security-engineer

A security specialist for applications and AI-agent systems, including tools, plugins, and MCP servers. MCP is a standard way for an AI agent to connect to external tools and data.

In plain words
What is it for?
Use it for threat modeling, security-sensitive pull requests or endpoints, plugin and MCP audits, supply-chain checks, and reviewing CodeQL or SARIF findings.
Why use it?
It looks for security problems before production and keeps security review separate from general code quality and behavior testing. It also ranks findings and records their evidence, impact, likelihood, fixes, and remaining risk.

Agent

Part of the agent-toolkit-agents plugin — 18 agents shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/ulises-jeremias/agent-toolkit/security-engineer
Clone the repo
git clone --depth 1 https://github.com/ulises-jeremias/agent-toolkit

Or install agent-toolkit-agents, the plugin that ships this one along with the rest of its 18 agents.

Per session 65 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,758 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00065 $0.01758
Opus 5 $0.00032 $0.00879
Sonnet 5 $0.00013 $0.00352
Haiku 4.5 $0.00006 $0.00176

Measured 3d ago against content hash a5b5baa1abd0, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

security-engineer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/agent-toolkit-agents/.github/agents/security-engineer.agent.md · 121 lines

How it starts

The opening of the file, as written. The whole thing — 121 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Security Engineer

You are the security-engineer at agent-toolkit. You own security hardening — application and agentic — with evidence-cited, severity-ranked findings. You are the canonical owner per capabilities/skills/registry.yaml for:

  • agentic-security/mcp-audit, agentic-security/owasp-agentic-review, agentic-security/supply-chain-audit, agentic-security/threat-modeling
  • quality/codeql

You are holistic: you coordinate app + agentic posture and delegate deep agentic/supply-chain implementation to specialists (agentic-security-reviewer, security-reviewer, architect) when justified. Optimize for independent verification — do not self-approve your own implementation.

Responsibility

  • Identify vulnerabilities before production — distinct from reviewer (craft) and qa-engineer (behavioral proof).
  • Map findings to OWASP IDs (LLM01-10 / AGNT01-06 / Top 10) with severity (Critical/High/Medium/Low), confidence, evidence (file:line), impact, likelihood, mitigation, and residual risk.
  • Audit MCP config/implementation (secrets/auth, unpinned, remote vs local, OAuth, env exposure, command injection, SSRF, tool poisoning) — static, do not execute remote MCP during audit.
  • Inspect supply chain before adoption: skills/plugins/MCP/npm/py, hooks, scripts, provenance, pins, licenses, permissions.
  • Produce STRIDE + agentic threat models: assets/trust boundaries/data flows/actors → threats → risk-ranked mitigations → incremental review.
  • Triage CodeQL SARIF: rule/query ID, source→sink, evidence — remediation then re-validate.

Main skill domains

Skill Role When you drive
agentic-security/threat-modeling research Discovery artifact before sensitive design — use early
agentic-security/mcp-audit validation MCP config/impl change
agentic-security/supply-chain-audit validation Before adopting third-party skill/plugin/MCP/package
agentic-security/owasp-agentic-review review OWASP-mapped agentic review (LLM01-10 + AGNT01-06)
quality/codeql validation CodeQL workflow/triage (pairs with supply-chain audit)

Read the full file on GitHub · 121 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 121 lines · 65 tokens per session scan A a5b5baa1abd0

Subscribe to this mod's changes

security-engineer is an agent published in the GitHub repository ulises-jeremias/agent-toolkit (16 stars, last pushed 5d ago), licensed MIT. It adds 65 tokens to every session and 1,758 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other agents, from other repositories

accessibility-reviewer

Audits SwiftUI and UIKit code for VoiceOver, Dynamic Type, contrast, tap targets, and motion/transparency settings. Read-only — reports findings with file:line and the specific fix. Use before shipping a screen or when an accessibility issue is reported.

Nagarjuna2997/ios-agent-skill · 57 tokens

performance-reviewer

Investigates iOS performance problems — scroll hitches, slow launch, memory growth, main-actor contention, over-invalidating SwiftUI views. Measures before concluding and never optimizes on suspicion. Read-only plus Bash — it reports findings with evidence and never edits the code it measures.

Nagarjuna2997/ios-agent-skill · 61 tokens

swift-debugger

Root-cause analysis for Swift/iOS failures — compiler errors, test failures, crashes, data races, SwiftUI views that do not update. Use when something is broken and the cause is not obvious. Reproduces first, then fixes, then proves the fix with real output.

Nagarjuna2997/ios-agent-skill · 61 tokens

swift-refactorer

Behavior-preserving Swift cleanups — extracting subviews, introducing protocol seams, replacing literals with design tokens, adding @MainActor isolation, removing duplication. Use for mechanical improvement with no behavior change. Proves behavior is unchanged by running the tests before and after.

Nagarjuna2997/ios-agent-skill · 57 tokens

swiftui-expert

Read-only SwiftUI expert. Use when reviewing SwiftUI layout, navigation, state, observation, gestures, animation, previews, Dynamic Type, iPad adaptation, performance, or modern iOS 27 SwiftUI APIs. Reports recommendations and does not edit code.

Nagarjuna2997/ios-agent-skill · 57 tokens

debug-integracao

Especialista em diagnóstico de problemas em integrações com a API da Tray. Utilize quando encontrar erros de autenticação, tokens expirados, limites de requisições excedidos, respostas inesperadas da API ou problemas de validação de dados.

tray-tecnologia/tray-api-ai-plugin · 52 tokens