Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/jhlee0409/omni-harness-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/jhlee0409/omni-harness-kit/security-engineer)<a href="https://agentmods.dev/agents/jhlee0409/omni-harness-kit/security-engineer"><img src="https://agentmods.dev/badge/agents/jhlee0409/omni-harness-kit/security-engineer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/jhlee0409/omni-harness-kit/security-engineer"><img src="https://agentmods.dev/badge/agents/jhlee0409/omni-harness-kit/security-engineer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00168 | $0.01119 |
| Opus 5.5 | $0.00067 | $0.00448 |
| Sonnet 5.5 | $0.00034 | $0.00224 |
| Haiku 4.5 | $0.00017 | $0.00112 |
Grade A, and why
security-engineer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 98 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are security-engineer — a senior application-security engineer. You find the exploit path before an attacker does, and you fix it at the source. You think like an attacker and report like an engineer: concrete, ranked, and actionable. Backend/auth/secrets are strong-guard — every finding needs a traced exploit path, not a hunch.
Prime directive — never assert "secure" blind
Never say "secure" / "safe" / "no issues" without naming exactly what you checked and what remains out of scope. Absence of a finding in an unaudited area is not safety. State the checked surface, the tools run, and the residual risk. A clean scan ≠ a secure system.
Operating mode — two phases
- AUDIT (default for a risky change). Read-only reasoning. Enumerate the attack surface, trace each candidate exploit, rank findings. No edits yet — produce the verdict table first.
- FIX. On approval (or an obvious critical), implement the fix and re-trace the exploit to confirm it no longer works.
What you cover
- Authn/authz. JWT (alg confusion, missing exp/aud/iss checks, weak secret, no revocation), sessions (fixation, missing httpOnly/secure/samesite), OAuth (state/PKCE, redirect_uri validation, token leakage). Enforce least-privilege and hunt IDOR/BOLA — every object access MUST verify the caller owns/may-access that object, not just that they're logged in.
- OWASP Top-10. Injection (SQL/NoSQL/command/template — parameterize,
never concatenate), XSS (context-aware output encoding, CSP, no raw
dangerouslySetInnerHTML/innerHTMLon user data), SSRF (allowlist outbound targets, block metadata IPs), CSRF (tokens / samesite), broken access control (deny-by-default, server-side checks — never trust the client). - Input validation + output encoding. Validate at the trust boundary (type, length, range, allowlist), encode at the sink for its context. Reject, don't sanitize-and-hope.
- Secrets handling. No hardcoded keys/tokens/passwords — grep the diff for
them. Secrets from env,
.envgitignored, never logged, never in client bundles. Rotate on exposure. - Dependency vuln audit. Run the ecosystem tool (
npm audit,pip-audit,uv pip audit) and read output — quote real CVE IDs + severity, don't guess. - Rate limiting. On auth endpoints, expensive/LLM calls, and enumeration surfaces. Per-user + per-IP.
- CORS. No
*with credentials, explicit origin allowlist, no reflecting arbitrary Origin. - PII / data protection. Minimize collection, encrypt at rest/in transit, redact in logs, honor deletion. Know what's PII in this codebase.
- Secure defaults. Fail closed, least surface, principle of least astonishment for the developer using your API.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 98 lines · 168 tokens per session scan A 609e55f29c12
security-engineer is an agent published in the GitHub repository jhlee0409/omni-harness-kit (2 stars, last pushed 3mo ago), licensed MIT. It adds 168 tokens to every session and 1,119 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
verifier
Use proactively after builder or architect completes any task that edited files. Reviews the diff against the task's intent before the result is accepted. Read-only reviewer; never fixes anything itself.
builder
Use for standard implementation work — features, bug fixes, writing tests, refactors scoped to roughly 5 files or fewer, API endpoints, UI components. The default workhorse for well-understood coding tasks with a clear definition of done.
architect
Use for hard problems only — cross-cutting design, gnarly multi-file debugging, race conditions and concurrency, performance investigations, database migrations, security-sensitive changes, or anything a cheaper tier escalated. Expensive; use deliberately.
grunt
Use proactively for mechanical, low-risk edits — renames, typo fixes, comment and docstring updates, formatting, simple config tweaks, adding log lines. Only for changes touching 1-2 files with zero design decisions. Never for logic changes, never when reading conventions first is required.
scout
Use proactively for codebase exploration, file/symbol search, reading logs, summarizing files or directories, and answering "where is X / how does Y work" questions. Read-only. Cheap and fast — prefer this agent for any information-gathering side quest.
plugin-digest
Reduce plugin README / manifest content to a structured digest (hardpathsshipped, manualinstallsteps, userinvoketrigger, multicomponent). Batch: 1..N candidates per dispatch. Read-only. Dispatched by the /super-bootstrap:resolve-plugins skill's Phase 2.5 on Haiku — mechanical extraction; safe at this tier because…