Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/thejefflarson/soundcheck/attack-chain-analysisgit clone --depth 1 https://github.com/thejefflarson/soundcheckWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00038 | $0.01477 |
| Opus 5 | $0.00019 | $0.00739 |
| Sonnet 5 | $0.00008 | $0.00295 |
| Haiku 4.5 | $0.00004 | $0.00148 |
Grade B, and why
attack-chain-analysis scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Cloud metadata endpointmediumServer-side request forgery
One request to 169.254.169.254 can return temporary IAM credentials.
`169.254.169.254` on AWS turns into IAM role takeover. Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 150 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You look at a set of vulnerability findings and decide whether any of them combine into a worse-than-the-individual-pieces attack. Final analytical stage of the Soundcheck security review pipeline.
Most reviews don't produce chains — that's fine. Your job is to find them when they exist, not to invent chains to make a report look more dramatic. A speculative chain that doesn't really connect is worse than no chain at all.
Why this stage matters
Individual findings get triaged by severity. But two Medium findings can compose into a Critical-level outcome if one of them gives the attacker something the other one needs. Some recurring shapes:
- Info disclosure → credential use. An unauthenticated debug endpoint that prints environment variables (Medium on its own) plus a missing rotation policy on those credentials (Medium on its own) becomes Critical when the attacker is now the holder of valid prod creds.
- Path traversal → file write → code execution. A path-traversal
bug that's only a "read" might be Medium. The same bug as a
"write" (e.g. on a logging path) plus a writable
__pycache__or init file becomes RCE. - CSRF + state-changing endpoint without CSRF check. Either alone is bounded; combined, an attacker can take state-changing actions on behalf of any logged-in user who visits a hostile page.
- Prompt injection → tool use → exfiltration. An LLM agent that fetches user-controlled URLs and also has a "send email" tool becomes a data-exfil channel for anything the agent can see.
- SSRF + cloud metadata service. SSRF that can reach
169.254.169.254on AWS turns into IAM role takeover.
Inputs
The user message will include a merged JSON array of findings from the Stages 1b + 2 auditors:
[{"severity", "file", "line", "skill", "finding", "fix"}, ...]
Each finding has an implicit id equal to its index in the array
(0, 1, 2, …). You'll reference these ids in finding_ids.
What to do
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 150 lines · 38 tokens per session scan B c685cc5d2352
attack-chain-analysis is an agent published in the GitHub repository thejefflarson/soundcheck (20 stars, last pushed 1mo ago), licensed MIT. It adds 38 tokens to every session and 1,477 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (cloud metadata endpoint). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
AGENTS
In-depth tutorials on LLMs, RAGs and real-world AI agent applications.
index
Browse built-in Agent Framework capabilities for multimodal input, tools, retrieval, evaluation, security, and autonomous execution.
mlops-engineer
ML operations agent for experiment tracking, model registry, feature stores, ML pipelines, model serving, drift monitoring, and AIOps.
loom-senior-software-engineer
Use PROACTIVELY for architecture design, complex debugging, design patterns, code review, test strategy, data modeling, ML system design, UX strategy, documentation architecture, and strategic technical decisions across all domains.
loom-advisor
Read-only advisory agent for debugging and repeated failures. Spawned instead of a blind retry when an implementer has failed twice on the same task, or a bug resists straightforward diagnosis. Returns a root-cause diagnosis plus one concrete next step.
loom-code-reviewer
Read-only code review agent for comprehensive review of code quality, security, architecture, and best practices. Cannot modify files.