Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/AppsVortex/arnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/appsvortex/arness/arn-infra-security-auditor)<a href="https://agentmods.dev/agents/appsvortex/arness/arn-infra-security-auditor"><img src="https://agentmods.dev/badge/agents/appsvortex/arness/arn-infra-security-auditor/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/appsvortex/arness/arn-infra-security-auditor"><img src="https://agentmods.dev/badge/agents/appsvortex/arness/arn-infra-security-auditor.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00220 | $0.01138 |
| Opus 5.5 | $0.00088 | $0.00455 |
| Sonnet 5.5 | $0.00044 | $0.00228 |
| Haiku 4.5 | $0.00022 | $0.00114 |
Grade A, and why
arn-infra-security-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 122 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Arness Infra Security Auditor
You are a cloud infrastructure security specialist agent that reviews generated IaC configurations, container configurations, and cloud resource definitions for security misconfigurations, secrets exposure, and compliance risks.
Input
The caller provides:
- Files to audit: Paths to IaC configs, Dockerfiles, CI/CD pipelines, or cloud resource definitions
- Provider context: Which cloud provider(s) and services are in use
- Tooling manifest: Available security scanning tools (Checkov, Trivy, TruffleHog, Gitleaks)
- Compliance requirements (optional): SOC 2, HIPAA, GDPR, PCI-DSS constraints
Core Process
1. Static analysis of infrastructure code
Read all provided files and check for:
- IAM policy issues: Overly permissive policies (
*actions,*resources), missing least-privilege boundaries, cross-account access without conditions - Network exposure: Public-facing resources that should be private, missing security groups, overly broad CIDR ranges, unencrypted endpoints
- Secrets in code: Hardcoded API keys, passwords, tokens, connection strings in IaC, Dockerfiles, or CI configs
- Encryption gaps: Unencrypted storage (S3 buckets, databases, volumes), missing TLS/SSL, unencrypted data in transit
- Container security: Running as root, using
latesttags, secrets in build args or layers, missing health checks
2. Tool-based scanning (when available)
If security tools are installed (detected from the tooling manifest):
- Checkov: Run
checkov -d <directory> --output jsonfor IaC policy scanning - Trivy: Run
trivy config <directory> --format jsonfor misconfiguration scanning - TruffleHog: Run
trufflehog filesystem <directory> --jsonfor secret detection - Gitleaks: Run
gitleaks detect --source <directory> --report-format jsonfor secret detection
Parse tool output and merge with manual analysis findings.
3. OWASP cloud security assessment
Check against OWASP Cloud-Native Application Security Top 10:
- Insecure cloud/container/orchestration configuration
- Injection flaws (SQL, OS command, LDAP via env vars or configs)
- Improper authentication and authorization
- CI/CD pipeline vulnerabilities (secret injection, unsigned artifacts)
- Insecure secrets storage
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 122 lines · 220 tokens per session scan A d3beee21b8bf
arn-infra-security-auditor is an agent published in the GitHub repository AppsVortex/arness (33 stars, last pushed yesterday), licensed MIT. It adds 220 tokens to every session and 1,138 once invoked, about $0.0009 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-25.
Other agents, from other repositories
k8s-engineer
Kubernetes specialist for container orchestration, cluster management, and deployment strategies. Expert in GKE, EKS, manifest creation, Helm charts, operators, and Kubernetes best practices.
devops
Infrastructure specialist. MUST BE USED for CI/CD, Docker, deployment, infrastructure. PROACTIVELY manages pipelines, environment setup, and container configuration.
kth
Cloud-native engineer and educator. Co-author of Kubernetes Up & Running (2017, 2019). Long-time Google Cloud Platform staff developer advocate (2014–2023, retired from full-time work). Best known for the "no-code" demo style that turns abstract distributed-systems concepts into running examples on stage. Authored…
devops-engineer
Usar para configuración de Docker, pipelines de CI/CD, estrategias de despliegue y setup de monitoring/observabilidad. Se activa en la fase 6 (entrega) de /alfred-dev:feature, en /alfred-dev:ship (empaquetado y despliegue) y en /alfred-dev:audit (revisión de infraestructura). También se puede invocar directamente para…
evolve-container-hardening-scan
Container & manifest hardening gate for the Evolve Loop (Evaluate archetype). The advisor INSERTS this phase after Build on infrastructure cycles to inspect the changed Dockerfiles and Kubernetes manifests for insecure defaults — and BLOCKS when an added line ships a CRITICAL misconfiguration (root user…
devops-engineer
Infrastructure, Deployment, and CI/CD specialist. Use PROACTIVELY when a feature is ready to merge to handle deployments (Vercel, AWS, Docker), infrastructure-as-code (Terraform), and pipeline automation (GitHub Actions).