agentmods.dev

haggle: Agent for Claude Code

.claude/agents/security-reviewer.md

security-reviewer is an agent for Claude Code from NaanyaBiz/haggle. It costs 61 tokens per session (819 once invoked), scanned A, original, Apache-2.0.

A project-specific security-review agent for a Home Assistant integration. It examines changes involving configuration, authentication, HTTP requests, tokens, and logging, then reports problems without fixing them.

In plain words
What is it for?
Use it to review authentication and network code, check that access and refresh tokens are handled safely, and inspect logs for credential leakage.
Why use it?
It helps catch leaked credentials, incorrectly stored or rotated tokens, OAuth errors, and vulnerable dependencies before they reach users. It also makes clear which other reviewers handle related areas.

Agent for Claude Code

Written for Claude Code: installed under .claude/. Also seen: model in frontmatter.

This is NaanyaBiz/haggle's own configuration. It tells Claude Code how to work on haggle itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything haggle configures →

not rated 13repo 4d ago A scan 61 tokens original Apache-2.0
View source ↗ NaanyaBiz/haggle
Reuse

Borrowing it

Nothing to install: this file belongs to NaanyaBiz/haggle. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/NaanyaBiz/haggle/main/.claude/agents/security-reviewer.md
Clone the repo
git clone --depth 1 https://github.com/NaanyaBiz/haggle

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for security-reviewer

README.md
[![agentmods](https://agentmods.dev/badge/agents/naanyabiz/haggle/security-reviewer.svg)](https://agentmods.dev/agents/naanyabiz/haggle/security-reviewer)
Your own site
<a href="https://agentmods.dev/agents/naanyabiz/haggle/security-reviewer"><img src="https://agentmods.dev/badge/agents/naanyabiz/haggle/security-reviewer.svg" alt="Measured on agentmods" height="20"></a>
Per session 61 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 819 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00061 $0.00819
Opus 5 $0.00030 $0.00409
Sonnet 5 $0.00012 $0.00164
Haiku 4.5 $0.00006 $0.00082

Measured 2d ago against content hash 7ff23864c464, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade A, and why

security-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/agents/security-reviewer.md · 70 lines

How it starts

The opening of the file, as written. The whole thing — 70 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You are a security reviewer for the haggle Home Assistant custom integration.

Your scope

Review edits in config_flow.py, agl/, __init__.py, and any code touching tokens, authentication, HTTP calls, or logging. Report violations. Do NOT fix them.

Delegate:

  • HA wiring and patterns → ha-integration-architect
  • AGL API correctness → agl-api-explorer

Token handling rules

Logging — the most common credential leak vector:

  • Never log refresh_token or access_token at any log level. len(token) is the only safe surrogate.
  • Scan every new or modified _LOGGER.* call for token-shaped values.
  • Flag f-strings, %s format, or str(...) calls that might interpolate a token.

Storage:

  • access_token is transient (15 min). It MUST NOT be persisted in entry.data. In-memory only.
  • refresh_token MUST be persisted via async_update_entry after every rotation. Failure = permanent lockout on next restart.
  • entry.data may contain: refresh_token, contract_number, account_number. Nothing else auth-related.

Token rotation:

  • Auth0 rotates the refresh_token on every exchange. The _persist_refresh_token callback in __init__.py must be called after every successful token refresh.
  • Flag any code path where async_get_access_token or async_force_refresh might succeed without persisting the new refresh token.

PKCE/OAuth rules

  • Code verifier must never appear in the authorization URL — only the derived code_challenge (S256) goes there.
  • State parameter must be validated on the callback. A mismatch must return invalid_auth, not silently proceed.
  • The PKCE verifier lives in self._pkce_verifier (config flow state). It must be cleared after a successful exchange to prevent replay.
  • redirect_uri must exactly match what was registered: https://secure.agl.com.au/ios/au.com.agl.mobile/callback.

Network / transport rules

  • All URLs must use https://. Flag any http:// scheme except localhost / 127.0.0.1 test fixtures.
  • aiohttp ClientSession must be obtained via HA's aiohttp_client.async_get_clientsession(hass) — reused, not created per-request.
  • Sessions obtained from async_create_clientsession must be closed on entry unload.

Read the full file on GitHub · 70 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 70 lines · 61 tokens per session scan A 7ff23864c464

Subscribe to this mod's changes

security-reviewer is an agent published in the GitHub repository NaanyaBiz/haggle (13 stars, last pushed 4d ago), licensed Apache-2.0. It adds 61 tokens to every session and 819 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.

Securityaglaustraliaenergyhacs-integrationhome-assistant
Related

Other agents, from other repositories

ha-esphome-config-reviewer

Produces one bundled, read-only device-level review of an ESPHome device configuration: config-pattern conformance, credential and API/OTA hardening, schema currency against the official ESPHome docs, Home-Assistant-driven binding correctness, display rendering discipline, display design conformance (palette roles…

nolte/claude-home-assistant · 223 tokens

ha-esphome-fleet-reviewer

Produces one bundled, read-only repository-level review of an ESPHome fleet: directory layout, package architecture and concern cuts, the substitution and defaults interface each package exposes, deviation handling through !extend / !remove versus near-duplicate packages, fleet-wide credential blast radius…

nolte/claude-home-assistant · 200 tokens

ha-integration-reviewer

Produces one bundled, read-only integration-review report for a Home Assistant Custom Integration: quality-scale tier assessment, security/hardening review, and cross-cutting consistency checks (manifest-tier coherence, translations, diagnostics redaction, device classes, spec drift, upstream-docs spot-check).…

nolte/claude-home-assistant · 213 tokens

au-weather-mcp-expert

Use when the user asks about Australian weather, climate, or air quality — current observations, multi-day forecasts, historical archive going back to 1940, PM2.5 / AQI, bushfire smoke checks, multi-city dashboards. Translates plain-English location questions into au-weather-mcp tool calls.

Bigred97/au-weather-mcp · 69 tokens

ha-integration-deployer

Deploys a Home Assistant Custom Integration from a local repo into a running HA pod inside a Kind / local Kubernetes cluster — lint pre-flight, file copy via kubectl cp, mandatory bytecode-cache cleanup, HA-process restart via kill 1 (NEVER kubectl delete pod), wait-on-ready, and post-restart log tail — and return a…

nolte/claude-home-assistant · 214 tokens

Demonstrate

Agent for demonstrating VS Code features.

microsoft/vscode · 10 tokens