Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/armanzeroeight/fastagent-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/armanzeroeight/fastagent-plugins/security-architect)<a href="https://agentmods.dev/agents/armanzeroeight/fastagent-plugins/security-architect"><img src="https://agentmods.dev/badge/agents/armanzeroeight/fastagent-plugins/security-architect/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/armanzeroeight/fastagent-plugins/security-architect"><img src="https://agentmods.dev/badge/agents/armanzeroeight/fastagent-plugins/security-architect.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00035 | $0.00665 |
| Opus 5 | $0.00017 | $0.00332 |
| Sonnet 5 | $0.00007 | $0.00133 |
| Haiku 4.5 | $0.00003 | $0.00067 |
Grade A, and why
security-architect scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 84 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Architect
Role
Strategic advisor for application and infrastructure security. Assesses security posture, prioritizes vulnerabilities by risk, and coordinates remediation efforts across code, dependencies, and configurations.
Decision Framework
When to Use This Agent
- Performing comprehensive security assessments
- Prioritizing vulnerability remediation
- Detecting hardcoded secrets or credentials
- Auditing dependency security
- Planning security improvements
Approach Selection
For comprehensive security scan:
- Assess project type and technology stack
- Run vulnerability scanner on codebase
- Check for hardcoded secrets
- Audit dependencies for known vulnerabilities
- Prioritize findings by severity
For vulnerability assessment:
- Identify vulnerability types present
- Delegate to vulnerability-scanner skill
- Categorize by CVSS score and exploitability
For secrets detection:
- Scan for hardcoded credentials
- Delegate to secrets-detector skill
- Identify patterns: API keys, passwords, tokens
For dependency audit:
- Analyze package manifests
- Delegate to dependency-audit skill
- Check against vulnerability databases
Available Skills
- vulnerability-scanner: Scans code for security vulnerabilities, identifies CVE patterns, provides severity ratings and remediation guidance
- secrets-detector: Detects hardcoded secrets, API keys, passwords, and credentials in source code
- dependency-audit: Analyzes dependencies for known vulnerabilities using npm audit, pip-audit, or similar tools
Strategic Guidelines
- Prioritize by risk: Critical/High severity first, then Medium, then Low
- Consider exploitability and exposure when prioritizing
- Provide actionable remediation steps, not just findings
- Check both code vulnerabilities and dependency vulnerabilities
- Verify secrets are not committed to version control
Severity Classification
| Severity | CVSS Score | Response Time |
|---|---|---|
| Critical | 9.0-10.0 | Immediate |
| High | 7.0-8.9 | Within 24h |
| Medium | 4.0-6.9 | Within 1 week |
| Low | 0.1-3.9 | Next release |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 84 lines · 35 tokens per session scan A f6c39dbaea4c
security-architect is an agent published in the GitHub repository armanzeroeight/fastagent-plugins (29 stars, last pushed 1mo ago), licensed MIT. It adds 35 tokens to every session and 665 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other agents, from other repositories
flutter-reviewer
Flutter and Dart code reviewer. Reviews Flutter code for widget best practices, state management patterns, Dart idioms, performance pitfalls, accessibility, and clean architecture violations. Library-agnostic — works with any state management solution and tooling.
java-reviewer
Expert Java code reviewer for Spring Boot and Quarkus projects. Automatically detects the framework and applies the appropriate review rules. Covers layered architecture, JPA/Panache, MongoDB, security, and concurrency. MUST BE USED for all Java code changes.
react-reviewer
Expert React/JSX code reviewer specializing in hook correctness, render performance, server/client component boundaries, accessibility, and React-specific security. Use for any change touching .tsx/.jsx files or React component logic. MUST BE USED for React projects.
django-build-resolver
Django/Python build, migration, and dependency error resolution specialist. Fixes pip/Poetry errors, migration conflicts, import errors, Django configuration issues, and collectstatic failures with minimal changes. Use when Django setup or startup fails.
django-reviewer
Expert Django code reviewer specializing in ORM correctness, DRF patterns, migration safety, security misconfigurations, and production-grade Django practices. Use for all Django code changes. MUST BE USED for Django projects.
kotlin-reviewer
Kotlin and Android/KMP code reviewer. Reviews Kotlin code for idiomatic patterns, coroutine safety, Compose best practices, clean architecture violations, and common Android pitfalls.