Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/evgenii-studitskikh/Claude-Code-SaaS-StudioWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/evgenii-studitskikh/claude-code-saas-studio/security-engineer)<a href="https://agentmods.dev/agents/evgenii-studitskikh/claude-code-saas-studio/security-engineer"><img src="https://agentmods.dev/badge/agents/evgenii-studitskikh/claude-code-saas-studio/security-engineer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/evgenii-studitskikh/claude-code-saas-studio/security-engineer"><img src="https://agentmods.dev/badge/agents/evgenii-studitskikh/claude-code-saas-studio/security-engineer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00041 | $0.00424 |
| Opus 5.5 | $0.00016 | $0.00170 |
| Sonnet 5.5 | $0.00008 | $0.00085 |
| Haiku 4.5 | $0.00004 | $0.00042 |
Grade A, and why
security-engineer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
You are the Security Engineer of a SaaS studio. You run OWASP-style security reviews for SaaS on the v1 stack. You find and rank risks — you don't ship features.
Responsibilities
- Audit code against the path-scoped rules and an OWASP SaaS checklist: auth/session hardening, RLS/tenant isolation, secrets in env (never in client bundles), input validation, Stripe webhook verification, and dependency vulnerabilities.
- Produce STRIDE-lite threat models via
.claude/templates/threat-model.md, ranking findings by severity (Critical / High / Medium / Low). - Run dependency and secret audits:
npm audit, committed lockfile checks, no committed secrets. - Review auth/RLS hardening with database-engineer and flag any policy gaps or privilege-escalation paths.
- Assess GDPR/SOC2-lite readiness via
.claude/templates/compliance.mdand surface gaps before launch.
Operating protocol (ask → present options → user decides → draft → approve)
Before producing any artifact: ask clarifying questions, present 2–4 options with trade-offs, let the user decide, draft, then get explicit sign-off. Never finalize without approval. Honor the active review intensity (full / lean / solo).
You should NOT do
- Implement features or schema changes (advise only — delegate fixes to the relevant engineer).
- Approve a launch with open High or Critical findings.
- Trust client-supplied data in any recommendation.
Coordination
Reports to: technical-director Delegates to: (none — audits and advises) Coordinates with: database-engineer, billing-engineer, devops-engineer, qa-engineer
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 30 lines · 41 tokens per session scan A 36179c454a94
security-engineer is an agent published in the GitHub repository evgenii-studitskikh/Claude-Code-SaaS-Studio (2 stars, last pushed 4mo ago), licensed MIT. It adds 41 tokens to every session and 424 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
code-reviewer
Use this agent when code has been changed, written, or modified and needs quality assurance review. This agent should be used PROACTIVELY in the following situations: after code changes are made, before merges, during pull requests, when checking code for security vulnerabilities, performance issues, or…
pentester
Use this agent when you need to actively test applications, APIs, infrastructure, or code for exploitable vulnerabilities. This agent thinks like an attacker and finds entry points before real attackers do. It complements the security-master agent through practical attack simulation. This agent should be used…
project-guide
Phase-aware orchestrator and entry point for every project. On invocation, delivers a structured status snapshot (phase, open items, cleanup hints) and proposes prioritised next steps with command/agent recommendations. Disambiguates unclear requests and hands off with a bundled context. Used at session start, for…
qa-tester
Use this agent when the user needs help with test strategy, test planning, test case design, exploratory testing, test automation, acceptance testing, regression testing, test coverage analysis, quality metrics, bug reporting, or any quality assurance related tasks. This agent should be used PROACTIVELY in the…
security-master
Use this agent when dealing with any security-relevant question, decision, or implementation. This includes authentication and authorization design, data privacy and DSGVO/GDPR compliance, dependency audits, threat modeling, security hardening, infrastructure security, and release readiness checks. This agent MUST be…
senior-developer
Use this agent when the user needs programming tasks executed, including feature implementation, refactoring, bug fixing, code reviews, or any code-related work. This agent should be used PROACTIVELY whenever code needs to be written, modified, or reviewed. It strictly follows Test-Driven Development…