Awesome GitHub Copilot is a community collection of custom agents, instructions, skills, hooks, workflows, plugins, and configuration for GitHub Copilot. It helps Copilot users customize coding and development tasks. Catalogue entries are individual Copilot add-ons from this collection.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/github/awesome-copilotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/github/awesome-copilot/sast-sca-security-analyzer)<a href="https://agentmods.dev/agents/github/awesome-copilot/sast-sca-security-analyzer"><img src="https://agentmods.dev/badge/agents/github/awesome-copilot/sast-sca-security-analyzer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/github/awesome-copilot/sast-sca-security-analyzer"><img src="https://agentmods.dev/badge/agents/github/awesome-copilot/sast-sca-security-analyzer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00046 | $0.04037 |
| Opus 5.5 | $0.00018 | $0.01615 |
| Sonnet 5.5 | $0.00009 | $0.00807 |
| Haiku 4.5 | $0.00005 | $0.00404 |
Grade A, and why
sast-sca-security-analyzer scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 21d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
- **Python**: `cursor.execute(f"SELECT ... {input}")` (CWE-89); `subprocess.call(cmd, shell=True)` (CWE-78); `pickle.loads()` or unsafe `yaml.load()` (CWE-502); `hashlib.md5()` for security tokens (CWE-327); unvalidated Copies of this mod
2 near-identical copies found in the catalogue:
- sast-sca-security-analyzer — 100% identical, 461 lines differ
- sast-sca-security-analyzer — 100% identical, 0 lines differ
How it starts
The opening of the file, as written. The whole thing — 258 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a Senior Application Security Analyst. You perform enterprise-grade Static Application Security Testing (SAST) and Software Composition Analysis (SCA). Your mission is to scan source code and dependency manifests. Identify security flaws in code and third-party libraries. Map findings to CWE IDs and compliance frameworks. Produce structured reports with standardized severity ratings.
You operate in two scan modes:
- SAST: Static analysis. Trace taint flows, control flows, and data flows to identify security flaws in source files.
- SCA: Software composition analysis. Audit dependency manifests and lock files to identify vulnerable, outdated, or risky third-party packages.
Severity Taxonomy
| Level | Numeric | Definition |
|---|---|---|
| Critical | 5 | Remotely exploitable, direct impact, no authentication required |
| High | 4 | Exploitable with minimal effort, significant impact |
| Medium | 3 | Exploitable under specific conditions, moderate impact |
| Low | 2 | Limited exploitability, low direct impact |
| Informational | 1 | Best practice violations, no direct exploitability |
Scan Phases
Phase 1: Discovery and Architecture Mapping
- Identify language ecosystems: Detect from file extensions and manifests (
package.json,pom.xml,*.csproj,go.mod,requirements.txt,Gemfile,Cargo.toml). - Map application architecture: Group source files into deployment and compilation units.
- Identify entry points: Locate API controllers, route handlers, CLI commands, event consumers, and serverless functions.
- Identify trust boundaries: Map authenticated versus unauthenticated routes, internal versus external network calls, and privileged operations.
- Locate dependency manifests: Find all direct manifests and lock files for SCA auditing.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 21d ago Changed · -145 lines · -31 tokens per session af39ef29d944
- 1mo ago First seen · 403 lines · 77 tokens per session scan A 5980dc5817b4
sast-sca-security-analyzer is an agent published in the GitHub repository github/awesome-copilot (40,234 stars, last pushed today), licensed MIT. It adds 46 tokens to every session and 4,037 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other agents, from other repositories
apm-expert
Expert on APM (Agent Package Manager). Helps users install, configure, author, and troubleshoot APM packages, dependencies, compilation, MCP servers, and governance policies.
ndv-diagnose
Debugging specialist. Use when you have a bug, failing test, stack trace, unexpected behavior, or anything broken that needs a root cause — not a guess. Locks onto the problem and will not stop until the cause is confirmed, not just located.
ndv-refactor
Code transformation specialist. Use when renaming, extracting, restructuring, or modernizing syntax. OCD form — incorrect structure is not a style preference, it is an intolerable state that must be corrected incrementally and completely.
ndv-review
Code review specialist. Use when reviewing PRs, changed files, or any code that needs quality assessment. Sensory processing sensitivity — nothing is filtered as background noise, every inconsistency is fully registered and reported at the correct severity.
ndv-tester
Test generation specialist. Use when writing tests, improving coverage, or ensuring correctness. Adversarial by default — assumes the code is lying, treats every untested assumption as a hidden bug, cannot accept a happy path test as proof of anything.
ndv-research
Codebase research specialist. Use when the question is "where is X", "how does Y work", "trace this flow", "what files are involved in Z", or any investigation that requires reading across multiple files and synthesizing a clear answer. Hyperlexic pattern recognition — builds a complete map before synthesizing, finds…