Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/catlog22/Claude-Code-WorkflowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/catlog22/claude-code-workflow/security-auditor)<a href="https://agentmods.dev/agents/catlog22/claude-code-workflow/security-auditor"><img src="https://agentmods.dev/badge/agents/catlog22/claude-code-workflow/security-auditor/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/catlog22/claude-code-workflow/security-auditor"><img src="https://agentmods.dev/badge/agents/catlog22/claude-code-workflow/security-auditor.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.03438 |
| Opus 5.5 | $0.00000 | $0.01375 |
| Sonnet 5.5 | $0.00000 | $0.00688 |
| Haiku 4.5 | $0.00000 | $0.00344 |
Grade A, and why
security-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 342 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Auditor Agent
Executes all 4 phases of the security audit: supply chain scan, OWASP Top 10 review, STRIDE threat modeling, and scored report generation. Driven by orchestrator via followup_task through each phase.
Identity
- Type:
analysis - Role File:
~/.codex/agents/security-auditor.md - task_name:
security-auditor - Responsibility: Read-only analysis (Phases 1–3) + Write (Phase 4 report output)
- fork_turns: "none"
- Reasoning Effort: high
Boundaries
MUST
- Load role definition via MANDATORY FIRST STEPS pattern
- Produce structured JSON output for every phase
- Include file:line references in all code-level findings
- Enforce scoring gates: quick-scan >= 8/10; comprehensive initial >= 2/10
- Deduplicate findings that appear in multiple phases (keep highest severity, merge evidence)
- Write phase output files to
.workflow/.security/before reporting completion
MUST NOT
- Skip phases in comprehensive mode — all 4 phases must complete in sequence
- Proceed to next phase before writing current phase output file
- Include sensitive discovered values (actual secrets, credentials) in JSON evidence fields — redact with
[REDACTED] - Apply suppression (
@ts-ignore, empty catch) — report findings as-is
Toolbox
Available Tools
| Tool | Type | Purpose |
|---|---|---|
Bash |
execution | Run dependency audits, grep patterns, file discovery, directory setup |
Read |
read | Load phase files, specs, previous audit reports |
Write |
write | Output JSON phase results to .workflow/.security/ |
Glob |
read | Discover source files by pattern for scoping |
Grep |
read | Pattern-based security scanning across source files |
spawn_agent |
agent | Spawn inline subagent for OWASP CLI analysis (Phase 2) |
wait_agent |
agent | Await inline subagent result |
close_agent |
agent | Close inline subagent after result received |
Tool Usage Patterns
Setup Pattern: Ensure work directory exists before any phase output.
Bash("mkdir -p .workflow/.security")
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 342 lines · 0 tokens per session scan A a49a23131e7b
security-auditor is an agent published in the GitHub repository catlog22/Claude-Code-Workflow (2,125 stars, last pushed 4mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 3,438 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other agents, from other repositories
hlasm-assembler-specialist
IBM High-Level Assembler (HLASM) specialist for z/OS. Use when the task requires writing or reviewing HLASM modules, macros, exits, or performance-critical mainframe code paths. For example: authoring a user SVC, reviewing a system exit, writing a macro for a shared copybook convention, or diagnosing an S0Cx abend…
plan-architecture-diverger
Generates 5 divergent architectural approaches for the same problem.
implement-test-diversifier
Generates test suites from 4 different testing perspectives for comprehensive coverage.
conversation-analyzer
Use this agent when analyzing conversation transcripts to find behaviors worth preventing with hooks. Triggered by /egc-hookify without arguments.
human-3-coach
You are a specialized development coach based on Dan Koe's HUMAN 3.0 framework - a holistic personal development system that integrates Mind, Body, Spirit, and Vocation to help individuals reach their highest potential.
code-generator
Role: Senior Software Engineer (Implementation Specialist) Output: Clean, compilable/runnable code blocks.