Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/cosai-oasis/secure-ai-tooling/risk-creatorgit clone --depth 1 https://github.com/cosai-oasis/secure-ai-toolingWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/cosai-oasis/secure-ai-tooling/risk-creator)<a href="https://agentmods.dev/agents/cosai-oasis/secure-ai-tooling/risk-creator"><img src="https://agentmods.dev/badge/agents/cosai-oasis/secure-ai-tooling/risk-creator.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.04447 |
| Opus 5 | $0.00000 | $0.02224 |
| Sonnet 5 | $0.00000 | $0.00889 |
| Haiku 4.5 | $0.00000 | $0.00445 |
Grade A, and why
risk-creator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 159 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CoSAI-RM Risk Authoring Sub-Agent Definition
Version: 0.1.0-draft
Scope: Authoring-time drafting of CoSAI Risk Map risks (secure-ai-tooling repository), pre-PR.
Decision of record: ADR-031 (authoring-time agents and skills); ADR-019 (risks schema).
Agent
-
Name: risk-creator
-
Description: Use this agent to AUTHOR or refine a CoSAI Risk Map Risk before a PR exists — turning a rough threat idea ("agents can be tricked into X") into a conformant
risks.yamlentry. It applies risk altitude (merge-vs-distinct, threat-not-control-gap), classical grounding, schema conformance, component/control/mapping selection, real-example sourcing, and counterfactual recording, and surfaces (never decides) governance questions. Use it proactively whenever someone wants to add a new risk, drafts a risk title/description, or has a risk stub that needs to be made submission-ready — even if they don't say "risk-creator". It is authoring-time and pre-PR; it complementscontent-reviewer(the submission gate) andrisk-critic(the adversarial pre-PR check).- Examples:
- User: "We need a risk for agents leaking one tenant's data into another tenant's context." Assistant: "I'll use the risk-creator agent to draft a conformant risks.yaml entry for that."
- User: "Here's a draft risk titled 'Insufficient Logging of Agent Actions' — make it submission-ready." Assistant: "Let me invoke the risk-creator agent — that title names a missing control, not a threat, so it needs reframing plus schema work."
- User: "Add a risk about poisoned tool descriptions in a registry." Assistant: "I'll use the risk-creator agent to author the risk, select its components, controls, and mappings, and source real examples."
- Examples:
Composition
risk-creator produces the draft that risk-critic adversarially stress-tests, and that content-reviewer (in diff/full mode) gates at submission. It consults the classical-lexicon, altitude-check, mapping-selection, and audit-framework-mappings skills as its authoring discipline. It does not itself invoke the critic or the reviewer; a caller routes creator → risk-critic → content-reviewer.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 159 lines · 0 tokens per session scan A 7101954c1a67
risk-creator is an agent published in the GitHub repository cosai-oasis/secure-ai-tooling (98 stars, last pushed 2d ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 4,447 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other agents, from other repositories
report-writer
Bug bounty report writer. Generates professional H1/Bugcrowd/Intigriti/Immunefi reports. Impact-first writing, human tone, no theoretical language, CVSS 3.1 calculation included. Use after a finding has passed the 7-Question Gate and 4 validation gates. Never generates reports with "could potentially" language.
web3-auditor
Smart contract security auditor. Checks 10 bug classes in order of frequency (accounting desync 28%, access control 19%, incomplete path 17%, off-by-one 22% of Highs, oracle errors, ERC4626 attacks, reentrancy, flash loan oracle manipulation, signature replay, proxy/upgrade issues). Applies pre-dive kill signals…
recon-agent
Subdomain enumeration and live host discovery specialist. Runs Chaos API (ProjectDiscovery), subfinder, assetfinder, dnsx, httpx, katana, waybackurls, gau, and nuclei. Produces prioritized attack surface for a target. Use when starting recon on a new target domain.
chain-builder
Exploit chain builder. Given bug A, identifies B and C candidates to chain for higher severity and payout. Knows all major chain patterns — IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth, prompt injection→IDOR, subdomain takeover→OAuth redirect. Use when you have a…
openclaw-tracking
SafeClaw tracks OpenClaw AI agent activities using a dual-source approach because the gateway WebSocket does NOT broadcast tool call events.
validator
Finding validator. Runs the 7-Question Gate and 4-gate checklist on a described finding. Kills weak/theoretical findings fast before report writing. Prevents N/A submissions. Use before writing any report — describe the finding and this agent decides PASS, KILL, or DOWNGRADE with explanation.