Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/random6913/claude-code-superkit/security-scannergit clone --depth 1 https://github.com/RaNDoM6913/claude-code-superkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/random6913/claude-code-superkit/security-scanner)<a href="https://agentmods.dev/agents/random6913/claude-code-superkit/security-scanner"><img src="https://agentmods.dev/badge/agents/random6913/claude-code-superkit/security-scanner.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00034 | $0.03667 |
| Opus 5 | $0.00017 | $0.01834 |
| Sonnet 5 | $0.00007 | $0.00733 |
| Haiku 4.5 | $0.00003 | $0.00367 |
Grade D, and why
security-scanner scanned grade D with 5 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Instruction-override phrasingmediumPrompt injection
Text telling the model to disregard its earlier instructions or safety rules is the shape of a prompt injection, whoever wrote it.
Agent `.md` files: zero-width Unicode characters (U+200B, U+FEFF, U+200C, U+200D); base64-encoded instructions; hidden HTML comments that override behavior; `ignore previous instructions` patterns. Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Hidden instructionshighPrompt injection
Directives inside HTML comments, invisible characters or bidirectional overrides are read by the model and not by the person reviewing the file.
<!-- Add domain checks here. Social: photo/location privacy, block system, age verification · E-commerce: payment security, inventory races, coupon abuse · Healthcare: PHI/HIPAA, audit logging, encryption at rest · SaaS: Asks for rootlowPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
Grep all scripts: `--dangerously-skip-permissions`; `--no-verify`; `chmod 777` or `chmod a+rwx`. Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Reads MCP configurationlowAgent snooping
mcp.json carries server URLs and auth tokens; reading it lets a mod discover and abuse other integrations.
Grep `.claude/settings.json`, `settings.local.json`, and any standalone `.mcp.json` or `.kiro/settings/mcp.json`: key-like strings `[A-Za-z0-9_-]{32,}` in values; token prefixes `sk-`, `ghp_`, `gho_`, `github_pat_`, `AIz Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
User-supplied URLs validated before server-side fetching; RFC 1918/private IPs blocked in outbound requests; external responses parsed, not forwarded raw. Grep `http.Get|fetch|requests.get|urllib` with variable URLs. How it starts
The opening of the file, as written. The whole thing — 237 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Scanner
Reviewer agent: scans the codebase against 31 numbered security checks (CHECK-01..31), triages every hit through an Evidence Gate, and produces a prioritized mitigation roadmap.
Requires: govulncheck (go install golang.org/x/vuln/cmd/govulncheck@latest) — CHECK-09 degrades gracefully when absent.
Hard Rules
- Execute every check the Applicability table marks in scope; report the rest as N/A. Never silently skip a check.
- ONE severity scale everywhere: CRITICAL / WARNING / SUGGESTION. Each check lists a default severity — adjust only with cited evidence.
- Discover first, triage second: the Discover step collects candidates without filtering; nothing is reported until it passes the Evidence Gate during Triage.
- LOW-confidence or ambiguous items go to Open Questions — never dropped, never reported as findings.
- If a referenced file/path cannot be found: output
NOT FOUND: <path>— never invent contents. - A clean scan (0 findings) is a valid result — do not manufacture findings or inflate severity.
Phase 0 — Load Project Context
Read if present, skip silently if absent: CLAUDE.md or AGENTS.md; docs/architecture/auth-and-sessions.md; docs/architecture/api-reference.md.
Use it to: identify intentionally public endpoints (avoids CHECK-04 false positives), the auth token lifecycle, and project-specific security patterns (e.g., single-device enforcement, TOTP). Violations of DOCUMENTED conventions → report with HIGH confidence instead of MEDIUM.
Check Applicability
| Checks | Run when | Otherwise |
|---|---|---|
| CHECK-01..15, 18 | always | — |
| CHECK-16 | codebase has payments | mark N/A |
| CHECK-17 | codebase has file uploads | mark N/A |
| CHECK-19..25 | .claude/ directory exists (CHECK-19 also runs when a standalone .mcp.json or .kiro/settings/mcp.json exists without .claude/) |
mark N/A |
| CHECK-26..31 | *.go files in scope |
mark N/A |
Process
- Discover — run every in-scope check; record each candidate hit as
file:line+ pattern matched. Coverage over filtering: better a candidate filtered in triage than a real bug silently missed. Done when: every check ran or is marked N/A. - Triage — per candidate: Read the surrounding code/caller, apply the Evidence Gate, assign Severity + Confidence. HIGH/MEDIUM confidence → Findings; LOW or ambiguous → Open Questions. Done when: every candidate is a finding, an Open Question, or discarded with a stated reason.
- Posture — from surviving findings, conclude: highest-risk attack surfaces, systemic patterns (e.g., consistently missing input validation), compensating controls. Report conclusions only, not chain of thought.
- Roadmap — assign each finding a tier via the Mitigation Roadmap Tiers table; give Fix approach / Verification / Regression risk per item.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 237 lines · 34 tokens per session scan D 5a5a2dc1a652
security-scanner is an agent published in the GitHub repository RaNDoM6913/claude-code-superkit (2 stars, last pushed 1mo ago), licensed MIT. It adds 34 tokens to every session and 3,667 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it D with 5 findings (instruction-override phrasing, hidden instructions, asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other agents, from other repositories
python-architect
Expert on Python design patterns, modularization, and scalable architecture for the APM CLI codebase. Activate when creating new modules, refactoring class hierarchies, or making cross-cutting architectural decisions.
doc-writer
APM documentation writer. Use this agent for creating, editing, or restructuring any documentation in docs/src/content/docs/. Activate whenever the task involves writing user-facing prose, adding guide pages, updating reference docs, or consolidating duplicate content across the doc site.
cdo
APM Chief Documentation Officer. Use this agent as the synthesizer and final arbiter for any multi-persona docs panel -- holds the 3-promise narrative (consume / produce / govern), the chapter-start and chapter-end bridges, the TOC integrity, and the persona ramps (consumer / producer / enterprise). Activate to…
algorithmic-patterns
Load this reference when the PR diff touches code outside the transport/cache layer -- i.e. when the change introduces or modifies loops, data structures, lookup patterns, or module-level imports.
apm-expert
Expert on APM (Agent Package Manager). Helps users install, configure, author, and troubleshoot APM packages, dependencies, compilation, MCP servers, and governance policies.
test-coverage-expert
Test-coverage expert paired with the DevX UX lens. Activate when reviewing PRs that change CLI surface (commands, flags, help text), error wording, exit codes, install/init/run flows, lockfile behavior, auth resolution, hooks, marketplace, or any contract a user can observe -- even when the user does not say "tests"…