config-safety-reviewer

config-safety-reviewer is an agent for Claude Code from alirezarezvani/claude-code-tresor. It costs 37 tokens per session (1,671 once invoked), scanned A, original, MIT.

A reviewer focused on the safety of production configuration changes, especially values such as timeouts, connection limits, pool sizes, and fixed numeric settings. Production means the live environment used by real users or services.

In plain words
What is it for?
Use it to review changes to service configuration, connection pools, limits, timeouts, and other operational settings, including related security and test-coverage checks.
Why use it?
It helps identify configuration choices that could cause outages, resource exhaustion, security problems, or unreliable behavior. It can also use lightweight checks for common security issues and missing tests before the deeper review.

Agent for Claude Code

Written for Claude Code: a Claude Code subagent (agents/*.md). Also seen: model in frontmatter.

Good fit Use it to review changes to service configuration, connection pools, limits, timeouts, and other operational settings, including related security and test-coverage checks.

Compare 6 agents from other repositories ↓
Install with agentmods
npx agentmods add agents/alirezarezvani/claude-code-tresor/config-safety-reviewer
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo
git clone --depth 1 https://github.com/alirezarezvani/claude-code-tresor

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for config-safety-reviewer

README.md
[![agentmods](https://agentmods.dev/badge/agents/alirezarezvani/claude-code-tresor/config-safety-reviewer/github.svg)](https://agentmods.dev/agents/alirezarezvani/claude-code-tresor/config-safety-reviewer)
Your own site
<a href="https://agentmods.dev/agents/alirezarezvani/claude-code-tresor/config-safety-reviewer"><img src="https://agentmods.dev/badge/agents/alirezarezvani/claude-code-tresor/config-safety-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for config-safety-reviewer

Your own site · 80×15
<a href="https://agentmods.dev/agents/alirezarezvani/claude-code-tresor/config-safety-reviewer"><img src="https://agentmods.dev/badge/agents/alirezarezvani/claude-code-tresor/config-safety-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 37 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,671 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00037 $0.01671
Opus 5 $0.00018 $0.00835
Sonnet 5 $0.00007 $0.00334
Haiku 4.5 $0.00004 $0.00167

Measured 10d ago against content hash b1c80f3c11a0, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade A, and why

config-safety-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

agents/config-safety-reviewer.md · 219 lines

How it starts

The opening of the file, as written. The whole thing — 219 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You are an expert code reviewer with deep knowledge of software engineering best practices, security vulnerabilities, performance optimization, and modern development patterns.

Your Role

As a senior code reviewer, you ensure high standards of code quality and security across all development work. You provide comprehensive, actionable feedback that helps developers write better, more secure, and more maintainable code.

Working with Skills

You have access to lightweight skills for quick validations BEFORE your deep analysis. Skills are complementary helpers, not replacements for your expert review.

Available Skills

1. security-auditor skill

  • Quick OWASP Top 10 vulnerability scan
  • Secret/API key detection
  • Basic security pattern checks
  • Invoke when: Reviewing authentication, APIs, or user input handling

2. test-generator skill

  • Detects untested code
  • Suggests basic test structure
  • Identifies missing test cases
  • Invoke when: Code changes lack tests or test coverage is unclear

When to Invoke Skills

DO invoke skills at the START of your review for:

  • ✅ Quick security validation before deep security analysis
  • ✅ Test coverage check before suggesting comprehensive test strategy
  • ✅ Initial scan to identify obvious issues

DON'T invoke skills for:

  • ❌ Architectural analysis (your expertise)
  • ❌ Performance optimization (your deep analysis)
  • ❌ Complex refactoring recommendations (your comprehensive approach)

How to Invoke Skills

Use the Skill tool with skill name only (no arguments):

# At the START of your review:
[Invoke security-auditor skill for quick scan]
[Invoke test-generator skill to check coverage]

# Then proceed with YOUR deep expert analysis

Workflow Pattern

1. QUICK CHECKS (Skills)
   └─> Invoke security-auditor skill
   └─> Invoke test-generator skill (if relevant)
   └─> Review skill outputs

2. DEEP ANALYSIS (You - Expert)
   └─> Build on skill findings with context
   └─> Identify complex issues skills missed
   └─> Provide architectural recommendations
   └─> Suggest comprehensive solutions

3. REPORT
   └─> Acknowledge what skills found: "Security scan identified..."
   └─> Add your expert insights: "Additionally, the architecture shows..."
   └─> Provide actionable recommendations

Read the full file on GitHub · 219 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 10d ago First seen · 219 lines · 37 tokens per session scan A b1c80f3c11a0

Subscribe to this mod's changes

config-safety-reviewer is an agent published in the GitHub repository alirezarezvani/claude-code-tresor (771 stars, last pushed 2mo ago), licensed MIT. It adds 37 tokens to every session and 1,671 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other agents, from other repositories

alchemist

Creative technologist who sees the browser as an unexplored physics engine. Consult when building UI that needs to feel alive - scroll-driven reveals, morphing transitions, spatial animation systems, anything where the interaction itself IS the product. Thinks in weight, tension, and breath before thinking in code.…

drobins25/craft · 355 tokens

style-analyzer

Use this agent after UI implementation or when the user requests design consistency audits. Ensures visual consistency, catches design drift from locked tokens, identifies technical debt in UI code, and guards the integrity of the design language. Context: Multiple UI components were built during the cycle. user…

drobins25/craft · 203 tokens

tester

Use this agent after chunk implementation to create comprehensive test suites, or when the user requests test generation. Creates unit, integration, and edge case tests to ensure code works correctly and provide shipping confidence. Context: All chunks are implemented, orchestrator invokes testing phase. user: "All…

drobins25/craft · 200 tokens

product-anthropologist

The human-truth layer for product decisions. Consult when diagnosing why users aren't adopting, when deciding whether to iterate or kill, when interpreting user feedback or metrics, when designing research for AI-powered products, when a founder's conviction is outrunning evidence, or any moment where the question is…

drobins25/craft · 116 tokens

rn-code-architect

Designs implementation blueprints for React Native features by analyzing existing codebase patterns, then providing specific files to create/modify, component designs, testID placement, store slice design, and build sequences. Triggers: "design the architecture", "plan the implementation", "create a blueprint", "what…

Lykhoyda/rn-dev-agent · 238 tokens

pi-teammate-en

PI Wisdom-in-Action Teammate v20 — Agent Team member with PI methodology preloaded. Self-driven excellence, handle L1 independently, report L2+ to Leader. Use when Leader dispatches subtasks.

share-skills/pi · 50 tokens