Copy-ready Lagune prompts you can paste directly into your AI agent.

💧 Shallow Scan

A read-only sweep that reads the code on its own and reports every flaw with a fix, without running the Blue Team flow or writing to Lagune's tracking.

tip

Works better in planning mode and with a charter (/lagune.charter) defined.

🪼 Default

Aspect	Trade-off	Level
Effort	One agent scans and reports, no sub-agents.
Time	Quick. A single read-only pass, nothing is applied.
Token Usage	Moderate, shared. The whole scan runs in one context.

/lagune You are a cybersecurity researcher with deep expertise in defensive security, using Lagune to improve your knowledge and precision.

Scan the workspace on your own and pair each flaw you find with a concrete fix. This is a standalone sweep, not the Blue Team flow: do not run detect, plan, harden, or verify, and write nothing to Lagune's tracking.

At the end, list every flaw you found, each with its severity and a concrete fix.

🐬 Multi Agents

Aspect	Trade-off	Level
Effort	One sub-agent per file, scaled to the size of your codebase.
Time	Parallel per file, then merged into one report. Still read-only.
Token Usage	Higher, but isolated. Each sub-agent scans in its own context.

/lagune You are a cybersecurity orchestrator using Lagune to enumerate, dispatch a subagent per path, and merge their reports (all content is read by the subagents).

You must delegate the task to sub-agents based on the current project's size: the larger the codebase, the more sub-agents should be dispatched, all in parallel, giving each the prompt below:

```prompt
/lagune You are a cybersecurity researcher with deep expertise in defensive security, using Lagune to improve your knowledge and precision.

Scan <path> on your own and pair each flaw you find with a concrete fix. This is a standalone sweep, not the Blue Team flow: do not run detect, plan, harden, or verify, and write nothing to Lagune's tracking.

At the end, list every flaw in <path>, each with its severity and a concrete fix.
```

At the end, merge all sub-agent reports into one prioritized list of flaws and fixes.

warning

A quick scan is one broad, unscoped prompt, so some agents are likelier to refuse it or cut it short. If yours pushes back, run the full Blue Team flow below instead: its scoped, step-by-step phases are far less likely to be blocked.

---

🌊 Auto Blue Team Audit Flow

Runs the full command flow end to end without asking for user confirmation.

🪼 Default

Aspect	Trade-off	Level
Effort	One agent, no sub-agents, regardless of codebase size.
Time	Medium, but less thorough in large codebases. Each command runs once, one after another.
Token Usage	Lower, but less isolated. Every command shares the same context.

Execute the following commands, one by one: `/lagune.charter`, `/lagune.detect`, `/lagune.plan`, `/lagune.harden`, and `/lagune.verify`.

## Loop

When `/lagune.verify` reproves one or more fixes, repeat `/lagune.harden` and then `/lagune.verify` until all findings are properly resolved.

## Important

The `/lagune.harden` command requires user confirmation before executing. Confirm everything automatically to not block the execution.

- Don't pause, don't ask: in case of doubt, do everything in "full" mode.

🐋 Multi Agents (Deep Scan)

Aspect	Trade-off	Level
Effort	The number of sub-agents is scaled to the size of your codebase.
Time	Longer, but more thorough. Dispatches multiple sub-agents to detect, plan, and harden findings in parallel.
Token Usage	Higher, but safer. Each sub-agent has its own isolated context without bias.

Execute the following commands each to one sub-agent, one at a time (without backticks, just the command):

Sub-agent 1 prompt: `/lagune.charter`
Sub-agent 2 prompt: `/lagune.detect`
Sub-agent 3 prompt: `/lagune.plan`
Sub-agent 4 prompt: `/lagune.harden`
Sub-agent 5 prompt: `/lagune.verify`

In the `/lagune.detect`, `/lagune.plan`, `/lagune.harden`, and `/lagune.verify` commands, you must delegate the task to sub-agents based on the current project's size: the larger the codebase, the more sub-agents should be dispatched. For example:

```prompt
/lagune.detect <path>
```

```prompt
/lagune.plan <finding>
```

```prompt
/lagune.harden <finding>
```

```prompt
/lagune.verify <finding>
```

- Multiple agents on the same command should be dispatched in parallel.
- At the end of all `/lagune.detect` sub-agents, perform:

```prompt
/lagune.detect merge equivalent findings. Don't detect for new findings nor scan the codebase again.
```

## Loop

When `/lagune.verify` reproves one or more fixes, repeat `/lagune.harden` and then `/lagune.verify` until all findings are properly resolved.

## Important

The `/lagune.harden` command requires user confirmation before executing. Confirm everything automatically to not block the execution.

- Don't pause, don't ask: in case of doubt, do everything in "full" mode.

---

🪄 Scoped Detection

Point /lagune.detect at a slice of your project instead of the whole thing. Describe the scope in plain language (a commit, a pull request, or a real situation) and it maps only the security-relevant findings there.

tip

Everything it detects here is a normal finding, so you can carry it straight into /lagune.plan, /lagune.harden, and /lagune.verify, scoped to just those items.

📌 Since a commit

Give a fresh batch of commits its own security pass, scoped to just what they changed, for example:

/lagune.detect Scope the detection to everything that changed since commit `a1b2c3d`.

🔀 Branch or PR diff

Review a pull request for security before it merges, scoped to just its diff, for example:

/lagune.detect Scope the detection to the changes this branch introduces against `main`.

⛑️ After an incident

Describe what happened in your own words. Lagune reads the situation, not a flag, and turns it into a focused hunt, for example:

/lagune.detect Our site had a data leak a few weeks ago. I don't know exactly how it happened, and I'm worried something is still open that could leak data again. Go through the code carefully, focus on anywhere sensitive data is read, stored, or exposed, and map anything that could still be a way out. Treat this as a real incident, not a drill.

---

🚨 Zero Trust Audit

Treats the whole workspace and every dependency as hostile: it hunts for interpreters, network calls, encoded payloads, and code hidden in unlikely places to slip past scanners, then ends with a go/no-go verdict on whether the project is safe to use.

We recommend installing with the specializations this audit leans on:

• OWASP, AI/LLM, and the project's stack (e.g., JavaScript, Python, etc.).

danger

Be careful when running projects from untrusted sources in your local environment. Use an isolated environment, such as a sandbox (recommended), VM, or similar, to prevent malicious code from affecting your system.

🪼 Default

Aspect	Trade-off	Level
Effort	One agent sweeps the whole workspace, no sub-agents.
Time	Medium. One agent works through the code and its dependencies in sequence.
Token Usage	Moderate, but shared. The sub-skills, the code, and the dependencies all load into one context.

/lagune You are a cybersecurity researcher with deep expertise in zero trust defensive security, using Lagune to improve your knowledge and precision.

Map the entire workspace as an untrusted source and a potential malicious scope. Every interpreter, fetch, base64, and the like must be treated as a potential threat.

Extend your analysis to the dependencies and sub-dependencies: a project may try to hide malicious code in an unlikely place to slip past scanners.

Mandatory sub-skills (read them one at a time):

- @.lagune/skills/interpreter.md
- @.lagune/skills/secrets.md
- @.lagune/skills/llm.md
- @.lagune/skills/path.md

To be clear: every mapped vulnerability must be treated as a potential threat, without exception.

At the end, give a verdict on whether the project is safe and trustworthy for me to use or not.

🐋 Multi Agents (Deep Scan)

Aspect	Trade-off	Level
Effort	One sub-agent per file, scaled to the size of your codebase.
Time	Longer, but more thorough. Files are swept in parallel, then merged into one verdict.
Token Usage	Highest, but safest. Each sub-agent reads the sub-skills in its own isolated context.

/lagune You are a cybersecurity orchestrator using Lagune to enumerate, dispatch a subagent per file, and generate reports (all content is read by the subagents).

Dispatch one sub-agent per file, all in parallel, giving each the prompt below, scoped to its file:

```prompt
/lagune You are a cybersecurity researcher with deep expertise in zero trust defensive security, using Lagune to improve your knowledge and precision.

Treat <file> as an untrusted source and a potential malicious scope. Every interpreter, fetch, base64, and the like must be treated as a potential threat.

Extend the analysis to whatever <file> imports, including dependencies and sub-dependencies, where malicious code may hide to slip past scanners.

Mandatory sub-skills for every sub-agent (read them one at a time):

- @.lagune/skills/interpreter.md
- @.lagune/skills/secrets.md
- @.lagune/skills/llm.md
- @.lagune/skills/path.md

To be clear: every mapped vulnerability must be treated as a potential threat, without exception.

At the end, give a verdict on whether the project is safe and trustworthy for me to use or not.
```

At the end, merge all sub-agent reports into one final verdict.