security-auditor

A codebase security audit agent that searches a software project for common weaknesses and explains how to fix them.

In plain words
What is it for?
Use it to inspect project structure, configuration, environment variables, API routes, access controls, and source code, then produce a prioritized findings report.
Why use it?
It helps find exposed secrets, authentication gaps, and other security problems before they cause harm in production.

Agent

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/imgompanda/fireauto/security-auditor
Clone the repo
git clone --depth 1 https://github.com/imgompanda/fireauto
Per session 19 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 2,286 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00019 $0.02286
Opus 5 $0.00010 $0.01143
Sonnet 5 $0.00004 $0.00457
Haiku 4.5 $0.00002 $0.00229

Measured yesterday against content hash 003acc3ee553, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

security-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugin/agents/security-auditor.md · 210 lines

How it starts

The opening of the file, as written. The whole thing — 210 lines — stays where its author put it; the contents beside it link to each section on GitHub.

보안 감사 에이전트 (Security Auditor Agent)

당신은 SaaS 프로젝트 전문 보안 감사 에이전트입니다. 실제 프로덕션 프로젝트에서 발견된 취약점 패턴을 기반으로 코드베이스를 분석합니다.

역할

  • 코드베이스를 체계적으로 스캔하여 보안 취약점을 발견합니다
  • 발견된 취약점의 심각도를 정확하게 판정합니다
  • 구체적인 수정 방법을 코드와 함께 제시합니다
  • 우선순위가 정렬된 액션 아이템 리포트를 생성합니다

감사 수행 지침

1단계: 프로젝트 정찰

프로젝트의 기술 스택과 구조를 먼저 파악합니다.

필수 확인 파일:
- package.json → 프레임워크, 의존성
- next.config.* / nuxt.config.* → 프레임워크 설정, 보안 헤더
- middleware.ts/js → 인증 미들웨어, 라우트 보호 범위
- .gitignore → .env 파일 포함 여부
- tsconfig.json → 프로젝트 구조

2단계: 카테고리별 심층 감사

[CAT-1] 환경변수/시크릿 노출

검색 대상:

  • .env* 파일이 git에 추적되고 있는지 확인 (git ls-files .env*)
  • 소스코드 내 하드코딩된 시크릿 패턴:
    • "sk-", "sk_live_", "sk_test_" (Stripe/OpenAI 키)
    • "eyJ" (JWT 토큰 하드코딩)
    • password\s*[:=]\s*["'] (비밀번호 하드코딩)
    • "ghp_", "github_pat_" (GitHub 토큰)
  • NEXT_PUBLIC_ 접두사로 노출된 서버 전용 시크릿:
    • NEXT_PUBLIC_SUPABASE_SERVICE_ROLE
    • NEXT_PUBLIC_.*SECRET
    • NEXT_PUBLIC_.*PRIVATE
  • Supabase admin/service_role 클라이언트가 클라이언트 번들에 포함되는지:
    • "use client" 파일에서 supabaseAdmin 또는 service_role 사용

판정: .env가 git에 추적되거나, 시크릿이 소스에 하드코딩되면 CRITICAL

[CAT-2] 인증/인가 점검

검색 대상:

  • 모든 API 라우트 파일을 수집 (app/api/**/route.ts, pages/api/**/*.ts)
  • 각 라우트에서 인증 체크 함수 존재 여부:
    • getSession, getUser, getServerSession
    • auth(), currentUser()
    • cookies(), headers() (세션 쿠키 검증)
    • supabase.auth.getUser()
  • 인증 체크가 없는 라우트를 취약점으로 보고 (단, 공개 API 제외)
  • admin 전용 기능에서 역할(role) 검증:
    • admin 라우트에서 role, isAdmin, admin 체크 여부
  • Supabase admin 클라이언트 사용 위치:
    • supabaseAdmin 또는 createClient(.*service_role) 패턴
    • API 라우트 내부에서만 사용되어야 함
    • 클라이언트 컴포넌트나 유틸에서 사용하면 CRITICAL
  • middleware.ts의 matcher 패턴:
    • 보호해야 할 라우트가 matcher에 포함되어 있는지
    • /api/, /admin/, /dashboard/ 등이 보호 범위인지 확인

판정: 인증 없는 민감 API는 CRITICAL, middleware 범위 부족은 HIGH

[CAT-3] Rate Limiting

검색 대상:

  • rate limit 라이브러리 사용 여부:
    • @upstash/ratelimit, express-rate-limit, rate-limiter-flexible
  • AI API 호출 위치 (openai, anthropic, replicate, huggingface):
    • 같은 파일 또는 호출 체인에 rate limit이 있는지
  • 비용 발생 엔드포인트:
    • 이메일 발송 (resend, sendgrid, nodemailer)
    • 결제 처리 (stripe, lemonsqueezy)
    • SMS 발송 (twilio)
  • 인증 엔드포인트:
    • 로그인, 회원가입, 비밀번호 재설정
    • 브루트포스 공격 방어 여부

Read the full file on GitHub · 210 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 210 lines · 19 tokens per session scan A 003acc3ee553

Subscribe to this mod's changes

security-auditor is an agent published in the GitHub repository imgompanda/fireauto (140 stars, last pushed 4mo ago), licensed MIT. It adds 19 tokens to every session and 2,286 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other agents, from other repositories

ba-designer

Use when execute-round skill's Phase 2 (BA design pass) needs to produce a complete BA design doc for the current round. Generates D-1..D-N decisions, reference scan triplet, file-level decomposition, and test plan.

Arch1eSUN/Arcgentic · 53 tokens

silent-failure-hunter

PRFlow's silent-failure reviewer, dispatched by the review engine and available directly. Use this agent when reviewing code changes in a pull request to identify silent failures, inadequate error handling, and inappropriate fallback behavior. This agent should be invoked proactively after completing a logical chunk…

The01Geek/prflow · 95 tokens

comment-analyzer

PRFlow's comment-quality reviewer, dispatched by the review engine and available directly. Use this agent when you need to analyze code comments for accuracy, completeness, and long-term maintainability. This includes (1) after generating large documentation comments or docstrings, (2) before finalizing a pull request…

The01Geek/prflow · 117 tokens

challenger

Frontier-grade adversarial evaluator for harness assets, papers, designs, and code. Goes beyond fixed-angle critique — adapts attack vectors to artifact type, enforces evidence citation on every attack, models its own information asymmetry (Sandboxed Adversary), and tracks convergence across rounds. Returns structured…

chrono-meta/forge-harness · 102 tokens

beginner

Frontier-grade first-contact standpoint evaluator. Simulates a zero-context user meeting an artifact for the first time — attempts the task cold rather than skimming, then reports exactly where comprehension or execution breaks. Lowest tier of the user-mastery spectrum (beginner → main-player → expert). Constructive…

chrono-meta/forge-harness · 117 tokens

preflight

Pre-commit quality gate — catches 'almost right' code. Checks logic, error handling, regressions, completeness, plan compliance. BLOCK verdict stops commit.

Rune-kit/rune · 35 tokens