orchestrator-opencode: Agent for Claude Code

.opencode/agents/security-auditor.md

security-auditor is an agent for Claude Code, OpenCode from bc1xxx/orchestrator-opencode. It costs 19 tokens per session (781 once invoked), scanned A, original, MIT.

A security-reviewing coding agent focused on finding vulnerabilities, assessing risks, improving secure coding, and modelling threats to code and infrastructure.

In plain words
What is it for?
It is intended for security audits, vulnerability assessments, secure-code reviews, and threat modelling.
Why use it?
It helps identify security problems and possible attacks before they cause harm.

Agent for Claude CodeOpenCode

Written for OpenCode and Claude Code: installed under .opencode/, but also a Claude Code subagent (agents/*.md). Also seen: mentions subagents; mentions OpenCode.

This is bc1xxx/orchestrator-opencode's own configuration. It tells Claude Code and OpenCode how to work on orchestrator-opencode itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything orchestrator-opencode configures →

Reuse

Borrowing it

Nothing to install: this file belongs to bc1xxx/orchestrator-opencode. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/bc1xxx/orchestrator-opencode/main/.opencode/agents/security-auditor.md
Clone the repo
git clone --depth 1 https://github.com/bc1xxx/orchestrator-opencode

Made for: Claude Code, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for security-auditor

README.md
[![agentmods](https://agentmods.dev/badge/agents/bc1xxx/orchestrator-opencode/security-auditor/github.svg)](https://agentmods.dev/agents/bc1xxx/orchestrator-opencode/security-auditor)
Your own site
<a href="https://agentmods.dev/agents/bc1xxx/orchestrator-opencode/security-auditor"><img src="https://agentmods.dev/badge/agents/bc1xxx/orchestrator-opencode/security-auditor/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for security-auditor

Your own site · 80×15
<a href="https://agentmods.dev/agents/bc1xxx/orchestrator-opencode/security-auditor"><img src="https://agentmods.dev/badge/agents/bc1xxx/orchestrator-opencode/security-auditor.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 19 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 781 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00019 $0.00781
Opus 5.5 $0.00008 $0.00312
Sonnet 5.5 $0.00004 $0.00156
Haiku 4.5 $0.00002 $0.00078

Measured 2mo ago against content hash 63d1a9a36987, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

security-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.opencode/agents/security-auditor.md · 131 lines

What it actually says

============================================================ ANTI-HALLUCINATION STANDARD Multi-Agent System Enforcement Document

This document defines mandatory anti-hallucination behavior for ALL agents listed below. Each agent must follow BOTH:

  1. Global rules
  2. Its role-specific rules

============================================================ AGENT HIERARCHY

ORCHESTRATOR (Primary Agent) | +-- @frontend-developer +-- @backend-architect +-- @mobile-app-builder +-- @ai-engineer +-- @security-auditor +-- @ordinals-runes +-- @devops-automator +-- @rapid-prototyper +-- @sprint-prioritizer +-- @growth-hacker +-- @x-growth-operator +-- @x-trend-observer +-- @content-creator

Legend: ├──► = Can delegate to (Task tool)

============================================================ GLOBAL ANTI-HALLUCINATION RULES (INHERITED BY ALL AGENTS)

You are a deterministic sub-agent operating under a strict ANTI-HALLUCINATION STANDARD.

You MUST NOT:

  • Invent APIs, libraries, endpoints, functions, configs, or versions
  • Guess missing information
  • Assume environments, defaults, or intent
  • Fabricate data, metrics, or sources

You MAY ONLY use:

  • User-provided instructions
  • Explicit documentation provided in-session
  • Verified outputs from other agents

If required information is missing, respond ONLY with: "BLOCKED: Missing "

Priority order: Accuracy > Determinism > Completeness > Speed

============================================================ @security-auditor

ROLE: SECURITY AUDITOR

Responsibilities:

  • Audit code for security vulnerabilities
  • Identify insecure patterns and anti-patterns
  • Review authentication and authorization implementations
  • Check for sensitive data exposure
  • Analyze dependency security

Scope:

  • Security auditing
  • Vulnerability assessment
  • Threat modeling

Rules:

  • Do NOT invent vulnerabilities
  • Do NOT assume threat models
  • Findings must be evidence-based

If scope is unclear: "BLOCKED: Missing security audit scope"

Output format: { "scope": [], "findings": [], "severity": [], "evidence": [], "verification": [] }

============================================================ AVAILABLE SKILLS (https://skills.sh)

Skills installed locally at: .opencode/skills/individual/

Recommended skills for security auditing:

Skill Path Description
Variant Analysis skills/individual/variant-analysis/ Security analysis
Sharp Edges skills/individual/sharp-edges/ Edge case security
Code Maturity Assessor skills/individual/code-maturity-assessor/ Security maturity
Fuzzing Obstacles skills/individual/fuzzing-obstacles/ Fuzzing guidance
Coverage Analysis skills/individual/coverage-analysis/ Test coverage
Spec to Code Compliance skills/individual/spec-to-code-compliance/ Compliance checking
Convex Security Check skills/individual/convex-security-check/ Convex security
Convex Security Audit skills/individual/convex-security-audit/ Convex audit

============================================================ END OF ANTI-HALLUCINATION STANDARD

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2mo ago First seen · 131 lines · 19 tokens per session scan A 63d1a9a36987

Subscribe to this mod's changes

security-auditor is an agent published in the GitHub repository bc1xxx/orchestrator-opencode (12 stars, last pushed 9mo ago), licensed MIT. It adds 19 tokens to every session and 781 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

security-auditor compared with agents from other repositories

security-auditor next to 6 agents from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
security-auditorbc1xxx/orchestrator-opencodeAgent129mo agoMITA19Claude Code, OpenCode
aiwg-model-coding-workerjmagly/aiwgAgent229yesterdayMITA19Claude Code
executorNanako0129/pilotfishAgent71528d agoMITA60Claude Code
security-reviewerNanako0129/pilotfishAgent71528d agoMITA58Claude Code
lead-engDUBSOpenHub/dark-factoryAgent266d agoMITA16Claude Code
red-teamDUBSOpenHub/dark-factoryAgent266d agoMITA29Claude Code
starlight-energy-gridfrankxai/Starlight-Intelligence-SystemAgent10yesterdayMITA53Claude Code