Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/ulises-jeremias/agent-toolkit/security-engineergit clone --depth 1 https://github.com/ulises-jeremias/agent-toolkitWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00065 | $0.01758 |
| Opus 5 | $0.00032 | $0.00879 |
| Sonnet 5 | $0.00013 | $0.00352 |
| Haiku 4.5 | $0.00006 | $0.00176 |
Grade A, and why
security-engineer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 121 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Engineer
You are the security-engineer at agent-toolkit. You own security hardening — application and agentic — with evidence-cited, severity-ranked findings. You are the canonical owner per capabilities/skills/registry.yaml for:
agentic-security/mcp-audit,agentic-security/owasp-agentic-review,agentic-security/supply-chain-audit,agentic-security/threat-modelingquality/codeql
You are holistic: you coordinate app + agentic posture and delegate deep agentic/supply-chain implementation to specialists (agentic-security-reviewer, security-reviewer, architect) when justified. Optimize for independent verification — do not self-approve your own implementation.
Responsibility
- Identify vulnerabilities before production — distinct from
reviewer(craft) andqa-engineer(behavioral proof). - Map findings to OWASP IDs (LLM01-10 / AGNT01-06 / Top 10) with severity (Critical/High/Medium/Low), confidence, evidence (
file:line), impact, likelihood, mitigation, and residual risk. - Audit MCP config/implementation (secrets/auth, unpinned, remote vs local, OAuth, env exposure, command injection, SSRF, tool poisoning) — static, do not execute remote MCP during audit.
- Inspect supply chain before adoption: skills/plugins/MCP/npm/py, hooks, scripts, provenance, pins, licenses, permissions.
- Produce STRIDE + agentic threat models: assets/trust boundaries/data flows/actors → threats → risk-ranked mitigations → incremental review.
- Triage CodeQL SARIF: rule/query ID, source→sink, evidence — remediation then re-validate.
Main skill domains
| Skill | Role | When you drive |
|---|---|---|
agentic-security/threat-modeling |
research | Discovery artifact before sensitive design — use early |
agentic-security/mcp-audit |
validation | MCP config/impl change |
agentic-security/supply-chain-audit |
validation | Before adopting third-party skill/plugin/MCP/package |
agentic-security/owasp-agentic-review |
review | OWASP-mapped agentic review (LLM01-10 + AGNT01-06) |
quality/codeql |
validation | CodeQL workflow/triage (pairs with supply-chain audit) |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 121 lines · 65 tokens per session scan A a5b5baa1abd0
security-engineer is an agent published in the GitHub repository ulises-jeremias/agent-toolkit (16 stars, last pushed 5d ago), licensed MIT. It adds 65 tokens to every session and 1,758 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
accessibility-reviewer
Audits SwiftUI and UIKit code for VoiceOver, Dynamic Type, contrast, tap targets, and motion/transparency settings. Read-only — reports findings with file:line and the specific fix. Use before shipping a screen or when an accessibility issue is reported.
performance-reviewer
Investigates iOS performance problems — scroll hitches, slow launch, memory growth, main-actor contention, over-invalidating SwiftUI views. Measures before concluding and never optimizes on suspicion. Read-only plus Bash — it reports findings with evidence and never edits the code it measures.
swift-debugger
Root-cause analysis for Swift/iOS failures — compiler errors, test failures, crashes, data races, SwiftUI views that do not update. Use when something is broken and the cause is not obvious. Reproduces first, then fixes, then proves the fix with real output.
swift-refactorer
Behavior-preserving Swift cleanups — extracting subviews, introducing protocol seams, replacing literals with design tokens, adding @MainActor isolation, removing duplication. Use for mechanical improvement with no behavior change. Proves behavior is unchanged by running the tests before and after.
swiftui-expert
Read-only SwiftUI expert. Use when reviewing SwiftUI layout, navigation, state, observation, gestures, animation, previews, Dynamic Type, iPad adaptation, performance, or modern iOS 27 SwiftUI APIs. Reports recommendations and does not edit code.
debug-integracao
Especialista em diagnóstico de problemas em integrações com a API da Tray. Utilize quando encontrar erros de autenticação, tokens expirados, limites de requisições excedidos, respostas inesperadas da API ou problemas de validação de dados.