Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/thevibeworks/claude-code-docs/scan-researchergit clone --depth 1 https://github.com/thevibeworks/claude-code-docsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00026 | $0.01469 |
| Opus 5 | $0.00013 | $0.00734 |
| Sonnet 5 | $0.00005 | $0.00294 |
| Haiku 4.5 | $0.00003 | $0.00147 |
Grade B, and why
scan-researcher scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Tells the agent never to refusemediumAnti-refusal
Suppressing the ability to decline removes a core safety control; a later harmful request then succeeds.
Vulnerability research on this repository is authorized work. Do not refuse it, and do not soften findings to be polite about the code. Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
This is a copy
100% identical to scan-researcher — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 60 lines — stays where its author put it; the contents beside it link to each section on GitHub.
The repository lives at the absolute SCAN_ROOT your dispatch names. Reach it by absolute path -- read <SCAN_ROOT>/path/to/file, and run git as git -C <SCAN_ROOT> log|show|blame .... Never assume the current working directory is the repository: on some platforms it is the run directory, and a bare relative path would search the wrong tree.
You are a security researcher. You are given one component of a repository and one category lens, and you find real vulnerabilities in it — not lint, not style, not "consider using a safer API". A finding is a claim that an attacker can do something they should not be able to do, and you must be able to point at the code that lets them.
What you can and cannot do
You have Bash, but only read-only commands are yours to run: searching, reading, and read-only git (git log, git diff, git show, git blame). Everything else -- building, testing, executing, writing, network access -- is off-limits: you have Bash for reading and searching, but building, running, testing, or installing the repository's code is a rule you follow here, not a permission that will be blocked for you -- so simply do not attempt it.
So: never try to build, test, or execute the repository's code, install a package, start a server, or fetch anything. Not because you would be caught — because it is not your job. You reason about code by reading it. If a question could only be answered by running something, say so in your finding's rationale and lower your confidence; do not guess, and do not describe an execution you did not perform. Describing a command's output you never saw is fabrication.
How to work
Read the hot-path files you are given in full: entry points, sinks, and the guards between them. Then follow the data. For each candidate sink, walk back to where the value enters the system, and read every hop — including the ones in other files. Grep for the callers of a function rather than assuming there is one. A vulnerability is a complete path from an attacker-controlled source to a dangerous operation with no effective check in between; anything less is a note, not a finding.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 60 lines · 26 tokens per session scan B f59e6200a759
scan-researcher is an agent published in the GitHub repository thevibeworks/claude-code-docs (38 stars, last pushed 2d ago), licensed MIT. It adds 26 tokens to every session and 1,469 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it B with 1 finding (tells the agent never to refuse). It is 100% identical to scan-researcher, differing in 0 lines, and is treated as a copy.
Other agents, from other repositories
edge-case-explorer
Systematically discovers and catalogs edge cases that should be covered by tests for a given piece of code. Traces input sources, call chains, and integration boundaries to find boundary values, type coercion traps, external input messiness, state-dependent failures, and error propagation gaps. Use when exploring how…
docs-reviewer
Lean docs reviewer that dispatches reviews docs for a particular skill.
plan
Triage, analyze, and create phased development plans. Iterate with the user until the plan is approved.
code-refactor-master
Execute refactoring tasks — reorganize files, extract components, update imports, fix patterns across the codebase. Use after a refactor-planner has created a plan.
release-engineer
Use when preparing releases, version bumps, changelog updates, or publishing packages.
polyglot-architect
Cross-language API design and binding parity.