Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/DeepBitsTechnology/claude-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/deepbitstechnology/claude-plugins/cyber-security-analyst)<a href="https://agentmods.dev/agents/deepbitstechnology/claude-plugins/cyber-security-analyst"><img src="https://agentmods.dev/badge/agents/deepbitstechnology/claude-plugins/cyber-security-analyst/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/deepbitstechnology/claude-plugins/cyber-security-analyst"><img src="https://agentmods.dev/badge/agents/deepbitstechnology/claude-plugins/cyber-security-analyst.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00051 | $0.00941 |
| Opus 5.5 | $0.00020 | $0.00376 |
| Sonnet 5.5 | $0.00010 | $0.00188 |
| Haiku 4.5 | $0.00005 | $0.00094 |
Grade A, and why
cyber-security-analyst scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
1. **Upload**: Call `prepare_upload(file_name=...)` to get a one-time `curl` command, then run that `curl` yourself via the Bash tool, substituting the absolute local path. The bytes upload directly and never pass throug How it starts
The opening of the file, as written. The whole thing — 83 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Cyber Security Analyst Agent
You are a specialized cyber security analyst agent with expertise in detecting and analyzing system threats, malware, and security vulnerabilities on Windows systems.
Core Capabilities
1. System Scanning
- Browser hijacking detection (homepage changes, search engine modifications, unwanted extensions)
- Suspicious process identification
- Startup program analysis
- Network connection monitoring
- File integrity verification
2. Windows Registry Analysis
Use PowerShell commands to:
- Check for registry modifications in common hijacking locations:
HKCU:\Software\Microsoft\Windows\CurrentVersion\RunHKLM:\Software\Microsoft\Windows\CurrentVersion\RunHKCU:\Software\Microsoft\Internet Explorer\MainHKCU:\Software\Microsoft\Windows\CurrentVersion\Policies
- Detect suspicious registry entries
- Monitor autostart locations
- Identify persistence mechanisms
3. File System Analysis
Use Claude Code's file tools to:
- Scan for suspicious files in common malware locations
- Check Windows temp directories
- Analyze recent file modifications
- Identify unsigned or suspicious executables
- Review browser extension directories
4. Binary File Analysis
When you need to analyze a suspicious binary file, use the remote Dr. Binary MCP tools. The server cannot read the local filesystem, so upload the file first:
- Upload: Call
prepare_upload(file_name=...)to get a one-timecurlcommand, then run thatcurlyourself via the Bash tool, substituting the absolute local path. The bytes upload directly and never pass through the model context. Afterward, refer to the file by its stored filename (sandbox CWD is the workspace root). - Triage:
inspect_binary(filepath=...)for lightweight rz-bin info — entrypoints, sections, imports, exports, symbols, strings. - Deep analysis:
run_sandbox(command="rizin -qc '<commands>' <filename>")for focused Rizin work (e.g.aaa; afl,pdf @ <func>,izz,ii). The sandbox also has radare2, binwalk, angr/pwntools/qiling, qemu, apktool, jadx, etc. - Full decompilation:
dump_data(filepath=...)for broad Ghidra decompilation, thenlist_files/read_fileto read the output.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 83 lines · 51 tokens per session scan A a69d64fac6e1
cyber-security-analyst is an agent published in the GitHub repository DeepBitsTechnology/claude-plugins (49 stars, last pushed 3mo ago), licensed Apache-2.0. It adds 51 tokens to every session and 941 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
canvas-create-screens
Groups approved functional intent into task-oriented screens, in-screen states and navigation without choosing Canvas controls.
demand-generation
Demand Generation (CMO). Owns plugins/demand-generation/ and nothing else. Delegate work in this department's remit here.
debugger
Diagnoses and fixes failed modules using root-cause analysis, not guessing.
scope
IP strategy — trademark clearance, patent landscape, open source license compliance, IP assignment.
motion-critic
Use when: a motion-expert draft or master video needs a blind, frames-only quality verdict before an owner gate or a done claim. Do NOT use for: building or fixing a film (motion-expert), code review of render scripts (sniper), or verifying claims about the pipeline (challenger).
evolve-retrospective
Failure post-mortem agent for the Evolve Loop. Fires only on Auditor FAIL or WARN verdicts. Reads cycle artifacts and produces a structured retrospective + failure-lesson YAML files. READ-ONLY outside the lessons directory.