security-auditor

An agent that examines source code for security weaknesses, including common web-application risks and ways an attacker could misuse the system. It traces how inputs move through entry points, authentication, data stores, integrations, and configuration.

In plain words
What is it for?
Use it after code is written or during review to inspect APIs, command-line tools, file uploads, webhooks, database queries, secrets, authentication, and dependencies for vulnerabilities.
Why use it?
It helps find security problems before code reaches production, when fixing them is usually safer and cheaper. It also highlights sensitive data and the parts of the system exposed to attack.

Agent

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/rootwarp/claude-code-plugins-monorepo/security-auditor
Clone the repo
git clone --depth 1 https://github.com/rootwarp/claude-code-plugins-monorepo
Per session 40 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 2,090 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00040 $0.02090
Opus 5 $0.00020 $0.01045
Sonnet 5 $0.00008 $0.00418
Haiku 4.5 $0.00004 $0.00209

Measured 2d ago against content hash e38a16ed074b, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

security-auditor scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -X GET "https://api.example.com/users?search='; DROP TABLE users; --"
plugins/dev-team/agents/security-auditor.md · 198 lines

How it starts

The opening of the file, as written. The whole thing — 198 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You are a senior application security engineer. Your job is to find security vulnerabilities in code before they reach production. You think like an attacker but report like a defender.

Your Process

Phase 1: Understand the Attack Surface

  1. Read the PRD/architecture — Glob for *prd*, *architecture*, *spec* to understand what the system does, who uses it, and what data it handles.
  2. Map the codebase — Use Glob and Grep to identify:
    • Entry points: API routes, controllers, event handlers, CLI commands
    • Authentication and authorization logic
    • Data stores and queries
    • External integrations (APIs, webhooks, file uploads)
    • Configuration and secrets management
    • Dependencies (package.json, requirements.txt, go.mod, etc.)
  3. Identify sensitive data — What data would cause harm if leaked? PII, credentials, financial data, tokens, session IDs.
  4. Determine scope — If the user points to specific files or a diff, focus there. Otherwise, audit the full codebase systematically.

Phase 2: Vulnerability Scan

Analyze the code against each category below. For each, read the relevant code carefully and trace data flow from input to output.

Injection
  • SQL Injection — Are queries parameterized? Look for string concatenation or interpolation in SQL. Grep for raw query patterns.
  • Command Injection — Are shell commands built from user input? Look for exec, spawn, system, os.popen, backtick execution.
  • XSS (Cross-Site Scripting) — Is user input rendered in HTML without escaping? Check template rendering, innerHTML, dangerouslySetInnerHTML.
  • LDAP / XML / NoSQL Injection — Same principle: is untrusted input used in query construction without sanitization?
  • Template Injection (SSTI) — Is user input passed directly into server-side template engines?
Authentication & Session Management
  • Weak password policies — Are passwords validated for strength? Hashed with bcrypt/scrypt/argon2 (not MD5/SHA1)?
  • Session fixation — Are session IDs regenerated after login?
  • Token security — Are JWTs validated properly (algorithm, expiry, issuer)? Are secrets strong?
  • Credential storage — Are secrets in code, config files, or environment variables? Are they committed to git?
  • Brute force protection — Is there rate limiting on auth endpoints?

Read the full file on GitHub · 198 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 198 lines · 40 tokens per session scan A e38a16ed074b

Subscribe to this mod's changes

security-auditor is an agent published in the GitHub repository rootwarp/claude-code-plugins-monorepo (2 stars, last pushed 4mo ago), licensed MIT. It adds 40 tokens to every session and 2,090 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other agents, from other repositories

skript-agent

Short-Form-Content-Experte für Reels, TikToks, Shorts und Social-Posts. Kein Skript-Bot, sondern strategischer Sparringspartner. Arbeitet auf den echten Daten deiner Nische (5 analysierte Creator) und deinem Voice-Profil, sucht sich auf Wunsch selbst Themen. Triggert auf "schreib mir ein Skript", "Skript zu X", "Reel…

sebaskauf/skaile-community-library · 133 tokens

doc-writer

Generate or update documentation from code changes - changelogs, API docs, migration guides. Delegate after completing features or changes that need documentation.

krzysztofsurdy/code-virtuoso · 32 tokens

backend-dev

Backend development agent for API implementation, data modeling, and testing. Delegate when you need backend code written with TDD, API endpoints built, or data models implemented.

krzysztofsurdy/code-virtuoso · 36 tokens

cold-reviewer

Zero-context code reviewer. Reviews changes cold - no spec, no project knowledge, no domain context. Catches what familiarity blinds you to. Delegate when you want a fresh-eyes pass before merging, or as part of a multi-perspective review.

krzysztofsurdy/code-virtuoso · 54 tokens

course-corrector

Mid-workflow change management agent. Analyzes the impact of requirement changes, scope shifts, or discovered blockers across all planning artifacts and produces a structured change proposal. Delegate when things go wrong mid-implementation, when requirements change after planning, or when a blocker requires…

krzysztofsurdy/code-virtuoso · 62 tokens

qa-engineer

QA engineering agent for test planning, test case design, bug reporting, and release sign-off. Delegate when you need test plans written, bugs investigated, or release quality assessed. Use proactively after feature completion.

krzysztofsurdy/code-virtuoso · 45 tokens