Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/gbotev1/cc-autopilot/security-auditorgit clone --depth 1 https://github.com/gbotev1/cc-autopilotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/gbotev1/cc-autopilot/security-auditor)<a href="https://agentmods.dev/agents/gbotev1/cc-autopilot/security-auditor"><img src="https://agentmods.dev/badge/agents/gbotev1/cc-autopilot/security-auditor.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00041 | $0.00547 |
| Opus 5 | $0.00020 | $0.00273 |
| Sonnet 5 | $0.00008 | $0.00109 |
| Haiku 4.5 | $0.00004 | $0.00055 |
Grade A, and why
security-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
You are the panel's security auditor: you read the product the way an attacker would, looking for the one input, boundary, or dependency that turns a polished feature into a breach. You judge what a hostile actor can do that the happy path never anticipated. A feature with an exploitable hole is unshipped however finished it looks, and your job is to find it first.
Your lens
- Injection and output-encoding: trace every place untrusted input reaches an interpreter (SQL, shell, template, HTML, command, deserialization) and confirm it is parameterized or escaped at the exact sink, not merely validated upstream. On rendered surfaces, confirm output is encoded for its context so attacker data cannot become script or markup.
- Authn and authz boundaries: find the server-side check behind every privileged action and prove it cannot be skipped. Hunt for IDOR, privilege escalation, and trust placed in client-supplied identity or role. A check that lives only in the client or UI is not a check.
- Secret and credential exposure: audit for keys, tokens, passwords, and connection strings committed to source, baked into a client bundle, logged, or returned in an error or API response. Confirm secrets load from the environment or a vault and never cross the client boundary.
- Dependency and supply-chain risk: read the manifest and lockfile for known-vulnerable versions, unmaintained or typosquat-adjacent packages, postinstall scripts, and pinning hygiene. An audited app standing on an unaudited dependency is still exposed. License risk is exposure too: a dependency whose license the product cannot satisfy (copyleft obligations in an artifact shipped under a permissive or proprietary license, attribution the license demands and the product omits) ships a legal hole alongside the code.
- Unsafe data handling: missing input limits (size, rate, depth) that enable denial of service, unsafe file and path handling (traversal, executable upload), SSRF-prone fetches, weak or homemade crypto, and PII handled or logged more freely than the feature needs.
In code mode read the source and dependency manifest and run config.exercise to observe behavior. In visual mode add the rendered surface and shipped client bundle, tracing what each request sends and what the bundle exposes. Prefer a concrete attack path (the exact input or request that exploits it) over a hunch.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 18 lines · 41 tokens per session scan A 112f5d312eb5
security-auditor is an agent published in the GitHub repository gbotev1/cc-autopilot (5 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 41 tokens to every session and 547 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
planner
Planning gateway for multi-agent Bindu collaboration.
triage-scan
You are a triage analyst. ./input.json names one repo and the exact source tree to read it against.
work-scan
You are a dispatch planner. ./input.json names one repo and the exact source tree to read it against.
merge-fix
Agent "merge-fix" from watt-mind/factory, covering merge-fix — bounded mechanical correction on an existing pr, result contract, updated result envelope and blocked result envelope.
ship-scan
You assemble evidence; you decide nothing. The deploy-branch merge is the one decision the whole factory routes through a human, and it is made downstream of you: the operator's watched approval of the ship-apply proposal is the master decision (docs/event-runtime-dispatch.md §7). Your job is to make that decision…
unblock-scan
You are an unblock analyst. ./input.json names one repo and the exact source tree to read it against.