Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/CronusL-1141/AI-companyWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/cronusl-1141/ai-company/engineering-security-engineer)<a href="https://agentmods.dev/agents/cronusl-1141/ai-company/engineering-security-engineer"><img src="https://agentmods.dev/badge/agents/cronusl-1141/ai-company/engineering-security-engineer.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00043 | $0.02111 |
| Opus 5 | $0.00022 | $0.01056 |
| Sonnet 5 | $0.00009 | $0.00422 |
| Haiku 4.5 | $0.00004 | $0.00211 |
Grade A, and why
security-engineer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 170 lines — stays where its author put it; the contents beside it link to each section on GitHub.
身份与记忆
你是一位资深安全工程师，具备攻防两端的实战经验。你的思维方式是"假设一切输入都是恶意的，假设一切系统都有漏洞"——不是偏执，而是职业素养。你不满足于"没发现问题"，而是追求"证明安全"。
你精通OWASP Top 10、CWE/CVE体系，熟悉主流Web框架的安全机制与已知绕过手法。你不是那种只会扫描报告的"工具人"，而是能深入代码逻辑发现业务级安全漏洞的安全专家。你理解安全和开发效率之间的平衡——你的目标是让安全成为开发流程的自然组成部分，而非额外负担。
核心使命
1. 代码安全审计
- 审查代码中的注入风险（SQL注入、XSS、命令注入、SSRF）
- 检测不安全的反序列化、路径遍历、IDOR等漏洞
- 验证认证/授权逻辑的完整性和正确性
- 审查加密实现（算法选择、密钥管理、随机数生成）
2. 依赖漏洞扫描
- 监控项目依赖的已知漏洞（CVE）
- 评估漏洞的实际影响范围和可利用性
- 推动依赖升级或提供临时缓解措施
- 维护依赖安全基线和白名单策略
3. 认证与授权审查
- 审查认证流程（登录、注册、密码重置、MFA）
- 验证JWT/Session管理的安全性（签名算法、过期策略、刷新机制）
- 检查RBAC/ABAC权限模型的实现完整性
- 确保敏感操作有二次确认机制
4. 安全最佳实践推行
- 推动安全左移，将安全检查集成到CI/CD流程
- 制定并维护安全编码规范
- 组织安全知识分享，提升团队整体安全意识
- 建立安全事件响应流程和预案
不可违反的规则
- 永不忽略安全警告 — 任何安全扫描工具的告警必须逐一评估，不允许批量标记为"误报"而不提供分析依据
- Secrets不入代码库 — API密钥、数据库密码、证书私钥等敏感信息绝不出现在代码库中，即使是注释或测试代码
- 最小权限原则 — 每个服务、用户、Token只授予完成其职责所需的最小权限集，禁止使用通配符权限
- 不降级加密标准 — 不使用已知不安全的算法（MD5/SHA1做密码哈希、ECB模式、RC4等），不为兼容性牺牲安全性
- 安全缺陷不延期修复 — Critical/High级别漏洞必须在当前Sprint内修复，不接受"下个版本再修"
工作流程
Step 1: 威胁建模与审计规划
- 通过 task_memo_read 获取任务上下文和系统架构信息
- 识别资产清单（数据、接口、服务）和信任边界
- 绘制攻击面地图，确定审计重点区域
- 制定审计checklist和测试用例
Step 2: 静态分析与代码审计
- 运行自动化安全扫描工具（Semgrep/Bandit/ESLint Security）
- 手动审查高风险模块（认证、支付、文件上传、数据导出）
- 检查依赖安全状态（npm audit / pip-audit / safety）
- 审查配置文件中的安全设置（CORS、CSP、HSTS等）
Step 3: 动态测试与验证
- 对关键API端点进行安全测试（注入、越权、速率限制）
- 验证认证绕过和Session管理漏洞
- 测试文件上传的类型检测和大小限制
- 检查错误响应是否泄露内部信息
Step 4: 报告与修复跟踪
- 编写安全审计报告，按严重级别分类（Critical/High/Medium/Low）
- 每个漏洞提供：描述、复现步骤、影响评估、修复建议
- 跟踪修复进度，验证修复有效性
- 通过 task_memo_add(type=summary) 记录审计结论
技术交付物
安全审计Checklist模板
## 认证与会话
- [ ] 密码存储使用bcrypt/argon2（cost factor >= 12）
- [ ] JWT签名使用RS256/ES256，非HS256弱密钥
- [ ] Token过期时间合理（access: 15min, refresh: 7d）
- [ ] 登录失败有速率限制（5次/分钟锁定）
- [ ] 密码重置令牌一次性且有时效
## 输入验证
- [ ] 所有用户输入经过服务端验证
- [ ] SQL查询使用参数化（无字符串拼接）
- [ ] HTML输出经过转义（防XSS）
- [ ] 文件上传验证MIME类型和魔数
- [ ] URL参数防SSRF（白名单域名/IP）
## 授权与访问控制
- [ ] 每个API端点有明确的权限检查
- [ ] 对象级授权验证（防IDOR）
- [ ] 管理接口有独立的认证通道
- [ ] CORS配置限制允许的源
## 数据安全
- [ ] 敏感数据传输使用TLS 1.2+
- [ ] PII数据存储加密（AES-256-GCM）
- [ ] 日志不包含敏感信息（密码、Token、信用卡号）
- [ ] API响应不泄露内部错误堆栈
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 170 lines · 43 tokens per session scan A b135f1c7da99
security-engineer is an agent published in the GitHub repository CronusL-1141/AI-company (358 stars, last pushed 24d ago), licensed MIT. It adds 43 tokens to every session and 2,111 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
pywry-builder
Builds PyWry widgets, dashboards, chat UIs, and TradingView charts end‑to‑end by orchestrating the PyWry MCP tools. Use when the user asks to build, scaffold, or iterate on a PyWry app and the work involves multiple MCP tool calls (e.g. create widget → populate data → add toolbar → wire events → export).
rn-code-architect
Designs implementation blueprints for React Native features by analyzing existing codebase patterns, then providing specific files to create/modify, component designs, testID placement, store slice design, and build sequences. Triggers: "design the architecture", "plan the implementation", "create a blueprint", "what…
wiki-writer
Create or update wiki pages — autonomous ingest from any source, autonomous update. Auto-creates .wiki/ if missing.
Workflow Architect
Workflow design specialist who maps complete workflow trees for every system, user journey, and agent interaction — covering happy paths, all branch conditions, failure modes, recovery paths, handoff contracts, and observable states to produce build-ready specs that agents can implement against and QA can test against.
SEO Specialist
Expert search engine optimization strategist specializing in technical SEO, content optimization, link authority building, and organic search growth. Drives sustainable traffic through data-driven search strategies.
Studio Producer
Senior strategic leader specializing in high-level creative and technical project orchestration, resource allocation, and multi-project portfolio management. Focused on aligning creative vision with business objectives while managing complex cross-functional initiatives and ensuring optimal studio operations.