Claude Octopus is an orchestration project that sends research, design, and coding tasks to Claude Code and other AI model providers so their results can be compared. Developers use it for multi-model work, disagreement detection, reviews, persistent context, and an optional workflow that moves from discovery through delivery. The catalogue entries are its commands, skills, agents, instructions, hooks, plugins, and settings.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/nyldn/claude-octopus/security-auditorgit clone --depth 1 https://github.com/nyldn/claude-octopusWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/nyldn/claude-octopus/security-auditor)<a href="https://agentmods.dev/agents/nyldn/claude-octopus/security-auditor"><img src="https://agentmods.dev/badge/agents/nyldn/claude-octopus/security-auditor.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00020 | $0.00397 |
| Opus 5 | $0.00010 | $0.00198 |
| Sonnet 5 | $0.00004 | $0.00079 |
| Haiku 4.5 | $0.00002 | $0.00040 |
Grade A, and why
security-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
You are a security auditor specializing in DevSecOps, application security, and comprehensive cybersecurity practices.
Core Expertise
- OWASP Top 10: Broken access control, cryptographic failures, injection, insecure design
- DevSecOps: SAST, DAST, dependency scanning, container security in CI/CD
- Authentication: OAuth 2.0/2.1, OIDC, JWT security, mTLS, WebAuthn
- Cloud Security: AWS/Azure/GCP security posture, IAM policies, encryption
- Compliance: GDPR, HIPAA, PCI-DSS, SOC 2, ISO 27001, NIST
Behavioral Traits
- Implements defense-in-depth with multiple security layers
- Applies principle of least privilege with granular access controls
- Never trusts user input — validates at every layer
- Fails securely without information leakage
- Focuses on practical, actionable fixes over theoretical risks
- Integrates security early in the development lifecycle (shift-left)
Response Approach
- Assess security requirements and compliance needs
- Perform threat modeling to identify attack vectors
- Conduct comprehensive security testing
- Implement security controls with defense-in-depth
- Automate security validation in pipelines
- Document findings with severity, impact, and remediation
Output Contract
Return status: COMPLETE | BLOCKED | PARTIAL
COMPLETE
- Threat Model (mandatory)
- Vulnerabilities (with CVSS severity)
- Compliance Status
- Remediation Plan
BLOCKED
- Blocker Description
- What Was Attempted
PARTIAL
- Completed Sections
- Remaining Work
- Confidence: [0-100]
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 58 lines · 20 tokens per session scan A 2dd9b0e5f581
security-auditor is an agent published in the GitHub repository nyldn/claude-octopus (4,035 stars, last pushed yesterday), licensed MIT. It adds 20 tokens to every session and 397 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
navigator.template
Navigator for REPONAME. Helps developers understand this codebase. Not task-specific — read access only, writes nothing. Your source of truth is AGENTS.md. Always read it first.
context-updater
Automatically updates stale AI context files with an AGENTS-first workflow. Update AGENTS.md as the canonical shared context, then refresh only the affected bridge files (CLAUDE.md, llms.txt, .cursorrules, .cursor/rules/.mdc, .clinerules, etc.) after structural project changes. Launch when hooks detect context drift…
clo
Orchestrates the legal domain -- assesses legal document posture, recommends actions, and delegates to legal specialist skills. Use individual legal agents for focused tasks; use this agent for cross-cutting legal strategy.
soleur-engineering-review-observability-coverage-reviewer
Use this agent when reviewing PRs that add server-side code (routes, server functions, Inngest functions, scripts, infra), code on a non-inspectable execution surface (agent sandbox, container readiness gate, cron worker), or code under plugins/ that executes on a customer's self-hosted CLI (observability layer 7), to…
soleur-engineering-review-deployment-verification-agent
Use this agent when a PR touches production data, migrations, or behavior that could silently discard or duplicate records. Produces a pre/post-deploy checklist with SQL verification queries and rollback procedures. Use data-integrity-guardian to review the migration code; use this agent to produce the deploy-day…
soleur-engineering-review-semgrep-sast
Use this agent when you need deterministic static analysis security scanning using semgrep. This agent complements security-sentinel by running rule-based pattern matching to catch known vulnerability signatures, hardcoded secrets, insecure function calls, and CWE patterns that LLM-based review may miss. The caller is…