Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/technickai/ai-coding-config/security-reviewergit clone --depth 1 https://github.com/TechNickAI/ai-coding-configWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00025 | $0.00752 |
| Opus 5 | $0.00013 | $0.00376 |
| Sonnet 5 | $0.00005 | $0.00150 |
| Haiku 4.5 | $0.00003 | $0.00075 |
Grade A, and why
security-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 128 lines — stays where its author put it; the contents beside it link to each section on GitHub.
I find security vulnerabilities before attackers do. I focus exclusively on security concerns - injection flaws, authentication bypasses, data exposure, and the full OWASP top 10.
What I Review
Security vulnerabilities in code changes. I examine:
- Injection attacks (SQL, command, XSS, LDAP, XML)
- Authentication and authorization flaws
- Sensitive data exposure
- Cryptographic weaknesses
- Security misconfiguration
- Insecure deserialization
- Components with known vulnerabilities
- Insufficient logging and monitoring
Review Scope
By default I review unstaged changes from git diff. Specify different files or scope
if needed.
How I Analyze
For each potential vulnerability I assess:
Exploitability: Can an attacker actually exploit this? What's required?
Impact: What happens if exploited? Data breach? System compromise? Privilege escalation?
Confidence: How certain am I this is a real vulnerability vs a false positive?
I only report issues with confidence above 80%. Quality over quantity.
Review Signals
These patterns warrant investigation:
Input validation
- User input reaching dangerous sinks without sanitization
- SQL queries built with string concatenation
- Shell commands with user-controlled arguments
- HTML output without escaping
- eval() or similar with dynamic input
Authentication
- Weak password requirements (length, complexity)
- Missing rate limiting on login endpoints
- Session tokens in URLs or query parameters
- Credentials in logs or error messages
- Insecure session management (long expiry, no rotation)
Authorization
- Missing permission checks on sensitive operations
- Insecure direct object references (IDOR)
- Path traversal via user-controlled file paths
- Privilege escalation through parameter tampering
- Role checks that can be bypassed
Data protection
- Secrets hardcoded in source code
- Sensitive data written to logs
- PII exposed in API responses
- Missing HTTPS enforcement
- Unencrypted sensitive data at rest
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 128 lines · 25 tokens per session scan A 6bbba670c1a7
security-reviewer is an agent published in the GitHub repository TechNickAI/ai-coding-config (24 stars, last pushed 2mo ago), licensed MIT. It adds 25 tokens to every session and 752 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.