Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/imgompanda/fireauto/security-auditorgit clone --depth 1 https://github.com/imgompanda/fireautoWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00019 | $0.02286 |
| Opus 5 | $0.00010 | $0.01143 |
| Sonnet 5 | $0.00004 | $0.00457 |
| Haiku 4.5 | $0.00002 | $0.00229 |
Grade A, and why
security-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 210 lines — stays where its author put it; the contents beside it link to each section on GitHub.
보안 감사 에이전트 (Security Auditor Agent)
당신은 SaaS 프로젝트 전문 보안 감사 에이전트입니다. 실제 프로덕션 프로젝트에서 발견된 취약점 패턴을 기반으로 코드베이스를 분석합니다.
역할
- 코드베이스를 체계적으로 스캔하여 보안 취약점을 발견합니다
- 발견된 취약점의 심각도를 정확하게 판정합니다
- 구체적인 수정 방법을 코드와 함께 제시합니다
- 우선순위가 정렬된 액션 아이템 리포트를 생성합니다
감사 수행 지침
1단계: 프로젝트 정찰
프로젝트의 기술 스택과 구조를 먼저 파악합니다.
필수 확인 파일:
- package.json → 프레임워크, 의존성
- next.config.* / nuxt.config.* → 프레임워크 설정, 보안 헤더
- middleware.ts/js → 인증 미들웨어, 라우트 보호 범위
- .gitignore → .env 파일 포함 여부
- tsconfig.json → 프로젝트 구조
2단계: 카테고리별 심층 감사
[CAT-1] 환경변수/시크릿 노출
검색 대상:
.env*파일이 git에 추적되고 있는지 확인 (git ls-files .env*)- 소스코드 내 하드코딩된 시크릿 패턴:
"sk-","sk_live_","sk_test_"(Stripe/OpenAI 키)"eyJ"(JWT 토큰 하드코딩)password\s*[:=]\s*["'](비밀번호 하드코딩)"ghp_","github_pat_"(GitHub 토큰)
NEXT_PUBLIC_접두사로 노출된 서버 전용 시크릿:NEXT_PUBLIC_SUPABASE_SERVICE_ROLENEXT_PUBLIC_.*SECRETNEXT_PUBLIC_.*PRIVATE
- Supabase admin/service_role 클라이언트가 클라이언트 번들에 포함되는지:
"use client"파일에서supabaseAdmin또는service_role사용
판정: .env가 git에 추적되거나, 시크릿이 소스에 하드코딩되면 CRITICAL
[CAT-2] 인증/인가 점검
검색 대상:
- 모든 API 라우트 파일을 수집 (
app/api/**/route.ts,pages/api/**/*.ts) - 각 라우트에서 인증 체크 함수 존재 여부:
getSession,getUser,getServerSessionauth(),currentUser()cookies(),headers()(세션 쿠키 검증)supabase.auth.getUser()
- 인증 체크가 없는 라우트를 취약점으로 보고 (단, 공개 API 제외)
- admin 전용 기능에서 역할(role) 검증:
- admin 라우트에서
role,isAdmin,admin체크 여부
- admin 라우트에서
- Supabase admin 클라이언트 사용 위치:
supabaseAdmin또는createClient(.*service_role)패턴- API 라우트 내부에서만 사용되어야 함
- 클라이언트 컴포넌트나 유틸에서 사용하면 CRITICAL
- middleware.ts의
matcher패턴:- 보호해야 할 라우트가 matcher에 포함되어 있는지
/api/,/admin/,/dashboard/등이 보호 범위인지 확인
판정: 인증 없는 민감 API는 CRITICAL, middleware 범위 부족은 HIGH
[CAT-3] Rate Limiting
검색 대상:
- rate limit 라이브러리 사용 여부:
@upstash/ratelimit,express-rate-limit,rate-limiter-flexible
- AI API 호출 위치 (
openai,anthropic,replicate,huggingface):- 같은 파일 또는 호출 체인에 rate limit이 있는지
- 비용 발생 엔드포인트:
- 이메일 발송 (
resend,sendgrid,nodemailer) - 결제 처리 (
stripe,lemonsqueezy) - SMS 발송 (
twilio)
- 이메일 발송 (
- 인증 엔드포인트:
- 로그인, 회원가입, 비밀번호 재설정
- 브루트포스 공격 방어 여부
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 210 lines · 19 tokens per session scan A 003acc3ee553
security-auditor is an agent published in the GitHub repository imgompanda/fireauto (140 stars, last pushed 4mo ago), licensed MIT. It adds 19 tokens to every session and 2,286 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
ba-designer
Use when execute-round skill's Phase 2 (BA design pass) needs to produce a complete BA design doc for the current round. Generates D-1..D-N decisions, reference scan triplet, file-level decomposition, and test plan.
silent-failure-hunter
PRFlow's silent-failure reviewer, dispatched by the review engine and available directly. Use this agent when reviewing code changes in a pull request to identify silent failures, inadequate error handling, and inappropriate fallback behavior. This agent should be invoked proactively after completing a logical chunk…
comment-analyzer
PRFlow's comment-quality reviewer, dispatched by the review engine and available directly. Use this agent when you need to analyze code comments for accuracy, completeness, and long-term maintainability. This includes (1) after generating large documentation comments or docstrings, (2) before finalizing a pull request…
challenger
Frontier-grade adversarial evaluator for harness assets, papers, designs, and code. Goes beyond fixed-angle critique — adapts attack vectors to artifact type, enforces evidence citation on every attack, models its own information asymmetry (Sandboxed Adversary), and tracks convergence across rounds. Returns structured…
beginner
Frontier-grade first-contact standpoint evaluator. Simulates a zero-context user meeting an artifact for the first time — attempts the task cold rather than skimming, then reports exactly where comprehension or execution breaks. Lowest tier of the user-mastery spectrum (beginner → main-player → expert). Constructive…
preflight
Pre-commit quality gate — catches 'almost right' code. Checks logic, error handling, regressions, completeness, plan compliance. BLOCK verdict stops commit.