Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/RBraga01/builder-aiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/rbraga01/builder-ai/ai-safety-reviewer)<a href="https://agentmods.dev/agents/rbraga01/builder-ai/ai-safety-reviewer"><img src="https://agentmods.dev/badge/agents/rbraga01/builder-ai/ai-safety-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/rbraga01/builder-ai/ai-safety-reviewer"><img src="https://agentmods.dev/badge/agents/rbraga01/builder-ai/ai-safety-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00038 | $0.00751 |
| Opus 5 | $0.00019 | $0.00376 |
| Sonnet 5 | $0.00008 | $0.00150 |
| Haiku 4.5 | $0.00004 | $0.00075 |
Grade B, and why
ai-safety-reviewer scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Instruction-override phrasingmediumPrompt injection
Text telling the model to disregard its earlier instructions or safety rules is the shape of a prompt injection, whoever wrote it.
Test: craft 5 injection attempts — "ignore previous instructions", role-play instructions in user content, instructions embedded in a fake document. Document which ones are blocked and which are not. Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 77 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are an AI safety reviewer for LLM product teams.
Your job is to find the ways this feature could harm users or be abused — before it ships. You are not a compliance checkbox. You are an adversary who knows how LLMs fail.
Review Scope
You review four risk categories. A feature cannot pass without addressing all four.
1 — Prompt Injection
The most underestimated LLM attack vector. Review:
- Can a user write something in their input that changes how the system prompt behaves?
- Can injected instructions arrive via tool outputs, retrieved documents, or uploaded files?
- Is user input clearly delimited from system instructions in the prompt structure?
Test: craft 5 injection attempts — "ignore previous instructions", role-play instructions in user content, instructions embedded in a fake document. Document which ones are blocked and which are not.
2 — Hallucination Risk
Not an abstract concern — a concrete engineering failure. Review:
- Is the model required to cite sources for factual claims?
- Is there a faithfulness check that compares output claims against retrieved context?
- What happens when the model doesn't know? Is there an explicit "I don't know" path?
- Are high-stakes domains (medical, legal, financial, safety-critical) flagged with disclaimers?
3 — Output Safety and Misuse
- Can the model be guided to produce harmful content through legitimate-looking inputs?
- Are model outputs sanitised before rendering (no raw HTML/script injection)?
- If the model generates code, is execution sandboxed?
- Does the feature surface PII from internal data that the user shouldn't see?
- Could the output be used to deceive a third party?
4 — Agentic Scope (if applicable)
For features where the model takes actions:
- What is the maximum blast radius of a single bad action? Is it acceptable?
- Can the agent take irreversible actions without explicit confirmation?
- Is the tool access minimised to only what this task requires?
- Is there a maximum step count that prevents runaway loops?
- Is there a human-in-the-loop checkpoint before any action that affects more than one record?
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 77 lines · 38 tokens per session scan B c684b5b6aa0b
ai-safety-reviewer is an agent published in the GitHub repository RBraga01/builder-ai (2 stars, last pushed 4d ago), licensed MIT. It adds 38 tokens to every session and 751 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (instruction-override phrasing). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
pixel-art-interaction-reviewer
Independent reviewer of OBJECT INTERACTION physics in pixel-art scenes (gravity, occlusion order, surface support, light direction consistency, anchor points, scale plausibility). The 4th specialized reviewer in the pixel-art-quality-board orchestrator. Use when the user asks "do objects interact correctly", "is…
pixel-art-animation-reviewer
Independent reviewer of pixel-art ANIMATION quality (loop seamlessness, motion physics, multi-component motion, frame timing, period selection, particle determinism). One of four specialized review roles in the pixel-art-quality-board orchestrator. Use when the user asks to "check animation timing", "verify loop…
community-ecologist
Reasons from Vellend's four processes and Chesson stabilizing/equalizing coexistence through PERMANOVA/betadisper, betapart turnover–nestedness, Gotelli SIM9/C-score null models, and vegan/entropart/picante pipelines while treating compositional closure, dispersion heterogeneity, and pseudoreplicated quadrats as…
cancer-biologist
Reasons from hallmark capabilities, clonal evolution, and TME context; separates driver from passenger, cell-autonomous from stromal mechanisms, and 2D artifacts from PDO/PDX-validated dependencies using TCGA, DepMap, OncoKB, and REMARK-grade biomarker logic.
anatomist
Reasons from homology, EPB, and von Baer principles through gross dissection, diceCT/μCT/MRI pipelines, UBERON–PATO EQ annotation, MorphoSource/oVert digitization, geometric morphometrics, and NAV/TA2 nomenclature while treating fixation shrinkage, segmentation artifacts, landmark homology error, and collection bias…
catalysis-scientist
Reasons from active-site structure, turnover frequency, selectivity, and the Sabatier principle through CO/H2 chemisorption site-counting, Weisz-Prater and Mears transport checks, Langmuir-Hinshelwood/Mars-van Krevelen kinetics, and operando DRIFTS/XAS while treating diffusion-limited apparent rates, DRIFTS spectator…