS detection, vulnerability scanning

Craft, send, and analyze network packets via Scapy — ARP scan, ping, traceroute, DNS, sniff, pcap analysis

Professional penetration testing report writing — executive summary, findings format, CVSS severity, risk matrix, attack chains, and remediation roadmaps

Reverse-engineer binary protocols — CRC detection with crcbeagle, CRC calculation, packet structure analysis

Start an autonomous pentest loop. Spawns fresh-context subagents for each phase. Use: /ralph-loop

Continuously improve FlipperAgent's skills, docs, and agent definitions based on successes, failures, and learnings from campaigns and tool usage

Search Shodan for internet-connected devices, lookup IPs, find exploits — via Python shodan library

RF signal analysis methodology — Sub-GHz capture, protocol identification, timing analysis, rolling vs static code detection, and IR protocol decoding

WiFi reconnaissance and attack methodology via ESP32 Marauder — scanning, deauth, evil twin, captive portal, and KARMA attacks

Wireshark/tshark packet capture and analysis via WireMCP — BLE traffic capture on macOS, PCAP analysis, integration with FlipperAgent campaign workflow