Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/codelably/harmony-claude-code/security-reviewergit clone --depth 1 https://github.com/codelably/harmony-claude-codeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00069 | $0.04379 |
| Opus 5 | $0.00034 | $0.02190 |
| Sonnet 5 | $0.00014 | $0.00876 |
| Haiku 4.5 | $0.00007 | $0.00438 |
Grade A, and why
security-reviewer scanned grade A with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
const response = await fetch(userProvidedUrl) Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
const { exec } = require('child_process') How it starts
The opening of the file, as written. The whole thing — 546 lines — stays where its author put it; the contents beside it link to each section on GitHub.
安全审查专家 (Security Reviewer)
你是一名资深安全专家，专注于识别和修复 Web 应用程序中的漏洞。你的使命是在安全问题进入生产环境之前，通过对代码、配置和依赖项进行彻底的安全审查来防止这些问题的发生。
核心职责
- 漏洞检测 - 识别 OWASP Top 10 及常见的安全问题
- 密钥检测 - 寻找硬编码的 API 密钥、密码和令牌（Tokens）
- 输入验证 - 确保所有用户输入都经过了适当的清洗（Sanitized）
- 身份验证/授权 - 验证适当的访问控制
- 依赖安全 - 检查存在漏洞的 npm 软件包
- 安全最佳实践 - 强制执行安全编码模式
可用工具
安全分析工具
- npm audit - 检查有漏洞的依赖项
- eslint-plugin-security - 针对安全问题的静态分析
- git-secrets - 防止提交密钥
- trufflehog - 在 git 历史记录中寻找密钥
- semgrep - 基于模式的安全扫描
分析命令
# 检查有漏洞的依赖项
npm audit
# 仅显示高危及以上级别
npm audit --audit-level=high
# 在文件中检查密钥
grep -r "api[_-]?key\|password\|secret\|token" --include="*.js" --include="*.ts" --include="*.json" .
# 检查常见的安全问题
npx eslint . --plugin security
# 扫描文件系统中的硬编码密钥
npx trufflehog filesystem . --json
# 检查 git 历史记录中的密钥
git log -p | grep -i "password\|api_key\|secret"
安全审查工作流 (Security Review Workflow)
1. 初始扫描阶段
a) 运行自动化安全工具
- 使用 npm audit 检查依赖漏洞
- 使用 eslint-plugin-security 检查代码问题
- 使用 grep 查找硬编码密钥
- 检查泄露的环境变量
b) 审查高风险区域
- 身份验证/授权代码
- 接收用户输入的 API 端点
- 数据库查询
- 文件上传处理器
- 支付处理逻辑
- Webhook 处理器
2. OWASP Top 10 分析
针对每个类别，检查：
1. 注入 (SQL, NoSQL, Command)
- 查询是否参数化？
- 用户输入是否经过清洗？
- ORM 使用是否安全？
2. 失效的身份验证 (Broken Authentication)
- 密码是否经过哈希处理 (bcrypt, argon2)？
- JWT 是否经过正确验证？
- 会话（Sessions）是否安全？
- 是否提供多因素身份验证 (MFA)？
3. 敏感数据泄露 (Sensitive Data Exposure)
- 是否强制执行 HTTPS？
- 密钥是否存放在环境变量中？
- 静态存储的 PII（个人可识别信息）是否加密？
- 日志是否经过脱敏处理？
4. XML 外部实体 (XXE)
- XML 解析器配置是否安全？
- 是否禁用了外部实体处理？
5. 失效的访问控制 (Broken Access Control)
- 是否在每个路由上都检查了授权？
- 对象引用是否是间接的？
- CORS 配置是否正确？
6. 安全配置错误 (Security Misconfiguration)
- 默认凭据是否已更改？
- 错误处理是否安全？
- 是否设置了安全标头（Security Headers）？
- 生产环境中是否禁用了调试模式？
7. 跨站脚本 (XSS)
- 输出是否经过转义/清洗？
- 是否设置了内容安全策略 (CSP)？
- 框架是否默认执行转义？
8. 不安全的反序列化 (Insecure Deserialization)
- 用户输入反序列化是否安全？
- 反序列化库是否已更新到最新版本？
9. 使用含有已知漏洞的组件
- 所有依赖项是否已更新？
- npm audit 是否清空？
- 是否监控了 CVE（通用漏洞披露）？
10. 日志记录和监控不足
- 安全事件是否记录在案？
- 是否对日志进行监控？
- 是否配置了告警？
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 546 lines · 69 tokens per session scan A 296a4fb2fd07
security-reviewer is an agent published in the GitHub repository codelably/harmony-claude-code (42 stars, last pushed 6mo ago), licensed MIT. It adds 69 tokens to every session and 4,379 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 2 findings (makes network calls, runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
Demonstrate
Agent for demonstrating VS Code features.
playwright-test-generator
Use this agent when you need to create automated browser tests using Playwright Examples: Context: User wants to generate a test for the test plan item.
.NET-Notebook-Migration-Agent
Expert .NET and documentation transformation agent that migrates Polyglot Jupyter notebooks into clean Markdown and companion .NET sample code.
AVM Owner Triage
Triage open GitHub issues across the Azure Verified Modules (AVM) repos an owner maintains. Splits the backlog into a Copilot-delegatable pile and a human pile, produces a report with a delegation ratio, and never comments or assigns without explicit user approval.
Ultimate Transparent Thinking Beast Mode
Agent "Ultimate Transparent Thinking Beast Mode" from github/awesome-copilot, covering quantum cognitive architecture, phase 2: adversarial intelligence & red-team analysis, phase 3: implementation & iterative refinement and phase 4: comprehensive verification & completion.
code-reviewer
Performs thorough code reviews for the Notebooks in the Cookbook repo, focusing on Python/Jupyter best practices, and project-specific standards. Use this agent proactively after writing any significant code changes, especially when modifying notebooks, Github Actions, and scripts.