security-auditor

security-auditor is an agent for Claude Code from nyldn/claude-octopus. It costs 20 tokens per session (397 once invoked), scanned A, original, MIT.

An AI security-auditor role for reviewing software and infrastructure for security risks, but it is intended to be used only within an Octopus workflow.

In plain words
What is it for?
Use it for threat modeling, security testing, application and cloud reviews, DevSecOps checks, and documenting practical fixes when that workflow explicitly starts it.
Why use it?
It provides a security-focused review process covering areas such as access control, authentication, cloud settings, dependencies, and compliance.

Agent for Claude Code

Part of the octo plugin — 56 skills, 77 commands, 10 agents, 2 hooks shipped together

About the project

Claude Octopus is an orchestration project that sends research, design, and coding tasks to Claude Code and other AI model providers so their results can be compared. Developers use it for multi-model work, disagreement detection, reviews, persistent context, and an optional workflow that moves from discovery through delivery. The catalogue entries are its commands, skills, agents, instructions, hooks, plugins, and settings.

nyldn/claude-octopus · 4,035 stars · on GitHub

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/nyldn/claude-octopus/security-auditor
Clone the repo
git clone --depth 1 https://github.com/nyldn/claude-octopus

Made for: Claude Code.

Or install octo, the plugin that ships this one along with the rest of its 56 skills, 77 commands, 10 agents, 2 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for security-auditor

README.md
[![agentmods](https://agentmods.dev/badge/agents/nyldn/claude-octopus/security-auditor.svg)](https://agentmods.dev/agents/nyldn/claude-octopus/security-auditor)
Your own site
<a href="https://agentmods.dev/agents/nyldn/claude-octopus/security-auditor"><img src="https://agentmods.dev/badge/agents/nyldn/claude-octopus/security-auditor.svg" alt="Measured on agentmods" height="20"></a>
Per session 20 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 397 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00020 $0.00397
Opus 5 $0.00010 $0.00198
Sonnet 5 $0.00004 $0.00079
Haiku 4.5 $0.00002 $0.00040

Measured 5d ago against content hash 2dd9b0e5f581, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

security-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/agents/security-auditor.md · 58 lines

What it actually says

You are a security auditor specializing in DevSecOps, application security, and comprehensive cybersecurity practices.

Core Expertise

  • OWASP Top 10: Broken access control, cryptographic failures, injection, insecure design
  • DevSecOps: SAST, DAST, dependency scanning, container security in CI/CD
  • Authentication: OAuth 2.0/2.1, OIDC, JWT security, mTLS, WebAuthn
  • Cloud Security: AWS/Azure/GCP security posture, IAM policies, encryption
  • Compliance: GDPR, HIPAA, PCI-DSS, SOC 2, ISO 27001, NIST

Behavioral Traits

  • Implements defense-in-depth with multiple security layers
  • Applies principle of least privilege with granular access controls
  • Never trusts user input — validates at every layer
  • Fails securely without information leakage
  • Focuses on practical, actionable fixes over theoretical risks
  • Integrates security early in the development lifecycle (shift-left)

Response Approach

  1. Assess security requirements and compliance needs
  2. Perform threat modeling to identify attack vectors
  3. Conduct comprehensive security testing
  4. Implement security controls with defense-in-depth
  5. Automate security validation in pipelines
  6. Document findings with severity, impact, and remediation

Output Contract

Return status: COMPLETE | BLOCKED | PARTIAL

COMPLETE

  • Threat Model (mandatory)
  • Vulnerabilities (with CVSS severity)
  • Compliance Status
  • Remediation Plan

BLOCKED

  • Blocker Description
  • What Was Attempted

PARTIAL

  • Completed Sections
  • Remaining Work
  • Confidence: [0-100]
Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 5d ago First seen · 58 lines · 20 tokens per session scan A 2dd9b0e5f581

Subscribe to this mod's changes

security-auditor is an agent published in the GitHub repository nyldn/claude-octopus (4,035 stars, last pushed yesterday), licensed MIT. It adds 20 tokens to every session and 397 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other agents, from other repositories

navigator.template

Navigator for REPONAME. Helps developers understand this codebase. Not task-specific — read access only, writes nothing. Your source of truth is AGENTS.md. Always read it first.

nitinjain999/platform-skills · 0 tokens

context-updater

Automatically updates stale AI context files with an AGENTS-first workflow. Update AGENTS.md as the canonical shared context, then refresh only the affected bridge files (CLAUDE.md, llms.txt, .cursorrules, .cursor/rules/.mdc, .clinerules, etc.) after structural project changes. Launch when hooks detect context drift…

littlebearapps/contextdocs · 88 tokens

clo

Orchestrates the legal domain -- assesses legal document posture, recommends actions, and delegates to legal specialist skills. Use individual legal agents for focused tasks; use this agent for cross-cutting legal strategy.

jikig-ai/soleur · 43 tokens

soleur-engineering-review-observability-coverage-reviewer

Use this agent when reviewing PRs that add server-side code (routes, server functions, Inngest functions, scripts, infra), code on a non-inspectable execution surface (agent sandbox, container readiness gate, cron worker), or code under plugins/ that executes on a customer's self-hosted CLI (observability layer 7), to…

jikig-ai/soleur · 198 tokens

soleur-engineering-review-deployment-verification-agent

Use this agent when a PR touches production data, migrations, or behavior that could silently discard or duplicate records. Produces a pre/post-deploy checklist with SQL verification queries and rollback procedures. Use data-integrity-guardian to review the migration code; use this agent to produce the deploy-day…

jikig-ai/soleur · 71 tokens

soleur-engineering-review-semgrep-sast

Use this agent when you need deterministic static analysis security scanning using semgrep. This agent complements security-sentinel by running rule-based pattern matching to catch known vulnerability signatures, hardcoded secrets, insecure function calls, and CWE patterns that LLM-based review may miss. The caller is…

jikig-ai/soleur · 93 tokens