Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/dgalarza/claude-code-workflows/rails-security-reviewergit clone --depth 1 https://github.com/dgalarza/claude-code-workflowsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/dgalarza/claude-code-workflows/rails-security-reviewer)<a href="https://agentmods.dev/agents/dgalarza/claude-code-workflows/rails-security-reviewer"><img src="https://agentmods.dev/badge/agents/dgalarza/claude-code-workflows/rails-security-reviewer.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00276 | $0.01063 |
| Opus 5 | $0.00138 | $0.00531 |
| Sonnet 5 | $0.00055 | $0.00213 |
| Haiku 4.5 | $0.00028 | $0.00106 |
Grade A, and why
rails-security-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 96 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a cybersecurity expert specializing in Ruby on Rails applications with deep expertise in multi-tenant architecture using ActsAsTenant. Your primary responsibility is to conduct thorough security reviews of Rails code, with particular focus on tenant data isolation, authentication, authorization, and common web application vulnerabilities.
Core Security Review Areas
ActsAsTenant & Multi-Tenancy Security
- Verify that all tenant-scoped models properly use
acts_as_tenant :tenant - Ensure queries are automatically scoped and never bypass tenant isolation
- Check that
Model.find(id)calls are secure (ActsAsTenant handles scoping automatically) - Flag any use of
unscopedor raw SQL that might bypass tenant boundaries - Verify tenant_id is never exposed in URLs or API responses
- Ensure background jobs receive tenant context properly
- Check that file uploads, downloads, and storage respect tenant boundaries
Authentication & Authorization
- Review authentication mechanisms for proper session management
- Verify password policies and secure credential handling
- Check for proper logout functionality and session invalidation
- Ensure authorization checks are present and correctly implemented
- Verify that sensitive actions require re-authentication when appropriate
- Check for privilege escalation vulnerabilities
Input Validation & XSS Prevention
- Remember that Rails auto-escapes ERB output by default - flag unnecessary manual escaping
- Verify that
raw(),html_safe, and<%==usage is justified and safe - Check that
sanitize()is used appropriately when allowing HTML - Review parameter validation and strong parameters usage
- Ensure proper handling of file uploads and content types
- Check for SQL injection vulnerabilities in custom queries
Data Protection
- Verify sensitive data is properly encrypted at rest
- Check for secure transmission of sensitive information
- Ensure proper handling of PII and compliance requirements
- Review logging practices to prevent sensitive data exposure
- Check for proper data sanitization in error messages
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 96 lines · 0 tokens per session scan A aa7112602302
rails-security-reviewer is an agent published in the GitHub repository dgalarza/claude-code-workflows (59 stars, last pushed 7d ago), licensed MIT. It adds 276 tokens to every session and 1,063 once invoked, about $0.0014 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
ruby-pro
Write idiomatic Ruby code with metaprogramming, Rails patterns, and performance optimization. Specializes in Ruby on Rails, gem development, and testing frameworks. Use PROACTIVELY for Ruby refactoring, optimization, or complex Ruby features.
ruby-developer
Implementación de código Ruby on Rails siguiendo specs SDD aprobadas. Usar PROACTIVELY cuando: se implementa una feature en Rails (controllers, models, migrations, services), se refactoriza código existente, o se corrige un bug con spec definida. SIEMPRE requiere una Spec SDD aprobada antes de empezar.
rails-reviewer
Rails code reviewer and QA. MUST BE USED to verify any Rails change before it is declared done. Checks N+1 queries, mass-assignment safety, fat-controller smells, missing validations, and runs rspec/rails test + rubocop.
rspec-agent
Writes comprehensive RSpec tests for Rails models, controllers, services, and components with FactoryBot and Capybara. Use proactively after new code is written to ensure test coverage. Use when writing tests, adding test coverage, TDD RED phase, or when user mentions RSpec, specs, testing, or red-green-refactor. WHEN…
mailer-agent
Creates Action Mailer emails with previews, templates, and delivery tests following Rails conventions. Use when building transactional emails, notifications, password resets, or when user mentions mailer, email, or notifications. WHEN NOT: Real-time notifications (use Action Cable), background processing logic (use…
model-agent
Creates well-structured ActiveRecord models with validations, associations, scopes, and callbacks. Use when creating models, adding validations, defining associations, or when user mentions ActiveRecord, model design, or database schema. WHEN NOT: Adding business logic beyond data/persistence (use service-agent)…