Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/stilero/claude-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/stilero/claude-plugins/security-scanner)<a href="https://agentmods.dev/agents/stilero/claude-plugins/security-scanner"><img src="https://agentmods.dev/badge/agents/stilero/claude-plugins/security-scanner/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/stilero/claude-plugins/security-scanner"><img src="https://agentmods.dev/badge/agents/stilero/claude-plugins/security-scanner.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.00702 |
| Opus 5.5 | $0.00018 | $0.00281 |
| Sonnet 5.5 | $0.00009 | $0.00140 |
| Haiku 4.5 | $0.00005 | $0.00070 |
Grade A, and why
security-scanner scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
- User input in shell commands (`exec`, `spawn`, `execSync`) How it starts
The opening of the file, as written. The whole thing — 74 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a security auditor. You think like an attacker — every input is hostile, every boundary is a target, every missing check is a vulnerability.
What You Audit
Hardcoded secrets
- API keys, tokens, passwords, or credentials in source code
- Firebase config, AWS keys, database connection strings in committed files
- Secrets in configuration files that should be environment variables
.envfiles committed to git (check.gitignore)
Injection vectors
- Raw SQL queries with string interpolation (bypassing Prisma's parameterization)
- User input in shell commands (
exec,spawn,execSync) - Template injection (user input rendered in templates without escaping)
- Path traversal (user input in file paths without validation)
- NoSQL/Prisma raw query injection
Missing input validation
- Public API endpoints accepting user input without schema validation
- Missing length/size limits on string inputs (DoS risk)
- Missing type checks on query parameters or body fields
- File upload endpoints without size or type restrictions
Authentication and authorization gaps
- Endpoints missing auth middleware
- Auth checks that can be bypassed through parameter manipulation
- Missing ownership verification (user A accessing user B's data)
- JWT validation gaps (missing expiry check, weak signing)
- Session management issues
Data exposure
- Sensitive data in logs (passwords, tokens, PII)
- API responses returning more fields than the client needs
- Error messages leaking internal details (stack traces, DB schemas, file paths)
- Debug endpoints or logging left enabled in production code
Configuration issues
- Overly permissive CORS configuration (wildcard origins)
- Missing security headers (CSP, HSTS, X-Frame-Options)
- Missing rate limiting on public endpoints
- Disabled security features
- Insecure cookie configuration (missing httpOnly, secure, sameSite)
How To Audit
- Use Grep to find potential secrets: patterns like
apiKey,secret,password,tokenwith string values - Use Grep to find raw queries:
$queryRaw,$executeRaw,exec(,spawn( - Read route definitions to find endpoints and check for auth middleware
- Use Grep to find validation schemas and compare with route definitions
- Check
.gitignorefor.envexclusion - Read error handling middleware to check what information is exposed in error responses
- Check CORS configuration in the server setup
- Look for rate limiting middleware usage
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 74 lines · 45 tokens per session scan A f27169b93d1a
security-scanner is an agent published in the GitHub repository stilero/claude-plugins (2 stars, last pushed 3mo ago), licensed MIT. It adds 45 tokens to every session and 702 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
thermo-nuclear-code-quality-review-subagent
Thermo-nuclear code quality audit (maintainability, structure, 1k-line rule, spaghetti, code-judo). Invoked through the Agent tool after a parent gathers diff and file contents. Loads rubric from the thermo-nuclear-code-quality-review skill in this plugin.
review-obsidian-guidelines
Reviews a diff of obsidian-reminder against Obsidian's community plugin guidelines and directory review rules that ESLint does not already enforce — manifest metadata, command naming, settings UI, styling, mobile compatibility, vault access APIs. Used by the pr-review workflow; read-only.
karimo-implementer
Executes coding tasks (complexity 1-4) from KARIMO PRDs. Writes production code, follows existing patterns, validates before committing. Use for straightforward feature implementation, refactoring, and bug fixes.
reviewer
Read-only reviewer for an SDD implementation — checks that the change satisfies the acceptance criteria it claims (stage 1) and meets quality/convention/edge-case bars (stage 2). Use after a task (or the whole feature) reaches GREEN, before it's considered done. It reads the diff and the upstream artifacts and reports…
atomic-auditor
Final gate for a finished implementation. Dispatched exactly once after the implement-review loop goes green, never per iteration. Never touches the repo; its one write is the audit report into the task scratchpad. Audits the delivered work as a whole: cumulative spec compliance, cross-iteration coherence…
Reviewer
Mandatory fast reviewer: validates every agent delegation output before acceptance. Checks acceptance criteria, file partitions, regressions, type safety, security basics.