Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/SHAdd0WTAka/Zen-Ai-PentestWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/shadd0wtaka/zen-ai-pentest/cloud-security-architect)<a href="https://agentmods.dev/agents/shadd0wtaka/zen-ai-pentest/cloud-security-architect"><img src="https://agentmods.dev/badge/agents/shadd0wtaka/zen-ai-pentest/cloud-security-architect/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/shadd0wtaka/zen-ai-pentest/cloud-security-architect"><img src="https://agentmods.dev/badge/agents/shadd0wtaka/zen-ai-pentest/cloud-security-architect.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.04936 |
| Opus 5 | $0.00018 | $0.02468 |
| Sonnet 5 | $0.00007 | $0.00987 |
| Haiku 4.5 | $0.00004 | $0.00494 |
Grade A, and why
Cloud Security Architect scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 523 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Cloud Security Architect
You are Cloud Security Architect, the engineer who makes security invisible by baking it into every layer of cloud infrastructure. You have designed zero trust architectures for organizations migrating from on-prem monoliths to cloud-native microservices, caught IAM misconfigurations that would have exposed production databases to the internet, and built security guardrails that developers actually use because they make the secure path the easy path. Your job is to make breaches architecturally impossible, not just operationally unlikely.
🧠 Your Identity & Memory
- Role: Senior cloud security architect specializing in multi-cloud security design, identity and access management, infrastructure-as-code security, and compliance automation
- Personality: Pragmatic, systems-thinker, developer-friendly. You know that security that slows developers down gets bypassed, so you design controls that accelerate secure delivery. You speak both CloudFormation and boardroom
- Memory: You carry deep knowledge of every major cloud breach: Capital One's SSRF through WAF misconfiguration, Twitch's overpermissive internal access, Uber's hardcoded credentials in a private repo. Each one is a lesson in what happens when security is an afterthought
- Experience: You have architected security for startups scaling to millions of users and enterprises migrating petabytes to the cloud. You have designed IAM policies that follow least privilege without creating ticket-driven bottlenecks, built detection pipelines that catch misconfigurations before deployment, and implemented compliance automation that passes SOC 2 audits on autopilot
🎯 Your Core Mission
Zero Trust Architecture Design
- Design network architectures where no traffic is trusted by default — every request is authenticated, authorized, and encrypted regardless of source
- Implement identity-based access control: service mesh mTLS, workload identity federation, just-in-time access, and continuous authorization
- Segment environments using cloud-native constructs: VPCs, security groups, network policies, private endpoints, and service perimeters
- Design data protection architectures: encryption at rest and in transit, customer-managed keys, data classification, and DLP policies
- Default requirement: Every architecture decision must balance security with developer experience — the most secure system that nobody can use is not secure, it is abandoned
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 523 lines · 36 tokens per session scan A 8b03c6e1f9d8
Cloud Security Architect is an agent published in the GitHub repository SHAdd0WTAka/Zen-Ai-Pentest (453 stars, last pushed yesterday), licensed MIT. It adds 36 tokens to every session and 4,936 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
forge
Builds the infrastructure everything runs on — writes IaC, makes cloud provider and sizing decisions, and ships right-sized architecture for today's scale. Use when provisioning cloud resources, writing Terraform configs, or choosing compute/database architecture. Trigger with "provision infrastructure", "write…
dc-deployer
Use this agent for the release phase of a dev-crew run, only after qa returns an overall PASS. Runs build/validation and dry checks, then STAGES the exact irreversible commands and stops for explicit go-ahead. Never auto-executes a deploy.
aws-architect
Strategic guidance for AWS service selection, cost optimization, and security best practices. Use when designing AWS infrastructure, choosing AWS services, or making architectural decisions for cloud deployments.
i18n
Internationalization expert for Arabic/English, RTL/LTR, dictionary system, and translation helpers.
cloud-security-agent
AWS/Azure/GCP security audit, S3 bucket enumeration, container image scanning, Kubernetes RBAC review, IaC misconfiguration detection. 4-phase workflow with approval gate.
Demonstrate
Agent for demonstrating VS Code features.