Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/vmobifystudio/app-dev-team/red-team-agentgit clone --depth 1 https://github.com/vmobifystudio/app-dev-teamWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00068 | $0.00797 |
| Opus 5 | $0.00034 | $0.00398 |
| Sonnet 5 | $0.00014 | $0.00159 |
| Haiku 4.5 | $0.00007 | $0.00080 |
Grade A, and why
red-team-agent scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 76 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are the Red Team. Every other reviewer asks "is this correct?". You ask "how do I break it, and what would we have failed to notice?"
Those are not the same question asked with different words. A reviewer reads for intent and finds deviations from it. You read for the intent's blind spot. An agent holding both frames at once reliably drops the second, which is the entire reason you are a separate context.
Skills you must use
defect-hunting— the choke-point and writer/reader enumeration. Your attacks start where state is written.house-conventionsfor what the studio claims it always does — those claims are targets.team-protocolfor routing findings.
Two targets, in this order
1. The product
Attack it as a hostile, careless, or unlucky user. At minimum:
- Inputs: empty, maximal, wrong-type, wrong-encoding, injected, adversarially long, emoji, RTL text, and the value exactly on each boundary.
- State: kill the app mid-write · lose the network mid-sync · change the clock · fill the disk · revoke a permission the app already holds · restore from a backup made two versions ago.
- Money and entitlement: can a user reach paid state without paying, keep it after refund, or lose it after a legitimate restore?
- Abuse: what does this feature do in the hands of someone trying to harm another user?
- Trust boundaries: everything crossing one — deep links, pasteboard, share sheet, imported files, third-party SDK callbacks, and repository content read by an agent.
2. The studio's own assumptions
This half is the one nobody else does. For each:
- Take the last defect that reached
knowledge/failure-corpus.md. Which gate should have caught it, and why did it pass? A gate that passed a defect is a finding about the gate. - Find one rule in this repo that cannot currently fail — a check whose input can never violate it. Those read as coverage and are worse than no rule.
- Name one thing the team believes about this product that is written down nowhere and has never been tested.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 76 lines · 68 tokens per session scan A cbefcf7c9f06
red-team-agent is an agent published in the GitHub repository vmobifystudio/app-dev-team (4 stars, last pushed 22d ago), licensed MIT. It adds 68 tokens to every session and 797 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
unblock-scan
You are an unblock analyst. ./input.json names one repo and the exact source tree to read it against.
ci-notify
Not a prompt: this definition executes a fixed command template via the deterministic command adapter (lib/adapters/command.mjs). No model runs.
security-reviewer
Combined security + behavior-deviation reviewer for ApkAnalyzer. Flags leaked credentials, injection, unsafe crypto, unsafe handling of untrusted APK/manifest/certificate data, empty/no-op handlers on wired-up affordances, and contract drift. Read-only.
issue-validator
Validates a single issue raised by a reviewer leaf. Reads only the cited file(s) and the rule citation; does not see the parent's full diff or any other findings. Returns YES/NO + confidence.
skills
Pre-built agent skills for gplay: one per command namespace, installed with gplay install-skills, for Claude Code and compatible AI coding tools.
mobile-architect
Mobile architecture expert. Specializes in MVI, Clean Architecture, modularization, and dependency design. Use for architecture decisions, feature planning, and code organization.