What is security-reviewer?

A read-only security review agent that scans a codebase for common vulnerabilities such as code injection, path traversal, shell injection, exposed secrets, unsafe deserialization, and missing input checks.

Use it for a security pass before merging or releasing code, especially when handling user input, files, commands, URLs, or secrets.

It highlights security risks and gives concrete recommendations without modifying the code under review.

security-reviewer — Agent for Claude Code by Smart-AI-Memory

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo

git clone --depth 1 https://github.com/Smart-AI-Memory/attune-ai

Made for: Claude Code.

Or install attune-ai, the plugin that ships this one along with the rest of its 1 command, 6 agents, 1 hook.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/agents/smart-ai-memory/attune-ai/security-reviewer.svg)](https://agentmods.dev/agents/smart-ai-memory/attune-ai/security-reviewer)

Your own site

<a href="https://agentmods.dev/agents/smart-ai-memory/attune-ai/security-reviewer"><img src="https://agentmods.dev/badge/agents/smart-ai-memory/attune-ai/security-reviewer.svg" alt="Measured on agentmods" height="20"></a>

Per session 73 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 746 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 2 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00073	$0.00746
Opus 5	$0.00036	$0.00373
Sonnet 5	$0.00015	$0.00149
Haiku 4.5	$0.00007	$0.00075

Measured 3d ago against content hash dd47a06f6bc4, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-06, from the pricing page.

Security

Grade A, and why

security-reviewer scanned grade A with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

`requests`/`urllib` on user-controlled URLs.

Runs shell commandslowCapability

Expected in a hook, worth knowing in a rule or an instructions file.

`os.system()` with interpolated input.

plugin/agents/security-reviewer.md · 69 lines

How it starts

The opening of the file, as written. The whole thing — 69 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Purpose

You are the security-reviewer agent — a read-only security analysis pass. You scan code for vulnerabilities and report findings with severity and a concrete fix recommendation. You never modify files (no Edit, no Write, no Bash) — a security review must not change the thing it's reviewing.

The security-audit skill covers the same domain interactively; this agent is the autonomous, scoped-tool form for "do a security pass and hand me a report" without consuming the main session's context.

Focus areas

Code injection (CWE-95) — eval(), exec(), __import__() on non-constant input.
Path traversal (CWE-22) — unvalidated file paths, ../ joins, null-byte injection.
Shell injection (CWE-78 / B602) — subprocess(..., shell=True), os.system() with interpolated input.
Hardcoded secrets — API keys, passwords, tokens in source.
Deserialization / SSRF — pickle.loads, yaml.load (unsafe), unbounded requests/urllib on user-controlled URLs.
Broad exception handling (BLE001) — bare except: masking failures.
Missing input validation — user-controlled data reaching dangerous APIs.

Method

Scope to the path the user names (default: project root). Use Glob to map the source files.
Grep for each pattern above across the target.
For every hit, Read ~10 lines of surrounding context to filter false positives (e.g. eval in a comment, a constant literal, a test fixture).
Classify confirmed findings: CRITICAL / HIGH / MEDIUM / LOW.
Be honest about coverage — say what you scanned and what you didn't.

Output

End with a structured report the main session can act on:

## Security Review: <target>

**Findings:** N total — C critical · H high · M medium · L low

| Severity | File:Line | CWE | Finding | Recommendation |
|----------|-----------|-----|---------|----------------|
| CRITICAL | path.py:42 | CWE-95 | eval() on request data | use ast.literal_eval / a parser |
| HIGH | io.py:88 | CWE-22 | unvalidated path join | validate against an allowlist / resolve+check root |

**Scanned:** <paths>. **Not covered:** <gaps>.

Read the full file on GitHub · 69 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

3d ago First seen · 69 lines · 73 tokens per session scan A dd47a06f6bc4

Subscribe to this mod's changes

security-reviewer is an agent published in the GitHub repository Smart-AI-Memory/attune-ai (10 stars, last pushed today), licensed Apache-2.0. It adds 73 tokens to every session and 746 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 2 findings (makes network calls, runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Code review Cost Optimization LLM Multi-Agent Security ai claude developer-tools

flutter-reviewer

Flutter and Dart code reviewer. Reviews Flutter code for widget best practices, state management patterns, Dart idioms, performance pitfalls, accessibility, and clean architecture violations. Library-agnostic — works with any state management solution and tooling.

affaan-m/ECC · 50 tokens

vue-reviewer

Expert Vue.js code reviewer specializing in Composition API correctness, reactivity pitfalls, component architecture, template security, and Vue-specific performance. Use for any change touching .vue, .ts/.js files with Vue imports, or Vue ecosystem code (Pinia, Vue Router, Nuxt). MUST BE USED for Vue projects.

affaan-m/ECC · 68 tokens

kotlin-reviewer

Kotlin and Android/KMP code reviewer. Reviews Kotlin code for idiomatic patterns, coroutine safety, Compose best practices, clean architecture violations, and common Android pitfalls.

affaan-m/ECC · 38 tokens

react-reviewer

Expert React/JSX code reviewer specializing in hook correctness, render performance, server/client component boundaries, accessibility, and React-specific security. Use for any change touching .tsx/.jsx files or React component logic. MUST BE USED for React projects.

affaan-m/ECC · 53 tokens

swift-reviewer

Expert Swift code reviewer specializing in protocol-oriented design, value semantics, ARC memory management, Swift Concurrency, and idiomatic patterns. Use for all Swift code changes. MUST BE USED for Swift projects.

affaan-m/ECC · 44 tokens

healthcare-reviewer

Reviews healthcare application code for clinical safety, CDSS accuracy, PHI compliance, and medical data integrity. Specialized for EMR/EHR, clinical decision support, and health information systems.

affaan-m/ECC · 42 tokens

security-reviewer