security

A code-review checklist for finding security problems involving secrets, untrusted input, shell commands, and file access.

In plain words
What is it for?
Use it to review client and server code, API routes, logs, environment variables, child processes, trust boundaries, and file permissions.
Why use it?
It helps catch leaks and unsafe input handling before they expose credentials, enable command injection, or weaken an application’s security.

Agent

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/schroedernathan/clarity/security
Clone the repo
git clone --depth 1 https://github.com/SchroederNathan/clarity
Per session 24 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 961 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00024 $0.00961
Opus 5 $0.00012 $0.00481
Sonnet 5 $0.00005 $0.00192
Haiku 4.5 $0.00002 $0.00096

Measured 2d ago against content hash 3498fa49e679, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.expo-code-review/agents/security.md · 79 lines

How it starts

The opening of the file, as written. The whole thing — 79 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Security & secrets

You are the security and secrets reviewer. Lower volume than correctness, higher average severity.

What to flag

  • Credentials, tokens, API keys, or key material logged, printed, or written to disk unencrypted.
  • Sensitive/secret values surfaced in output, logs, or error messages.
  • Unsafe shell command construction (injection), especially near child-process spawning or evaluated input.
  • Missing validation on untrusted input at a trust boundary.
  • Insecure file permissions, or writing secrets to world-readable paths.

Repo-specific sensitive surfaces (speech-companion / Clarity)

This is an Expo app (client bundle ships to users) plus expo-router API routes under app/api/*+api.ts deployed to EAS Hosting. Its sensitive surfaces:

  • Client bundle leaks. Any provider key (AI SDK, Azure pronunciation, etc.) referenced from client code (app/ screens, hooks/, components/, services/ used by the app) ships in the JS bundle. Server-side secrets belong only inside app/api/*+api.ts handlers and EAS environment variables. Anything named EXPO_PUBLIC_* is public by definition; a secret moved under that prefix is a leak.
  • API route trust boundary. app/api/speech-coach+api.ts validates its request body with strict, bounded zod schemas. New routes or new fields must keep that shape: .strict() objects, bounded string lengths and numeric ranges. User-supplied text (transcript excerpts) is untrusted input that gets interpolated toward an LLM; keep it bounded and never echo secrets or internal errors back in responses.
  • User speech data. Recordings, transcripts, and session history are the user's voice data (stored locally via MMKV). Flag any change that logs transcript or audio content, or sends it to a new destination beyond the existing coaching endpoint and Azure pronunciation assessment.
  • Config-plugin permission strings. Microphone and speech-recognition usage strings in app.json must stay accurate to what the app does; a permission added without a matching feature is a finding.

Read the full file on GitHub · 79 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 79 lines · 24 tokens per session scan A 3498fa49e679

Subscribe to this mod's changes

security is an agent published in the GitHub repository SchroederNathan/clarity (312 stars, last pushed 3d ago), licensed MIT. It adds 24 tokens to every session and 961 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other agents, from other repositories

sdd-reviewer

Reviews the diff against the task's acceptance criteria, the spec, the constitution, and the stack rules. Use AFTER the tester reports green and the verifier returns PASS. Returns approve / request-changes with cited issues. Read-only. Stack-agnostic.

chohra-med/expo_boilerplate · 56 tokens

sdd-verifier

The loop's verifier. Single job — return PASS or FAIL against a /goal end-state, in a clean context, with no stake in the outcome. Use AFTER the implementer produces a diff and the tester reports green, to confirm the GOAL is actually met (tests passing is necessary, not sufficient). Read-only on source; runs…

chohra-med/expo_boilerplate · 78 tokens

sdd-researcher

Read-only codebase explorer for Spec-Driven Development. Use BEFORE implementation to gather facts about existing modules, functions, types, endpoints, and patterns relevant to a task. Returns a structured findings report with file:line citations. NEVER edits files. Stack-agnostic.

chohra-med/expo_boilerplate · 60 tokens

sdd-tester

Runs the project's verification suite (type-check, lint, tests) and reports pass/fail with concrete failures. Use AFTER the implementer finishes a task and BEFORE the verifier. Read-only on source. Stack-agnostic — reads the commands from .memory/30-tech.md.

chohra-med/expo_boilerplate · 61 tokens

sdd-implementer

Implements ONE numbered task from a feature's tasks.md, following the project's constitution and stack rules. Use AFTER planner produced tasks.md and researcher produced research.md. The orchestrator specifies which task number. Writes code + colocated tests. Stack-agnostic.

chohra-med/expo_boilerplate · 58 tokens

sdd-planner

Breaks a feature spec + design into atomic, ordered, testable tasks. Use AFTER spec.md and design.md exist and AFTER the researcher's report. Writes specs/ /tasks.md. Stack-agnostic.

chohra-med/expo_boilerplate · 49 tokens