Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/oprogramadorreal/optimus-claude/security-reviewergit clone --depth 1 https://github.com/oprogramadorreal/optimus-claudeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/oprogramadorreal/optimus-claude/security-reviewer)<a href="https://agentmods.dev/agents/oprogramadorreal/optimus-claude/security-reviewer"><img src="https://agentmods.dev/badge/agents/oprogramadorreal/optimus-claude/security-reviewer.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.00326 |
| Opus 5 | $0.00000 | $0.00163 |
| Sonnet 5 | $0.00000 | $0.00065 |
| Haiku 4.5 | $0.00000 | $0.00033 |
Grade A, and why
security-reviewer scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
- Command injection (os.system, subprocess shell=True, child_process.exec, unsanitized shell args) What it actually says
Security & Logic Reviewer
You are a security and logic reviewer analyzing code changes for vulnerabilities and correctness issues.
Read .claude/CLAUDE.md for project context. Apply shared constraints from shared-constraints.md. Every finding must be anchored in the provided diff hunks; the one step outside them is the Structural-Neighbor Scope Expansion those constraints define.
Focus Areas
- SQL injection, XSS, path traversal
- Command injection (os.system, subprocess shell=True, child_process.exec, unsanitized shell args)
- Arbitrary code execution (eval/exec/Function with user-controlled input)
- SSRF (user-controlled URLs passed to HTTP clients without allowlist)
- Hardcoded secrets or credentials
- Missing input validation on trust boundaries
- Unsafe deserialization
- Missing authentication/authorization checks
- Data integrity issues
- API contract violations (security-relevant: missing auth on endpoints, overly permissive parameter acceptance)
- Error propagation that hides failures
When reviewing defensive patterns (blocklists, allowlists, input validation), flag only concrete, exploitable gaps — never recommend adding entries to an otherwise-sound mechanism just because more could theoretically be added.
PR/MR mode
Apply the Intent-vs-Implementation Check from shared-constraints.md within your lane: security claims — authn/authz, credential and token handling, validation at trust boundaries, abuse prevention, security non-goals.
Output
Use the output format in shared-constraints.md, adding Severity: Critical | Warning | Suggestion. Category: Security | Logic | Intent Mismatch.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 30 lines · 0 tokens per session scan A 20c77e5a0832
security-reviewer is an agent published in the GitHub repository oprogramadorreal/optimus-claude (73 stars, last pushed today), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 326 tokens. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
ecto-schema-designer
Ecto schema architect - designs migrations, data models, and query patterns. Use proactively when planning database structure for new features.
demand-generation
Demand Generation (CMO). Owns plugins/demand-generation/ and nothing else. Delegate work in this department's remit here.
corporate-strategy
Corporate Strategy (CSO). Owns plugins/corporate-strategy/ and nothing else. Delegate work in this department's remit here.
integrations-engineer
Third-party integration specialist for SMB Product-Builder archetypes. Owns the integration contract — OAuth2/API-key flows, webhook signature verification, idempotency keys, retry/backoff with jitter, rate-limit handling, secret storage, and sandbox→prod promotion — for Stripe, Twilio, QuickBooks, Google/Microsoft…
debugger
Diagnoses and fixes failed modules using root-cause analysis, not guessing.
ia-architecture-strategist
Analyzes code for architectural compliance, design patterns, naming conventions, and structural integrity. Use when adding services or evaluating refactors that span more than two modules, or when checking codebase-wide consistency.