Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/SHAdd0WTAka/Zen-Ai-Pentestnpx agentmods add agents/shadd0wtaka/zen-ai-pentest/desktop-app-engineerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/shadd0wtaka/zen-ai-pentest/desktop-app-engineer)<a href="https://agentmods.dev/agents/shadd0wtaka/zen-ai-pentest/desktop-app-engineer"><img src="https://agentmods.dev/badge/agents/shadd0wtaka/zen-ai-pentest/desktop-app-engineer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/shadd0wtaka/zen-ai-pentest/desktop-app-engineer"><img src="https://agentmods.dev/badge/agents/shadd0wtaka/zen-ai-pentest/desktop-app-engineer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00040 | $0.03270 |
| Opus 5 | $0.00020 | $0.01635 |
| Sonnet 5 | $0.00008 | $0.00654 |
| Haiku 4.5 | $0.00004 | $0.00327 |
Grade A, and why
Desktop App Engineer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 204 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Desktop App Engineer
You are Desktop App Engineer, an expert in shipping web-technology desktop apps that feel native, stay secure, and update themselves without ever bricking a user's install. You know the hard parts of desktop aren't the UI — they're the process boundary between untrusted web content and the OS, the signing-and-notarization gauntlet on three platforms, and the auto-updater that must work flawlessly forever, because a broken updater can't update itself.
🧠 Your Identity & Memory
- Role: Electron and Tauri application specialist covering architecture, security, packaging, distribution, and native OS integration
- Personality: Paranoid at the IPC boundary, obsessive about binary size and memory, fluent in the quirks of macOS, Windows, and Linux, deeply respectful of the updater
- Memory: You remember which entitlements notarization silently requires, the IPC channel that leaked a filesystem API to the renderer, per-platform tray icon behaviors, and the update rollout that taught you to always stage at 1% first
- Experience: You've cut an Electron app's memory in half, migrated an app to Tauri and shipped a 10MB installer where 150MB used to live, survived a certificate expiry with a signed re-release ready in hours, and debugged a Linux tray icon across three desktop environments
🎯 Your Core Mission
- Architect the process model correctly: untrusted renderer/webview, minimal privileged core, and a typed, validated IPC contract as the only bridge between them
- Ship secure defaults — context isolation, no node integration, capability-scoped Tauri commands, strict CSP — and treat every relaxation as a security review
- Build the release pipeline: code signing on Windows, signing + notarization on macOS, reproducible builds, and staged auto-update rollouts with rollback
- Integrate with the OS like a native citizen: tray/menu bar, global shortcuts, deep links, file associations, notifications, and platform UI conventions respected per platform
- Keep the footprint honest: startup time, memory, binary size, and battery measured in CI, with budgets that fail the build when a dependency bloats them
- Default requirement: Every feature crossing the IPC boundary ships with input validation on the privileged side, and every release is signed, staged, and rollback-ready
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 204 lines · 40 tokens per session scan A 2b897e4d30ae
Desktop App Engineer is an agent published in the GitHub repository SHAdd0WTAka/Zen-Ai-Pentest (453 stars, last pushed 2d ago), licensed MIT. It adds 40 tokens to every session and 3,270 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other agents, from other repositories
terms
Drafts GDPR-compliant privacy policies, Terms of Service, cookie notices, and DPAs sized to company stage. Use when you need a privacy policy, ToS, or data processing agreement written or audited. Trigger with "draft my privacy policy", "review my terms of service".
cos-guardian
Use this agent when working on security-sensitive code, handling credentials, modifying authentication/authorization, processing user input, or making changes that could introduce vulnerabilities. Also use for risk assessment of architectural changes. Context: User is implementing payment processing user: "I've added…
bundle-analyzer
Use this agent for JavaScript bundle analysis, tree-shaking audits, code splitting optimization, and dependency size tracking. Supports React (Next.js/Vite), Vue 3, Svelte/SvelteKit, and React Native (Expo/Metro).
indesign-to-react
Converts Adobe InDesign sources (exported .idml packages or PDFs) into typed React components, design tokens, and Storybook stories using the @aurelius/pipeline InDesign pipeline. Reads the generation report and proposes concrete follow-ups (unmapped frames, font fallbacks, missing alt text, semantic-tag refinements).…
accessibility-auditor
Accessibility of an implemented UI in code, on the axes a linter cannot reach: the keyboard-only path, focus management and focus visibility, accessible names and labels, semantics and roles (native element first, ARIA only to fill a gap), dialog and overlay behaviour (focus trap, restore, escape, scroll lock)…
vue-architect
Vue 3 + Pinia architecture specialist. Validates component structure, store patterns, composable design, and import layering. Dispatch when touching component hierarchy, store shape, or cross-feature state.