longshot-aggregator

longshot-aggregator is an agent for Claude Code from vigolium/piolium. It costs 62 tokens per session (1,349 once invoked), scanned A, original, MIT.

A results editor for a repository-wide vulnerability hunt. It reads many draft findings, combines duplicates, removes weak claims, and produces a ranked summary.

In plain words
What is it for?
It is for consolidating findings from the longshot-hunter process. It checks for evidence and source-code line references, counts explicit no-finding results, and ranks the remaining issues by severity and confidence.
Why use it?
Parallel security reviews often report the same bug several times or include findings without enough evidence. This add-on turns those drafts into a shorter, more reliable set of findings.

Agent for Claude Code

Written for Claude Code: effort in frontmatter. Also seen: model in frontmatter.

Good fit It is for consolidating findings from the longshot-hunter process. It checks for evidence and source-code line references, counts explicit no-finding results, and ranks the remaining issues by severity and confidence.

Compare 6 agents from other repositories ↓
Install with agentmods
npx agentmods add agents/vigolium/piolium/longshot-aggregator
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo
git clone --depth 1 https://github.com/vigolium/piolium

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for longshot-aggregator

README.md
[![agentmods](https://agentmods.dev/badge/agents/vigolium/piolium/longshot-aggregator.svg)](https://agentmods.dev/agents/vigolium/piolium/longshot-aggregator)
Your own site
<a href="https://agentmods.dev/agents/vigolium/piolium/longshot-aggregator"><img src="https://agentmods.dev/badge/agents/vigolium/piolium/longshot-aggregator.svg" alt="Measured on agentmods" height="20"></a>
Per session 62 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,349 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00062 $0.01349
Opus 5 $0.00031 $0.00674
Sonnet 5 $0.00012 $0.00270
Haiku 4.5 $0.00006 $0.00135

Measured 8d ago against content hash 52deca3e4ecf, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade A, and why

longshot-aggregator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

agents/longshot-aggregator.md · 129 lines

How it starts

The opening of the file, as written. The whole thing — 129 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You are the Phase 3 aggregator for /piolium-longshot.

The Phase 2 hunter swarm produced a flood of per-anchor drafts under piolium/longshot/findings-draft/longshot-*.md. Many drafts will describe the same underlying bug from different anchors. Your job is to merge duplicates, rank by severity and confidence, and produce a curated summary.

You do not hunt. You only summarize what the drafts already claim. If a draft has weak evidence, drop it; do not "fix" it.

Inputs

  • piolium/longshot/targets.json — the target list, with anchor → sha8 mapping and per-file status
  • piolium/longshot/findings-draft/longshot-*.md — one or more drafts per anchor
  • piolium/longshot/findings-draft/longshot-<sha8>-000-no-finding.md — explicit no-result markers; skip these in dedup but count them in the summary

Workflow

  1. Read piolium/longshot/targets.json to learn anchor counts and per-file status.
  2. List every longshot-*-NNN-*.md draft under piolium/longshot/findings-draft/. Skip *-000-no-finding.md.
  3. Read each draft. Reject drafts that:
    • lack a ## Evidence section, or
    • contain no path:line citations, or
    • describe behavior without naming an attacker, sink, or trust boundary.
  4. Group surviving drafts by root cause. Two drafts that point at the same vulnerable function, sink, or trust boundary violation are duplicates — even if they were produced by different anchors. Use file:line evidence to decide.
  5. For each unique vulnerability, write one curated draft to:
piolium/longshot/findings-draft/longshot-curated-NNN-<slug>.md

With frontmatter (matches piolium's existing draft convention):

---
Phase: 3
Sequence: NNN
Slug: <kebab-case-slug>
Verdict: VALID
Severity-Original: CRITICAL|HIGH|MEDIUM|LOW
Confidence: high|medium|low
Source-Drafts:
  - piolium/longshot/findings-draft/longshot-<sha8>-NNN-<slug>.md
  - ... (every draft merged into this curated finding)
---

And body sections:

  • ## Summary — one paragraph
  • ## Affected Files — every file involved across merged drafts
  • ## Root Cause — the underlying defect
  • ## Attacker Control — what input, from where
  • ## Impact — what an attacker achieves
  • ## Evidence — best path:line citations from the merged drafts (cite original draft paths too)
  • ## Exploit Sketch — high-level only
  • ## Confidence Notes — why this confidence level; what's verified vs inferred

Read the full file on GitHub · 129 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 8d ago First seen · 129 lines · 62 tokens per session scan A 52deca3e4ecf

Subscribe to this mod's changes

longshot-aggregator is an agent published in the GitHub repository vigolium/piolium (134 stars, last pushed 1mo ago), licensed MIT. It adds 62 tokens to every session and 1,349 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other agents, from other repositories

reviewer

Read-only reviewer for an SDD implementation — checks that the change satisfies the acceptance criteria it claims (stage 1) and meets quality/convention/edge-case bars (stage 2). Use after a task (or the whole feature) reaches GREEN, before it's considered done. It reads the diff and the upstream artifacts and reports…

genkovich/sdd · 81 tokens

atomic-auditor

Final gate for a finished implementation. Dispatched exactly once after the implement-review loop goes green, never per iteration. Never touches the repo; its one write is the audit report into the task scratchpad. Audits the delivered work as a whole: cumulative spec compliance, cross-iteration coherence…

damusix/atomic-claude · 169 tokens

bt6-pr-auditor

Reviews one pull request in a BT6 codebase for correctness, research integrity, security, verification quality, and merge readiness.

elder-plinius/T3MP3ST · 32 tokens

Reviewer

Mandatory fast reviewer: validates every agent delegation output before acceptance. Checks acceptance criteria, file partitions, regressions, type safety, security basics.

monkilabs/opencastle · 30 tokens

security-auditor

Use this agent when reviewing local code changes or pull requests to identify security vulnerabilities and risks. This agent should be invoked proactively after completing security-sensitive changes or before merging any PR.

NeoLabHQ/context-engineering-kit · 40 tokens

dotnet-architecture-reviewer

Reviews a .NET codebase or repository and produces a structured architecture report — layering and dependency-rule violations, coupling, CQRS/handler hygiene, EF Core boundary leaks, testability, and concrete prioritized fixes. Use when the user wants an architecture review, a "second opinion" on structure, a PR-level…

StefanTheCode/dotnet-ai-toolkit · 102 tokens