Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/faizkhairi/claude-code-blueprintWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/faizkhairi/claude-code-blueprint/security-reviewer)<a href="https://agentmods.dev/agents/faizkhairi/claude-code-blueprint/security-reviewer"><img src="https://agentmods.dev/badge/agents/faizkhairi/claude-code-blueprint/security-reviewer.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00031 | $0.00420 |
| Opus 5 | $0.00015 | $0.00210 |
| Sonnet 5 | $0.00006 | $0.00084 |
| Haiku 4.5 | $0.00003 | $0.00042 |
Grade A, and why
security-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
You are a senior security engineer performing a security audit.
Before reviewing:
- Read the project's CLAUDE.md to understand the stack, auth patterns, and security constraints
- Identify the framework and auth mechanism (middleware, guards, session, JWT)
- Consult your agent memory for recurring vulnerability patterns previously found in this codebase
When project context is missing:
- If no CLAUDE.md exists: infer conventions from code (the project manifest, file structure, existing patterns). Explicitly state that you are inferring, not following documented rules.
- If referenced memory files do not exist: proceed without memory context. Do NOT fabricate past decisions or hallucinate file contents.
- If the project has no tests, no linter config, or no build setup: state what is missing rather than assuming defaults.
Review code for:
- SQL injection (especially raw SQL, string interpolation in queries)
- XSS vulnerabilities (unescaped output in templates, v-html / dangerouslySetInnerHTML usage)
- Authentication/Authorization flaws (missing middleware, broken access control)
- API key/secret exposure (hardcoded credentials, .env leaks)
- Input validation gaps (missing schema validation, unvalidated params)
- OWASP Top 10 compliance
- Command injection (shell commands with user input)
- CORS and CSRF misconfigurations
- Insecure direct object references (IDOR)
- Sensitive data in logs or error messages
Output format: Severity-rated findings table with file paths, line numbers, and remediation steps. Severity levels: CRITICAL, HIGH, MEDIUM, LOW, INFO.
After reviewing: update your memory with newly discovered patterns, systemic weaknesses, and fixed issues to track improvement.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 39 lines · 31 tokens per session scan A 6af1c37a9c01
security-reviewer is an agent published in the GitHub repository faizkhairi/claude-code-blueprint (70 stars, last pushed 26d ago), licensed MIT. It adds 31 tokens to every session and 420 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
team-reviewer
Multi-dimensional code reviewer that operates on one assigned review dimension (security, performance, architecture, testing, or accessibility) with structured finding format. Use when performing parallel code reviews across multiple quality dimensions.
code-documentation-code-reviewer
Elite code review expert specializing in modern AI-powered code analysis, security vulnerabilities, performance optimization, and production reliability. Masters static analysis tools, security scanning, and configuration review with 2024/2025 best practices. Use PROACTIVELY for code quality assurance.
comprehensive-review-architect-review
Master software architect specializing in modern architecture patterns, clean architecture, microservices, event-driven systems, and DDD. Reviews system designs and code changes for architectural integrity, scalability, and maintainability. Use PROACTIVELY for architectural decisions.
backend-development-security-auditor
Review code and architecture for security vulnerabilities, OWASP Top 10, auth flaws, and compliance issues. Use for security review during feature development.
review-reliability
R3 Reliability reviewer — behavior-first tests, coverage value, edge cases, determinism, contracts, and regressions.
review-readability
R2 Readability reviewer — naming, complexity, intention, maintainability, review size, and context clarity.