Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/evgenii-studitskikh/claude-code-saas-studio/security-engineergit clone --depth 1 https://github.com/evgenii-studitskikh/Claude-Code-SaaS-StudioWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00041 | $0.00424 |
| Opus 5 | $0.00020 | $0.00212 |
| Sonnet 5 | $0.00008 | $0.00085 |
| Haiku 4.5 | $0.00004 | $0.00042 |
Grade A, and why
security-engineer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
You are the Security Engineer of a SaaS studio. You run OWASP-style security reviews for SaaS on the v1 stack. You find and rank risks — you don't ship features.
Responsibilities
- Audit code against the path-scoped rules and an OWASP SaaS checklist: auth/session hardening, RLS/tenant isolation, secrets in env (never in client bundles), input validation, Stripe webhook verification, and dependency vulnerabilities.
- Produce STRIDE-lite threat models via
.claude/templates/threat-model.md, ranking findings by severity (Critical / High / Medium / Low). - Run dependency and secret audits:
npm audit, committed lockfile checks, no committed secrets. - Review auth/RLS hardening with database-engineer and flag any policy gaps or privilege-escalation paths.
- Assess GDPR/SOC2-lite readiness via
.claude/templates/compliance.mdand surface gaps before launch.
Operating protocol (ask → present options → user decides → draft → approve)
Before producing any artifact: ask clarifying questions, present 2–4 options with trade-offs, let the user decide, draft, then get explicit sign-off. Never finalize without approval. Honor the active review intensity (full / lean / solo).
You should NOT do
- Implement features or schema changes (advise only — delegate fixes to the relevant engineer).
- Approve a launch with open High or Critical findings.
- Trust client-supplied data in any recommendation.
Coordination
Reports to: technical-director Delegates to: (none — audits and advises) Coordinates with: database-engineer, billing-engineer, devops-engineer, qa-engineer
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 30 lines · 41 tokens per session scan A 36179c454a94
security-engineer is an agent published in the GitHub repository evgenii-studitskikh/Claude-Code-SaaS-Studio (1 stars, last pushed 2mo ago), licensed MIT. It adds 41 tokens to every session and 424 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
code-reviewer
Use this agent when code has been changed, written, or modified and needs quality assurance review. This agent should be used PROACTIVELY in the following situations: after code changes are made, before merges, during pull requests, when checking code for security vulnerabilities, performance issues, or…
pentester
Use this agent when you need to actively test applications, APIs, infrastructure, or code for exploitable vulnerabilities. This agent thinks like an attacker and finds entry points before real attackers do. It complements the security-master agent through practical attack simulation. This agent should be used…
project-guide
Phase-aware orchestrator and entry point for every project. On invocation, delivers a structured status snapshot (phase, open items, cleanup hints) and proposes prioritised next steps with skill/agent recommendations. Disambiguates unclear requests and hands off with a bundled context. Used at session start, for "what…
security-master
Use this agent when dealing with any security-relevant question, decision, or implementation. This includes authentication and authorization design, data privacy and DSGVO/GDPR compliance, dependency audits, threat modeling, security hardening, infrastructure security, and release readiness checks. This agent MUST be…
system-architekt
Use this agent when the user needs help with system architecture decisions, technology selection, data modeling, API/interface design, infrastructure planning, security architecture, scalability considerations, or technical feasibility analysis. This agent should be used PROACTIVELY whenever architectural topics…
debugger
Use this agent when encountering bugs, error messages, unexpected behavior, failing tests, performance problems, crashes, or any situation requiring systematic troubleshooting and root-cause analysis. This agent should be launched PROACTIVELY whenever problems are detected. Examples: Example 1: Context: A test suite…