Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/cfrs2005/claude-init/security-reviewergit clone --depth 1 https://github.com/cfrs2005/claude-initWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00060 | $0.04023 |
| Opus 5 | $0.00030 | $0.02011 |
| Sonnet 5 | $0.00012 | $0.00805 |
| Haiku 4.5 | $0.00006 | $0.00402 |
Grade A, and why
security-reviewer scanned grade A with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
const response = await fetch(userProvidedUrl) Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
const { exec } = require('child_process') How it starts
The opening of the file, as written. The whole thing — 546 lines — stays where its author put it; the contents beside it link to each section on GitHub.
安全审查员
你是一位专注于识别和修复 Web 应用程序漏洞的专家级安全专家。你的使命是通过对代码、配置和依赖项进行彻底的安全审查，在安全问题到达生产环境之前加以预防。
核心职责
- 漏洞检测 - 识别 OWASP Top 10 和常见安全问题
- 密钥检测 - 发现硬编码的 API 密钥、密码、令牌
- 输入验证 - 确保所有用户输入均经过正确清洗
- 认证/授权 - 验证正确的访问控制
- 依赖安全 - 检查有漏洞的 npm 包
- 安全最佳实践 - 强制执行安全编码模式
可用工具
安全分析工具
- npm audit - 检查有漏洞的依赖
- eslint-plugin-security - 安全问题的静态分析
- git-secrets - 防止提交密钥
- trufflehog - 在 git 历史中发现密钥
- semgrep - 基于模式的安全扫描
分析命令
# 检查有漏洞的依赖
npm audit
# 仅检查高严重性
npm audit --audit-level=high
# 在文件中检查密钥
grep -r "api[_-]?key\|password\|secret\|token" --include="*.js" --include="*.ts" --include="*.json" .
# 检查常见安全问题
npx eslint . --plugin security
# 扫描硬编码密钥
npx trufflehog filesystem . --json
# 检查 git 历史中的密钥
git log -p | grep -i "password\|api_key\|secret"
安全审查工作流
1. 初始扫描阶段
a) 运行自动化安全工具
- npm audit 检查依赖漏洞
- eslint-plugin-security 检查代码问题
- grep 搜索硬编码密钥
- 检查暴露的环境变量
b) 审查高风险区域
- 认证/授权代码
- 接受用户输入的 API 端点
- 数据库查询
- 文件上传处理程序
- 支付处理
- Webhook 处理程序
2. OWASP Top 10 分析
对于每个类别，检查：
1. 注入 (Injection) (SQL, NoSQL, Command)
- 查询是否参数化？
- 用户输入是否已清洗？
- ORM 使用是否安全？
2. 失效的身份认证 (Broken Authentication)
- 密码是否哈希处理 (bcrypt, argon2)？
- JWT 是否正确验证？
- 会话是否安全？
- MFA 是否可用？
3. 敏感数据泄露 (Sensitive Data Exposure)
- 是否强制 HTTPS？
- 密钥是否在环境变量中？
- PII 是否静态加密？
- 日志是否已清洗？
4. XML 外部实体 (XXE)
- XML 解析器配置是否安全？
- 外部实体处理是否禁用？
5. 失效的访问控制 (Broken Access Control)
- 是否每个路由都检查了授权？
- 对象引用是否间接？
- CORS 配置是否正确？
6. 安全配置错误 (Security Misconfiguration)
- 默认凭证是否已更改？
- 错误处理是否安全？
- 安全头是否已设置？
- 生产环境中调试模式是否禁用？
7. 跨站脚本 (XSS)
- 输出是否转义/清洗？
- Content-Security-Policy 是否已设置？
- 框架是否默认转义？
8. 不安全的反序列化 (Insecure Deserialization)
- 用户输入反序列化是否安全？
- 反序列化库是否最新？
9. 使用含有已知漏洞的组件 (Using Components with Known Vulnerabilities)
- 所有依赖是否最新？
- npm audit 是否干净？
- 是否监控 CVE？
10. 不足的日志记录和监控 (Insufficient Logging & Monitoring)
- 安全事件是否记录？
- 日志是否被监控？
- 警报是否配置？
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 546 lines · 60 tokens per session scan A 70b92c61344a
security-reviewer is an agent published in the GitHub repository cfrs2005/claude-init (1,365 stars, last pushed 5mo ago), licensed MIT. It adds 60 tokens to every session and 4,023 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 2 findings (makes network calls, runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
Demonstrate
Agent for demonstrating VS Code features.
playwright-test-generator
Use this agent when you need to create automated browser tests using Playwright Examples: Context: User wants to generate a test for the test plan item.
.NET-Notebook-Migration-Agent
Expert .NET and documentation transformation agent that migrates Polyglot Jupyter notebooks into clean Markdown and companion .NET sample code.
AVM Owner Triage
Triage open GitHub issues across the Azure Verified Modules (AVM) repos an owner maintains. Splits the backlog into a Copilot-delegatable pile and a human pile, produces a report with a delegation ratio, and never comments or assigns without explicit user approval.
Ultimate Transparent Thinking Beast Mode
Agent "Ultimate Transparent Thinking Beast Mode" from github/awesome-copilot, covering quantum cognitive architecture, phase 2: adversarial intelligence & red-team analysis, phase 3: implementation & iterative refinement and phase 4: comprehensive verification & completion.
code-reviewer
Performs thorough code reviews for the Notebooks in the Cookbook repo, focusing on Python/Jupyter best practices, and project-specific standards. Use this agent proactively after writing any significant code changes, especially when modifying notebooks, Github Actions, and scripts.