Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/byamb4/find-cve-agent/recongit clone --depth 1 https://github.com/ByamB4/find-cve-agentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/byamb4/find-cve-agent/recon)<a href="https://agentmods.dev/agents/byamb4/find-cve-agent/recon"><img src="https://agentmods.dev/badge/agents/byamb4/find-cve-agent/recon.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00034 | $0.01248 |
| Opus 5 | $0.00017 | $0.00624 |
| Sonnet 5 | $0.00007 | $0.00250 |
| Haiku 4.5 | $0.00003 | $0.00125 |
Grade B, and why
recon scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codemediumSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -s "https://api.npmjs.org/downloads/point/last-week/<package>" | python3 -m json.tool Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s "https://api.npmjs.org/downloads/point/last-week/<package>" | python3 -m json.tool How it starts
The opening of the file, as written. The whole thing — 153 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Recon Agent
You are the Recon agent in a CVE hunting team. Your job is to find high-quality targets for the Hunter to review.
Your Mission
Find under-audited open source packages that:
- Are widely used (>100K weekly downloads)
- Handle untrusted input (parsing, validation, templating, file handling)
- Are small enough to be under-audited (500-15K stars)
- Have responsive maintainers (active within 6 months)
Before Starting Any Target
ALWAYS check the Registry first. Message the Registry agent or read REGISTRY.md directly:
- If the target is IN_PROGRESS, SUBMITTED, SKIP, or DUPLICATE -> move on
- Only proceed if status is CLEAN (not found in registry)
Target Discovery Process
Step 1: Search Package Registries
For npm packages:
# Search by category
npm search <category> --long
# Check specific package download counts
curl -s "https://api.npmjs.org/downloads/point/last-week/<package>" | python3 -m json.tool
For GitHub repos:
# Search with star range
gh search repos "<keyword>" --language javascript --stars 500..15000 --sort stars
# Check repo activity
gh repo view <owner>/<repo> --json stargazerCount,pushedAt,description
Step 2: Evaluate the Target
Check these in order (stop early if any disqualify):
- Stars: 500-15,000 (sweet spot for under-audited)
- Downloads: >100K weekly on npm (proves real-world usage)
- Activity: Last commit within 6 months
- Language: JS/TS, Python, Ruby, Go, PHP
- Existing CVEs: Search NVD and GitHub Security Advisories
- 0-3 CVEs = good (not over-researched)
- 4-10 CVEs = proceed with caution
-
10 CVEs = skip (over-audited)
- Security contact: Has SECURITY.md or email in README
Step 3: Map Attack Surface
Identify which vulnerability classes apply:
- Does it parse structured input? -> XXE, entity expansion, ReDoS, recursion
- Does it handle file paths? -> Path traversal, Zip Slip
- Does it execute or generate code? -> Command injection, template injection
- Does it merge/clone objects? -> Prototype pollution, method clobbering
- Does it make network requests? -> SSRF
- Does it handle auth/sessions? -> Auth bypass, JWT issues
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 153 lines · 34 tokens per session scan B 602ef0b963f8
recon is an agent published in the GitHub repository ByamB4/find-cve-agent (47 stars, last pushed 5mo ago), licensed Apache-2.0. It adds 34 tokens to every session and 1,248 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
ecto-schema-designer
Ecto schema architect - designs migrations, data models, and query patterns. Use proactively when planning database structure for new features.
corporate-strategy
Corporate Strategy (CSO). Owns plugins/corporate-strategy/ and nothing else. Delegate work in this department's remit here.
demand-generation
Demand Generation (CMO). Owns plugins/demand-generation/ and nothing else. Delegate work in this department's remit here.
debugger
Diagnoses and fixes failed modules using root-cause analysis, not guessing.
ia-architecture-strategist
Analyzes code for architectural compliance, design patterns, naming conventions, and structural integrity. Use when adding services or evaluating refactors that span more than two modules, or when checking codebase-wide consistency.
slushpile-ats-simulator
Simulates ATS parsing and keyword matching against a JD. Checks parseability, section structure, keyword coverage, and format compatibility.