What is threat-classification?

A system that rates AI-agent activities by examining what they do and which data they access. It can assign several threat findings and an overall level from none to critical.

Use it to assess actions such as reading files or running commands, identify evidence for each finding, and summarize session risk.

It avoids treating every file read or shell command as equally dangerous by considering its actual content and effect.

threat-classification — Agent by DinoMorphica

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add agents/dinomorphica/safeclaw/threat-classification

Clone the repo

git clone --depth 1 https://github.com/DinoMorphica/safeclaw

Made for: Claude Code.

Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 2,202 The whole file, excluding the scripts and references it only reads on demand.

Security scan F 5 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00000	$0.02202
Opus 5	$0.00000	$0.01101
Sonnet 5	$0.00000	$0.00440
Haiku 4.5	$0.00000	$0.00220

Measured 3d ago against content hash 6b864288f42e, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade F, and why

threat-classification scanned grade F with 5 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Asks for rootmediumPrivilege escalation

A mod that escalates privileges can change anything on the machine, not only the project.

- **CRITICAL**: Secrets in content, `rm -rf /`, `sudo rm`, writing to `/boot/`, fork bombs

Reaches for credential fileshighPrivilege escalation

SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.

| TC-SFA | Sensitive File Access | `.ssh/`, `.env`, `.aws/credentials`, `.pem`, `.p12`, keychain files. Read vs write severity differs. | LLM02 |

Downloads and executes remote codehighSupply chain

curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.

| TC-SUP | Supply Chain Risk | `npm install <pkg>`, `pip install`, `curl | bash`, `brew install`, modifying package.json/requirements.txt/Dockerfile. | LLM03 |

Recursive force deletehighDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

| TC-EXF | Data Exfiltration | Commands/URLs targeting paste sites, transfer services, ngrok, webhook.site. Code patterns like `fetch(process.env)`. | LLM02 |

.claude/agents/threat-classification.md · 147 lines

How it starts

The opening of the file, as written. The whole thing — 147 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Threat Classification System

Overview

SafeClaw uses a content-aware threat classification engine that evaluates AI agent activities based on what they actually do and what data they touch, not merely what type of action they are. A file read is only dangerous if the file contains secrets; a shell command is only critical if it's destructive.

The system is grounded in OWASP LLM Top 10 (2025) and MCP security research (Invariant Labs).

Design Principles

Content over action — Threat level is determined by what's IN the content, not the action type. Reading .env with API keys = CRITICAL (secrets go to model provider cloud). Reading README.md = NONE.
Multiple findings per activity — A single activity can trigger findings across multiple categories simultaneously (e.g., a shell command that is both destructive AND uses sudo).
Backward-compatible severity — The single threatLevel field (NONE–CRITICAL) is still computed as the max severity across all findings, so existing dashboard/session summary logic works unchanged.
Evidence-based — Each finding includes the specific evidence string that triggered it, so analysts can verify.

10 Threat Categories

| ID | Name | What it detects | OWASP Ref | | ------ | --------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | ----- | | TC-SEC | Secret Exposure | API keys, tokens, PEM keys, DB URLs in content previews. These get sent to model provider cloud. | LLM02 | | TC-EXF | Data Exfiltration | Commands/URLs targeting paste sites, transfer services, ngrok, webhook.site. Code patterns like fetch(process.env). | LLM02 | | TC-INJ | Prompt Injection Risk | Directive patterns in consumed content (web pages, tool responses): "ignore previous", "you are now", base64-encoded instructions. | LLM01 | | TC-DES | Destructive Operation | rm -rf /, mkfs, dd, fork bombs, DROP TABLE, TRUNCATE. | LLM06 | | TC-ESC | Privilege Escalation | sudo, chmod 777, chown root, usermod, su -, setuid changes. | LLM06 | | TC-SUP | Supply Chain Risk | npm install <pkg>, pip install, curl | bash, brew install, modifying package.json/requirements.txt/Dockerfile. | LLM03 | | TC-SFA | Sensitive File Access | .ssh/, .env, .aws/credentials, .pem, .p12, keychain files. Read vs write severity differs. | LLM02 | | TC-SYS | System Modification | Writing to /etc/, /usr/bin/, /boot/, .bashrc, .zshrc, crontab, systemd units. | LLM06 | | TC-NET | Suspicious Network | Raw IP connections, network commands (curl POST, wget, netcat, ssh, scp), messaging activity. | LLM02 | | TC-MCP | MCP/Tool Poisoning | Directive content detected in tool responses that could manipulate agent behavior. | LLM01 |

Read the full file on GitHub · 147 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

3d ago First seen · 147 lines · 0 tokens per session scan F 6b864288f42e

Subscribe to this mod's changes

threat-classification is an agent published in the GitHub repository DinoMorphica/safeclaw (21 stars, last pushed 6mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 2,202 tokens. A static security scan graded it F with 5 findings (asks for root, reaches for credential files, downloads and executes remote code). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Building agents Security access-control agent-monitoring ai ai-agents ai-security ai-security-tool

threat-classification