Borrowing it
Nothing to install: this file belongs to DinoMorphica/safeclaw. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/DinoMorphica/safeclaw/main/.claude/agents/threat-classification.mdgit clone --depth 1 https://github.com/DinoMorphica/safeclawWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/dinomorphica/safeclaw/threat-classification)<a href="https://agentmods.dev/agents/dinomorphica/safeclaw/threat-classification"><img src="https://agentmods.dev/badge/agents/dinomorphica/safeclaw/threat-classification/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/dinomorphica/safeclaw/threat-classification"><img src="https://agentmods.dev/badge/agents/dinomorphica/safeclaw/threat-classification.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.02202 |
| Opus 5.5 | $0.00000 | $0.00881 |
| Sonnet 5.5 | $0.00000 | $0.00440 |
| Haiku 4.5 | $0.00000 | $0.00220 |
Grade A, and why
threat-classification scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 147 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Threat Classification System
Overview
SafeClaw uses a content-aware threat classification engine that evaluates AI agent activities based on what they actually do and what data they touch, not merely what type of action they are. A file read is only dangerous if the file contains secrets; a shell command is only critical if it's destructive.
The system is grounded in OWASP LLM Top 10 (2025) and MCP security research (Invariant Labs).
Design Principles
- Content over action — Threat level is determined by what's IN the content, not the action type. Reading
.envwith API keys = CRITICAL (secrets go to model provider cloud). ReadingREADME.md= NONE. - Multiple findings per activity — A single activity can trigger findings across multiple categories simultaneously (e.g., a shell command that is both destructive AND uses sudo).
- Backward-compatible severity — The single
threatLevelfield (NONE–CRITICAL) is still computed as the max severity across all findings, so existing dashboard/session summary logic works unchanged. - Evidence-based — Each finding includes the specific evidence string that triggered it, so analysts can verify.
10 Threat Categories
| ID | Name | What it detects | OWASP Ref |
| ------ | --------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | ----- |
| TC-SEC | Secret Exposure | API keys, tokens, PEM keys, DB URLs in content previews. These get sent to model provider cloud. | LLM02 |
| TC-EXF | Data Exfiltration | Commands/URLs targeting paste sites, transfer services, ngrok, webhook.site. Code patterns like fetch(process.env). | LLM02 |
| TC-INJ | Prompt Injection Risk | Directive patterns in consumed content (web pages, tool responses): "ignore previous", "you are now", base64-encoded instructions. | LLM01 |
| TC-DES | Destructive Operation | rm -rf /, mkfs, dd, fork bombs, DROP TABLE, TRUNCATE. | LLM06 |
| TC-ESC | Privilege Escalation | sudo, chmod 777, chown root, usermod, su -, setuid changes. | LLM06 |
| TC-SUP | Supply Chain Risk | npm install <pkg>, pip install, curl | bash, brew install, modifying package.json/requirements.txt/Dockerfile. | LLM03 |
| TC-SFA | Sensitive File Access | .ssh/, .env, .aws/credentials, .pem, .p12, keychain files. Read vs write severity differs. | LLM02 |
| TC-SYS | System Modification | Writing to /etc/, /usr/bin/, /boot/, .bashrc, .zshrc, crontab, systemd units. | LLM06 |
| TC-NET | Suspicious Network | Raw IP connections, network commands (curl POST, wget, netcat, ssh, scp), messaging activity. | LLM02 |
| TC-MCP | MCP/Tool Poisoning | Directive content detected in tool responses that could manipulate agent behavior. | LLM01 |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 147 lines · 0 tokens per session scan F 6b864288f42e
threat-classification is an agent published in the GitHub repository DinoMorphica/safeclaw (22 stars, last pushed 8mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 2,202 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
report-writer
Bug bounty report writer. Generates professional H1/Bugcrowd/Intigriti/Immunefi reports. Impact-first writing, human tone, no theoretical language, CVSS 3.1 calculation included. Use after a finding has passed the 7-Question Gate and 4 validation gates. Never generates reports with "could potentially" language.
web3-auditor
Smart contract security auditor. Checks 10 bug classes in order of frequency (accounting desync 28%, access control 19%, incomplete path 17%, off-by-one 22% of Highs, oracle errors, ERC4626 attacks, reentrancy, flash loan oracle manipulation, signature replay, proxy/upgrade issues). Applies pre-dive kill signals…
recon-agent
Subdomain enumeration and live host discovery specialist. Runs Chaos API (ProjectDiscovery), subfinder, assetfinder, dnsx, httpx, katana, waybackurls, gau, and nuclei. Produces prioritized attack surface for a target. Use when starting recon on a new target domain.
chain-builder
Exploit chain builder. Given bug A, identifies B and C candidates to chain for higher severity and payout. Knows all major chain patterns — IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth, prompt injection→IDOR, subdomain takeover→OAuth redirect. Use when you have a…
validator
Finding validator. Runs the 7-Question Gate and 4-gate checklist on a described finding. Kills weak/theoretical findings fast before report writing. Prevents N/A submissions. Use before writing any report — describe the finding and this agent decides PASS, KILL, or DOWNGRADE with explanation.
渗透测试专员
An authorized penetration-testing agent for checking whether identified security weaknesses can be verified and used within a defined scope. Penetration testing is a controlled security assessment of a system.