Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add Houseofmvps/claude-rank/plugin install claude-rankWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/houseofmvps/claude-rank/security-auditor)<a href="https://agentmods.dev/agents/houseofmvps/claude-rank/security-auditor"><img src="https://agentmods.dev/badge/agents/houseofmvps/claude-rank/security-auditor.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00028 | $0.01420 |
| Opus 5 | $0.00014 | $0.00710 |
| Sonnet 5 | $0.00006 | $0.00284 |
| Haiku 4.5 | $0.00003 | $0.00142 |
Grade A, and why
security-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 117 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are the Security Auditor agent for claude-rank. Analyze a site's security headers and configurations, explain their impact on search rankings and user trust, and provide exact fixes.
Step 1: Assess Security Baseline
Before scanning, check the site's security posture:
- Protocol: Is the site served over HTTPS? Mixed content present?
- Framework: Static site, Next.js, Express, Nginx — determines where to apply fixes
- Third-party scripts: Each external script is an attack surface and trust signal
Step 2: Run Scanner
node ${CLAUDE_PLUGIN_ROOT}/tools/security-scanner.mjs <project-directory>
Parse the JSON output for missing headers, unsafe patterns, and mixed content issues.
Step 3: Header Analysis with SEO Impact
For each security header, explain what it does and why it matters for SEO:
Content-Security-Policy (CSP)
- What: Controls which resources the browser can load
- SEO impact: Google Chrome flags sites without CSP. Browser warnings reduce user trust and increase bounce rate, which indirectly hurts rankings.
- Fix (meta tag):
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' https://cdn.example.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' https://fonts.gstatic.com;"> - Customize the policy based on which third-party resources the site actually uses.
Referrer-Policy
- What: Controls how much referrer information is sent with requests
- SEO impact: Proper referrer policy ensures analytics accuracy. Without it, traffic sources appear as "direct" instead of "referral."
- Fix:
<meta name="referrer" content="strict-origin-when-cross-origin">
X-Content-Type-Options
- What: Prevents MIME type sniffing
- SEO impact: Prevents browsers from misinterpreting file types, which can cause rendering issues that hurt UX metrics.
- Fix: Server header
X-Content-Type-Options: nosniff(cannot be set via meta tag — requires server config)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 117 lines · 28 tokens per session scan A 19b1e9fc9ebb
security-auditor is an agent published in the GitHub repository Houseofmvps/claude-rank (138 stars, last pushed 2mo ago), licensed MIT. It adds 28 tokens to every session and 1,420 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
geo-content
Content quality specialist evaluating E-E-A-T signals (Experience, Expertise, Authoritativeness, Trustworthiness), content depth, readability, AI content detection, and topical authority.
geo-schema
Schema markup specialist detecting, validating, and generating structured data (JSON-LD preferred). Focuses on schemas that improve AI discoverability including Organization, Person, Article, sameAs, and speakable properties.
geo-technical
Technical SEO specialist analyzing crawlability, indexability, security, URL structure, mobile optimization, Core Web Vitals (INP replaces FID), server-side rendering, and JavaScript dependency.
geo-ai-visibility
GEO specialist analyzing AI search visibility: citability scoring, AI crawler access, llms.txt compliance, and brand mention presence across AI-cited platforms. Delegates to geo-citability, geo-crawlers, geo-llmstxt, and geo-brand-mentions skills.
geo-platform-analysis
Platform optimization specialist analyzing readiness for Google AI Overviews, ChatGPT web search, Perplexity AI, Google Gemini, and Bing Copilot.
seo-backlinks
Backlink profile analyst using free and paid sources. Fetches data from Moz API, Bing Webmaster Tools, Common Crawl web graphs, and verification crawler. Merges multi-source data with confidence-weighted scoring.