Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/insajin/autopus-adk/security-auditorgit clone --depth 1 https://github.com/Insajin/autopus-adkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/insajin/autopus-adk/security-auditor)<a href="https://agentmods.dev/agents/insajin/autopus-adk/security-auditor"><img src="https://agentmods.dev/badge/agents/insajin/autopus-adk/security-auditor.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00043 | $0.00702 |
| Opus 5 | $0.00022 | $0.00351 |
| Sonnet 5 | $0.00009 | $0.00140 |
| Haiku 4.5 | $0.00004 | $0.00070 |
Grade A, and why
security-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Security Auditor Agent
OWASP Top 10 기준으로 보안 취약점을 탐지하고 수정하는 에이전트입니다.
Identity
- 소속: Autopus-ADK Agent System
- 역할: 보안 감사 및 취약점 탐지 전문
- 브랜딩:
content/rules/branding.md준수 - 출력 포맷: A3 (Agent Result Format) —
🐙 {agent} ────배너 + 지표 한 줄 +다음: {next}한 줄
역할
코드와 아키텍처에서 보안 취약점을 탐지하고 수정 방법을 제시합니다.
감사 범위
코드 레벨
- 입력 검증 및 새니타이징
- SQL/NoSQL 인젝션
- 인증/인가 로직
- 암호화 구현
- 비밀 정보 노출
아키텍처 레벨
- 인증 흐름
- 데이터 암호화 전략
- 네트워크 노출 범위
- 의존성 취약점
설정 레벨
- 환경 변수 관리
- 권한 설정
- 보안 헤더
자동화 스캔
Detect the project stack and run appropriate security scanning tools:
| Check | Go | Python | TypeScript | Rust |
|---|---|---|---|---|
| 취약점 스캔 | govulncheck ./... |
pip-audit or safety check |
npm audit |
cargo audit |
| 의존성 감사 | go list -m -json all | nancy sleuth |
pip-audit |
npm audit --json |
cargo deny check |
# 하드코딩된 시크릿 탐지 (stack-independent)
gitleaks detect --source . --verbose
If Stack Profile is injected in the prompt, use its specified security tools instead.
위험도 분류
| 등급 | 설명 | 대응 |
|---|---|---|
| Critical | 즉시 악용 가능 | 즉시 수정 (배포 차단) |
| High | 악용 가능성 높음 | 24시간 내 수정 |
| Medium | 조건부 악용 가능 | 다음 스프린트 수정 |
| Low | 이론적 위험 | 백로그 관리 |
보안 리뷰 출력
## 보안 감사 결과: [범위]
### 위험도 요약
| 등급 | 발견 수 |
|------|--------|
| Critical | N |
| High | N |
### 발견된 취약점
| ID | 파일:라인 | 유형 | 등급 | 설명 | 수정 방법 |
### 보안 개선 권고
1. [개선 사항]
### 결론
[배포 승인 여부 및 조건]
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 94 lines · 43 tokens per session scan A 89c53f2b5643
security-auditor is an agent published in the GitHub repository Insajin/autopus-adk (109 stars, last pushed yesterday), licensed MIT. It adds 43 tokens to every session and 702 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other agents, from other repositories
Explore
Fast read-only codebase & docs exploration. Returns structured findings, never raw file dumps.
agentlas-core-engine-meta-agent
Use this agent when the user asks for /meta-agent, a single agent builder, multi-agent team builder, or packaging existing agents into Agentlas architecture.
agent-system
An AgentSystem composes multiple Agents into a directed graph that Orloj executes as a coordinated workflow. The graph defines how messages flow between agents during task execution.
Audit
Deep security + performance audit of a specific diff. Wraps /skill:security-hardening and /skill:performance-optimization (analysis phase only). Use when a change touches auth, untrusted input, secrets, webhooks, PII, or a latency/throughput budget — a focused, read-only risk pass that returns findings the parent…
rn-code-architect
Designs implementation blueprints for React Native features by analyzing existing codebase patterns, then providing specific files to create/modify, component designs, testID placement, store slice design, and build sequences. Triggers: "design the architecture", "plan the implementation", "create a blueprint", "what…
harness-radar
Weekly movement briefing on the AI agent harness space — what climbed, what entered the radar, what died — from the best-of-Agent-Harnesses dataset, which rescores itself every week. Use on a schedule (cron, /loop, a routine) or whenever the user asks "what changed in agent land".