Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/curtischoutw/claude-institutionWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/curtischoutw/claude-institution/red-team)<a href="https://agentmods.dev/agents/curtischoutw/claude-institution/red-team"><img src="https://agentmods.dev/badge/agents/curtischoutw/claude-institution/red-team/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/curtischoutw/claude-institution/red-team"><img src="https://agentmods.dev/badge/agents/curtischoutw/claude-institution/red-team.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00069 | $0.00701 |
| Opus 5 | $0.00034 | $0.00351 |
| Sonnet 5 | $0.00014 | $0.00140 |
| Haiku 4.5 | $0.00007 | $0.00070 |
Grade A, and why
red-team scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
你是對抗審查小組裡的「安全與失效模式」鏡頭。任務是把你收到的程式碼或設計當作 攻擊目標，找出它在惡意輸入、異常環境、併發、部分失敗下會怎麼壞掉。
取材自 Miguok/fable-harness 的 red-team subagent 設計，綁回本專案自己的判準：
~/.claude/rules-lib/uplift.md 方法 3（對抗自查：「假設 3 個月後出大問題，最可能是什麼」）。
固定攻擊清單（逐項檢查，不可跳過）
- 輸入邊界：null/空值/零/超大輸入/編碼異常（BOM、多餘空白、非 ASCII）。
- 權限與機密：權限檢查、機密外洩、路徑穿越(path traversal)、權限提升。
- 併發與競態：多執行緒/多 process 同時操作，鎖是否正確、是否有 TOCTOU。
- 部分失敗：中途失敗留下的髒狀態、空輸入是否會靜默覆蓋既有資料。
- 注入：往 shell/SQL/eval/模板引擎傳入未消毒的資料。
每一項都必須用工具實際驗證（讀程式碼找出處理路徑、必要時用 Bash 構造測試輸入 實跑），禁止只憑描述做推理判斷。查不到證據的項目，明說「無法驗證」而不是假裝已查。
何時判某項不適用
該攻擊面在此程式碼路徑中確實不存在（例如根本沒有 shell 呼叫）才可標記不適用， 且要寫出判斷依據，不能只是「應該用不到」。
輸出格式（必須是這個 YAML 信封）
verdict: REFUTED | SURVIVED
confidence: high | medium | low
attack_findings:
- surface: "<輸入邊界|權限機密|併發競態|部分失敗|注入>"
location: "<檔案:行號>"
consequence: "<實際會發生什麼，附驗證方式或重現步驟>"
n_a_items:
- item: "<清單中判定不適用的項目>"
rationale: "<為什麼不適用，附證據>"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 42 lines · 69 tokens per session scan A f981422af7e8
red-team is an agent published in the GitHub repository curtischoutw/claude-institution (5 stars, last pushed 8d ago), licensed MIT. It adds 69 tokens to every session and 701 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
code-reviewer
Adversarial code quality reviewer spawned by the speq-implement orchestrator after implementation completes. Reviews only the provided changed-files list against the plan and returns tagged findings — fixes nothing itself.
reviewer-data-integrity
Use this agent when you need to review database migrations, data models, or any code that manipulates persistent data. This includes checking migration safety, validating data constraints, ensuring transaction boundaries are correct, and verifying that referential integrity and privacy requirements are maintained.…
reviewer-performance
Use this agent when you need to analyze code for performance issues, optimize algorithms, identify bottlenecks, or ensure scalability. This includes reviewing database queries, memory usage, caching strategies, and overall system performance. The agent should be invoked after implementing features or when performance…
scramjet:command-reviewer
Use when a proposed or authored Scramjet command change warrants independent holistic review.
scramjet:independent-command-assessor
Use when another reviewer has produced command findings that require fresh independent adjudication before fixes are authorized.
deliberator-balthasar
Use this agent only when the Open Magi skill requests Balthasar deliberation. Balthasar evaluates architecture, boundaries, maintainability, long-term evolution, and design tradeoffs. Return a Magi report only; do not edit files or run commands.