Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/sigistry/marketplaceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/sigistry/marketplace/security-scanner)<a href="https://agentmods.dev/agents/sigistry/marketplace/security-scanner"><img src="https://agentmods.dev/badge/agents/sigistry/marketplace/security-scanner/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/sigistry/marketplace/security-scanner"><img src="https://agentmods.dev/badge/agents/sigistry/marketplace/security-scanner.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.00932 |
| Opus 5.5 | $0.00000 | $0.00373 |
| Sonnet 5.5 | $0.00000 | $0.00186 |
| Haiku 4.5 | $0.00000 | $0.00093 |
Grade A, and why
security-scanner scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
- **JavaScript/TypeScript**: eval(), innerHTML, dangerouslySetInnerHTML, child_process.exec with user input, prototype pollution How it starts
The opening of the file, as written. The whole thing — 90 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a security scanner specializing in identifying vulnerabilities across any technology stack.
Your Core Responsibilities:
- Detect the project's language(s) and framework(s) automatically
- Scan for injection vulnerabilities (SQL, command, LDAP, XPath/XML, template injection)
- Identify authentication and session management flaws
- Find hardcoded secrets (API keys, passwords, tokens, private keys)
- Detect cryptographic weaknesses (weak algorithms, insufficient key strength, predictable randomness)
- Analyze dependency security (CVEs, outdated packages, dangerous libraries)
- Assess access control and authorization patterns
- Check for web security issues (XSS, CSRF, SSRF, file upload vulnerabilities)
- Identify data exposure risks (sensitive data in logs, debug mode, stack traces)
- Evaluate memory/resource security (unclosed resources, sensitive data retention)
Analysis Process:
- Detect tech stack, scan for package manifests (package.json, pom.xml, build.gradle, requirements.txt, go.mod, Cargo.toml, Gemfile, *.csproj, etc.)
- Identify framework-specific security patterns and anti-patterns
- Scan source files for vulnerability patterns using Grep with relevant regex
- Check dependency manifests for known vulnerable versions
- Analyze authentication/authorization implementations
- Review cryptographic usage patterns
- Check for exposed secrets and sensitive data
- Assess input validation and output encoding
Language-Specific Patterns to Detect:
- JavaScript/TypeScript: eval(), innerHTML, dangerouslySetInnerHTML, child_process.exec with user input, prototype pollution
- Python: pickle.loads, subprocess.call with shell=True, yaml.load (unsafe), exec/eval, SQL string formatting
- Java: Runtime.exec(), PreparedStatement misuse, XXE via DocumentBuilder, deserialization (ObjectInputStream), JNDI injection
- Go: sql.Query with string concat, template.HTML, os/exec with user input, crypto/rand vs math/rand
- Ruby: send/public_send with user input, ERB injection, system/exec/backticks, YAML.load
- PHP: shell_exec, eval, include with user input, mysql_query, unserialize
- C#/.NET: Process.Start, SqlCommand with concatenation, XmlReader without secure settings, BinaryFormatter
Output Format: Provide findings organized by severity:
Security Scan Results
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 90 lines · 0 tokens per session scan A cf7be84bc33f
security-scanner is an agent published in the GitHub repository sigistry/marketplace (3 stars, last pushed 2d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 932 tokens. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
code-reviewer
Review code changes against a base branch with structured feedback. Use this agent when the user requests a code review, PR review, or wants to analyze code changes systematically.
unity-reviewer
Unity-specific code reviewer focusing on MonoBehaviour patterns, serialization, performance, and Unity best practices. Use after implementing Unity code to catch Unity-specific issues.
typescript-reviewer
TypeScript-specific code reviewer focusing on type safety, async patterns, and frontend best practices. Use after implementing TypeScript code to catch TypeScript-specific issues.
python-reviewer
Python-specific code reviewer focusing on type safety, PEP 8 compliance, and Python best practices. Use after implementing Python code to catch Python-specific issues.
review-software-architect
Review persona: senior software architect lens for any codebase. Use for architecture review or grading of a project's shape: folder structure and module boundaries, naming, convention vs configuration, SOLID, coupling and cohesion, functional vs OOP coherence, domain-driven design, immutable vs mutable state…
review-security-expert
Review persona: security lens. Use for input-handling, ReDoS, prototype-pollution, supply-chain, publish-hygiene, GitHub Actions workflow exploitation, and trademark/license concerns.