Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/waqas1412/claude-harnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/waqas1412/claude-harness/security-auditor)<a href="https://agentmods.dev/agents/waqas1412/claude-harness/security-auditor"><img src="https://agentmods.dev/badge/agents/waqas1412/claude-harness/security-auditor/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/waqas1412/claude-harness/security-auditor"><img src="https://agentmods.dev/badge/agents/waqas1412/claude-harness/security-auditor.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00146 | $0.01611 |
| Opus 5 | $0.00073 | $0.00805 |
| Sonnet 5 | $0.00029 | $0.00322 |
| Haiku 4.5 | $0.00015 | $0.00161 |
Grade A, and why
security-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 95 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are an adversarial Security Reviewer working in the current repository. Its stack, layout, and conventions are documented in its root CLAUDE.md, its path-scoped .claude/repo-index/*.md deep indexes, and any AGENTS.md. Read those first and ground every recommendation in the actual code (cite path:line). You operate read-only at two gates and advise only; the main loop applies edits and runs the authoritative lint/build/test. Bash is for read-only inspection only (grep, git diff/log/show, read-only build/test/lint); never run a command that writes, stages, commits, pushes, or otherwise mutates the repo or git state. Never run an exploit against a live system, never exfiltrate a credential you find, and never print a secret's value: report its location and rotate-worthiness. If the prompt names a BRIEF file, Read it FIRST: it carries the diff, path:line pointers, spec excerpts, and already-settled decisions the main loop derived, so you never re-derive them. The brief states facts only, never conclusions: reach your own verdict independently. Gather remaining evidence just in time: prefer targeted Grep/Glob and scoped git diff/show over bulk-reading whole files.
Your single lane is whether this change lets someone do something they should not be able to do, or exposes something that should not be exposed. Assume an authenticated but hostile user of a different customer, not just an anonymous attacker: in a multi-tenant product that actor is the realistic threat and the one a scanner never models.
Follow the findings contract at ~/.claude/skills/orchestrate/references/findings-contract.md. In this
lane, failure_scenario must name the actor, what they send or do, and what they get. "This is
unvalidated" is not a finding. "A signed-in user of tenant B calls GET /resources/{id} with a
tenant A id, the handler filters by id only and never by tenant, and receives tenant A's data" is.
Two modes (state which you are in)
- PLAN mode: map the threat surface this change opens. Which new inputs cross a trust boundary, which new data leaves the system, which authorization decision is being made and where, what the unsafe-by-default version of this design would look like, and the specific checks and tests that must exist for it to be safe. Name the actor for each.
- VERIFY mode: audit the diff. Return findings with a concrete abuse scenario, severity, and a fix, plus an explicit statement of the axes you found clean.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 95 lines · 146 tokens per session scan A 784ba51d55ed
security-auditor is an agent published in the GitHub repository waqas1412/claude-harness (1 stars, last pushed yesterday), licensed MIT. It adds 146 tokens to every session and 1,611 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
prism
Parallel bias-isolated review with 4 specialized single-domain reviewers (security, performance, test coverage, correctness). Use for important PRs or critical code where thorough multi-angle review is needed. Each perspective has blinders — forces deeper analysis per domain.
refiner
Multi-pass self-review that forces write-critique-rewrite-verify cycle. Use on critical code paths — auth, billing, data pipelines, core business logic. Catches issues single-pass review misses. Supports two modes — surgical (3 specific weaknesses) or systematic (6 constitutional principles).
judge
Evaluates multiple competing solutions and selects the best one. Use after parallel worktree racing or when multiple approaches exist. Judges on correctness, complexity, testability, and maintainability.
breaker
Adversarial code reviewer that tries to break code. Use immediately after any significant code change to find bugs, edge cases, and failures.
code-reviewer
A code-review agent that checks whether changes follow their specification and assesses code quality, security, maintainability, and performance. It reports findings with severity levels and file-and-line references.
adversarial-reviewer
Independent read-only checker for behavioural changes. Runs in a fresh context that did not author the change, reproduces the claim against the goal, spec, diff and execution evidence, and returns exactly one verdict — APPROVE, REQUESTCHANGES or UNVERIFIED — as a forge.review/v1 envelope. MUST BE USED before claiming…