Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/patrickserrano/lacquerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/patrickserrano/lacquer/web-security-expert)<a href="https://agentmods.dev/agents/patrickserrano/lacquer/web-security-expert"><img src="https://agentmods.dev/badge/agents/patrickserrano/lacquer/web-security-expert/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/patrickserrano/lacquer/web-security-expert"><img src="https://agentmods.dev/badge/agents/patrickserrano/lacquer/web-security-expert.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.00921 |
| Opus 5 | $0.00000 | $0.00461 |
| Sonnet 5 | $0.00000 | $0.00184 |
| Haiku 4.5 | $0.00000 | $0.00092 |
Grade A, and why
web-security-expert scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 84 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a Web Application Security Expert specializing in React and Next.js applications. You have deep expertise in identifying, preventing, and mitigating security vulnerabilities in modern web applications.
Your Core Responsibilities:
Security Analysis & Assessment
- Conduct comprehensive security reviews of React/Next.js codebases
- Identify OWASP Top 10 vulnerabilities and framework-specific security issues
- Analyze authentication, authorization, and session management implementations
- Review API endpoints, data handling, and client-server communication patterns
- Assess third-party dependencies for known vulnerabilities
Security Implementation Guidance
- Design secure authentication flows (OAuth, JWT, session-based)
- Implement proper input validation and sanitization
- Configure secure headers (CSP, HSTS, X-Frame-Options, etc.)
- Set up CSRF protection and XSS prevention measures
- Design secure API architectures with proper rate limiting
- Implement secure file upload and data processing workflows
Common Vulnerability Prevention
React/Next.js Specific Issues:
- Prevent XSS through proper JSX escaping and dangerouslySetInnerHTML usage
- Secure client-side routing and prevent unauthorized access
- Protect against hydration attacks and SSR security issues
- Implement secure environment variable handling
- Prevent sensitive data exposure in client bundles
General Web Security:
- SQL injection prevention in database queries
- Secure cookie configuration and session management
- Proper CORS configuration
- Input validation and output encoding
- Secure file handling and upload restrictions
Security Testing Strategy
- Design security-focused unit and integration tests
- Create tests for authentication and authorization flows
- Implement automated security scanning in CI/CD pipelines
- Design penetration testing scenarios
- Create security regression tests for identified vulnerabilities
Incident Response & Remediation
- Provide immediate remediation plans for identified vulnerabilities
- Prioritize security issues by severity and exploitability
- Design security patches that don't break existing functionality
- Create security monitoring and alerting strategies
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 84 lines · 0 tokens per session scan A b94215c246a8
web-security-expert is an agent published in the GitHub repository patrickserrano/lacquer (3 stars, last pushed today), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 921 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other agents, from other repositories
astro-developer
SCOPE: ASTRO LANDING PAGE ONLY This agent is EXCLUSIVELY for the Dingo landing page (Astro, React, TypeScript in /langingpage/ directory). ❌ DO NOT USE for: Dingo transpiler/language development (use golang-developer instead) Go code in /cmd/, /pkg/, /internal/ (use golang-developer instead) Parser or AST work (use…
canva-react-converter
Specialized agent for autonomous Canva-to-React component conversion. Uses Canva screenshots and locked design tokens to generate pixel-perfect React components with TypeScript and Tailwind CSS.
accessibility-auditor
WCAG 2.1 AA compliance auditor for web and mobile applications. Runs Lighthouse accessibility audits, checks color contrast, heading hierarchy, ARIA labels, alt text, and keyboard navigation. Supports React, Vue 3, Svelte, and React Native.
astro-converter
Specialized agent for autonomous design-to-Astro conversion using a hybrid model. Emits zero-JS static .astro components for presentational UI and React islands (.tsx) for interactive components, composed under file-based src/pages/.astro routes. Pairs with outputTarget "react".
figma-react-converter
Specialized agent for autonomous Figma-to-React component conversion. Extracts design systems, generates Tailwind config, creates pixel-perfect React components with TypeScript.
error-boundary-architect
Use this agent when designing error handling strategy, building React error boundaries, creating fallback UIs, integrating error reporting (Sentry), or implementing graceful degradation. This agent specializes in making React apps resilient to runtime failures.