agentmods.dev

security-reviewer

security-reviewer is an agent for Claude Code from shashankreddy509/claude-tdd-kit. It costs 41 tokens per session (523 once invoked), scanned A, original, MIT.

A read-only security reviewer for software changes. It checks code for vulnerabilities such as leaked secrets, injection, unsafe authentication, insecure storage, and exposed APIs.

In plain words
What is it for?
Use it to inspect backend, web, Python, or Android code for security problems, including SQL injection, weak cryptography, unsafe deserialization, path traversal, and missing request protections.
Why use it?
It provides a focused security check without changing files. Finding these issues before release can prevent attackers from using unsafe inputs, permissions, or configurations.

Agent for Claude Code

Written for Claude Code: shipped in a Claude Code plugin. Also seen: model in frontmatter.

Part of the tdd-pipeline plugin — 6 commands, 13 agents shipped together

not rated 2repo 16d ago A scan 41 tokens original MIT

Good fit Use it to inspect backend, web, Python, or Android code for security problems, including SQL injection, weak cryptography, unsafe deserialization, path traversal, and missing request protections.

Compare 6 agents from other repositories ↓
Install with agentmods
npx agentmods add agents/shashankreddy509/claude-tdd-kit/security-reviewer
View source ↗ shashankreddy509/claude-tdd-kit
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo
git clone --depth 1 https://github.com/shashankreddy509/claude-tdd-kit

Made for: Claude Code.

Or install tdd-pipeline, the plugin that ships this one along with the rest of its 6 commands, 13 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for security-reviewer

README.md
[![agentmods](https://agentmods.dev/badge/agents/shashankreddy509/claude-tdd-kit/security-reviewer/github.svg)](https://agentmods.dev/agents/shashankreddy509/claude-tdd-kit/security-reviewer)
Your own site
<a href="https://agentmods.dev/agents/shashankreddy509/claude-tdd-kit/security-reviewer"><img src="https://agentmods.dev/badge/agents/shashankreddy509/claude-tdd-kit/security-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for security-reviewer

Your own site · 80×15
<a href="https://agentmods.dev/agents/shashankreddy509/claude-tdd-kit/security-reviewer"><img src="https://agentmods.dev/badge/agents/shashankreddy509/claude-tdd-kit/security-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 41 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 523 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00041 $0.00523
Opus 5 $0.00020 $0.00262
Sonnet 5 $0.00008 $0.00105
Haiku 4.5 $0.00004 $0.00052

Measured 9d ago against content hash 966d7aba3bfe, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade A, and why

security-reviewer scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Runs shell commandslowCapability

Expected in a hook, worth knowing in a rule or an instructions file.

- `child_process.exec` with interpolated input
tdd-pipeline/agents/security-reviewer.md · 61 lines

What it actually says

You are a security engineer doing a targeted code review. Read-only. Never modify files.

What to Check

Universal (all platforms)

  • Hardcoded secrets, API keys, passwords, tokens
  • SQL injection / NoSQL injection vectors
  • Unvalidated user input used in queries, file paths, or shell commands
  • Insecure deserialization
  • Sensitive data written to logs
  • Weak cryptography (MD5, SHA1, DES, ECB mode)
  • HTTP used instead of HTTPS
  • Overly broad CORS or permissions

Android-specific

  • Secrets in local.properties, BuildConfig, or strings.xml
  • WebView with setJavaScriptEnabled(true) + untrusted URLs
  • MODE_WORLD_READABLE / MODE_WORLD_WRITEABLE file storage
  • Exported components in AndroidManifest.xml without permission checks
  • PII written to SharedPreferences unencrypted
  • allowBackup=true in manifest with sensitive data

Backend/Web

  • JWT secret hardcoded or weak
  • Missing rate limiting on auth endpoints
  • Unsafe eval() or dynamic code execution
  • Path traversal via unsanitized file inputs
  • CSRF tokens missing on state-changing endpoints

Python-specific

  • pickle/yaml.load (without SafeLoader) on untrusted data
  • subprocess with shell=True on any non-constant input
  • requests/httpx with verify=False
  • Format strings / f-strings building SQL or shell commands

JS/Node-specific

  • Prototype-pollution-prone deep merges of user input
  • child_process.exec with interpolated input
  • Secrets in client-side bundles / NEXT_PUBLIC-style env leaks
  • Unpinned install scripts / typosquat-prone dependency additions in the diff

Only apply the platform sections matching the diff's stack.

Output Format

For each issue: [SEVERITY: CRITICAL/HIGH/MEDIUM/LOW] file:line

  • Issue: [what it is]
  • Risk: [what can go wrong]
  • Fix: [concrete code fix or pattern]

If nothing found: state "No security issues detected."

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 9d ago First seen · 61 lines · 41 tokens per session scan A 966d7aba3bfe

Subscribe to this mod's changes

security-reviewer is an agent published in the GitHub repository shashankreddy509/claude-tdd-kit (2 stars, last pushed 16d ago), licensed MIT. It adds 41 tokens to every session and 523 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Claude CodeCode reviewSecurityai-agentsautomationclaudedeveloper-toolsjira
Related

Other agents, from other repositories

code-reviewer

A code-review agent that checks whether changes follow their specification and assesses code quality, security, maintainability, and performance. It reports findings with severity levels and file-and-line references.

sangrokjung/claude-forge · 96 tokens

adversarial-reviewer

Independent read-only checker for behavioural changes. Runs in a fresh context that did not author the change, reproduces the claim against the goal, spec, diff and execution evidence, and returns exactly one verdict — APPROVE, REQUESTCHANGES or UNVERIFIED — as a forge.review/v1 envelope. MUST BE USED before claiming…

sangrokjung/claude-forge · 102 tokens

security-reviewer

A read-only security review agent that checks code for common web risks, exposed secrets, unsafe input handling, authentication and authorization problems, and dependency issues. OWASP Top 10 is a widely used list of major web application security risks.

sangrokjung/claude-forge · 95 tokens

database-reviewer

Use when writing SQL queries, creating migrations, or troubleshooting database performance in Supabase/PostgreSQL projects. Reviews indexes, RLS policies, schema types, N+1 patterns. Read-only reviewer with EXPLAIN ANALYZE capability.

sangrokjung/claude-forge · 52 tokens

refactor-cleaner

An agent for finding and safely removing dead code, unused exports, unused dependencies, and duplicate implementations.

sangrokjung/claude-forge · 109 tokens

skeptical-auditor

Independent skeptical re-verification after verify-agent (or any self-verifying agent) claims a pass. Read-only and adversarial: re-runs every step that was claimed, compares actual exit codes against the claim, and is paid to find failures rather than confirm success. Never approves without executed evidence. Spawned…

sangrokjung/claude-forge · 120 tokens