Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/morodomi/dev-crewWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/morodomi/dev-crew/sca-attacker)<a href="https://agentmods.dev/agents/morodomi/dev-crew/sca-attacker"><img src="https://agentmods.dev/badge/agents/morodomi/dev-crew/sca-attacker/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/morodomi/dev-crew/sca-attacker"><img src="https://agentmods.dev/badge/agents/morodomi/dev-crew/sca-attacker.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00031 | $0.00901 |
| Opus 5.5 | $0.00012 | $0.00360 |
| Sonnet 5.5 | $0.00006 | $0.00180 |
| Haiku 4.5 | $0.00003 | $0.00090 |
Grade A, and why
sca-attacker scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s -X POST https://api.osv.dev/v1/querybatch \ How it starts
The opening of the file, as written. The whole thing — 99 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Detection Targets
| File | Ecosystem | Parse Method |
|---|---|---|
| package.json | npm | JSON parse, dependencies/devDependencies |
| package-lock.json | npm | JSON parse, packages |
| composer.json | Packagist | JSON parse, require/require-dev |
| composer.lock | Packagist | JSON parse, packages |
| requirements.txt | PyPI | Line parse, package==version |
| Pipfile.lock | PyPI | JSON parse, default/develop |
| Gemfile.lock | RubyGems | Text parse, gem (version) |
| go.mod | Go | Text parse, require lines |
OSV API Integration
- Endpoint:
POST https://api.osv.dev/v1/querybatch - Request Format:
{ "queries": [ { "package": { "name": "lodash", "ecosystem": "npm" }, "version": "4.17.0" } ] } - Batch Size: Max 100 queries per request (recommended)
HTTP Execution
curl -s -X POST https://api.osv.dev/v1/querybatch \
-H "Content-Type: application/json" \
-d '{"queries":[{"package":{"name":"lodash","ecosystem":"npm"},"version":"4.17.0"}]}'
Version Resolution Strategy
| Pattern | Strategy |
|---|---|
1.0.0 (exact) |
Use directly |
^1.0.0 (caret) |
Extract base version (1.0.0) |
~1.0.0 (tilde) |
Extract base version (1.0.0) |
>=1.0.0 (range) |
Extract base version (1.0.0) |
*, latest |
Skip with warning |
| Lock file available | Prefer lock file version |
Priority: lock file > exact version > range base
Fallback Strategy
- OSV API timeout (10s) → Exponential backoff (3回: 2s, 4s, 8s)
- OSV API error → Report as "api-unavailable", continue scan
- Offline mode → Not supported (require API)
| Attempt | Delay | Total Wait |
|---|---|---|
| 1st retry | 2s | 2s |
| 2nd retry | 4s | 6s |
| 3rd retry | 8s | 14s |
Max total wait: 14s + timeout (10s) = 24s per batch
Output
Base: {metadata: {scan_id, scanned_at, agent}, vulnerabilities: [{id, type, vulnerability_class, cwe_id, severity, file, line, code, description, remediation}], summary: {total, critical, high, medium, low}}
Extra: prefix=SCA, types=vulnerable-dependency, extra_fields={package, version, ecosystem, osv_ids, dev}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 99 lines · 31 tokens per session scan A f2f4f78a6d90
sca-attacker is an agent published in the GitHub repository morodomi/dev-crew (1 stars, last pushed yesterday), licensed MIT. It adds 31 tokens to every session and 901 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
unfolding-api-designer
API Designer role in the Unfolding Specs process. Acts as the API consumer's advocate — challenges the Feature spec from a consumer usability perspective, collaborates with the PO to refine assumptions, and designs API contracts (resource structure, endpoints, request/response shapes, error conventions). Commissioned…
elite-developer
Principal Full-Stack Engineer. Deterministic implementation engine. Master of TDD, formal verification, and architectural minimalism.
cascade-worker
Implements code changes in a single service. Called by cascade-orchestrator with a specific service path and change description. Follows TDD when test infrastructure exists. Does NOT update contracts.
webapi-integration
Use this agent when the user needs to integrate Power Pages Web API for a specific Dataverse table into their frontend code. Trigger examples: "integrate web api for products table", "add api calls for orders", "connect my site to the blog posts table", "implement crud for categories", "set up web api client", "create…
otp-advisor
OTP patterns specialist - GenServer, Supervisor, Agent, Task, Registry, ETS. Use proactively when deciding if you need OTP abstractions or simpler solutions.
do-setup-assistant
Autonomous Durable Objects project scaffolder. Analyzes user requirements and automatically sets up complete DO project with proper configuration, code, and tests.