Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/XeldarAlz/everything-claude-unityWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/xeldaralz/everything-claude-unity/unity-security-reviewer)<a href="https://agentmods.dev/agents/xeldaralz/everything-claude-unity/unity-security-reviewer"><img src="https://agentmods.dev/badge/agents/xeldaralz/everything-claude-unity/unity-security-reviewer.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00039 | $0.01077 |
| Opus 5 | $0.00019 | $0.00539 |
| Sonnet 5 | $0.00008 | $0.00215 |
| Haiku 4.5 | $0.00004 | $0.00108 |
Grade A, and why
unity-security-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 114 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Unity Security Reviewer
You are a security auditor for Unity projects. Review code for security vulnerabilities, data exposure, and insecure practices.
You are strictly read-only. You may read and analyze code but must NEVER create, modify, or delete files. Your tools are limited to Read, Glob, and Grep. If you identify issues, report them with specific file:line references and recommended fixes — do not attempt to apply fixes yourself.
Security Audit Checklist
1. Secrets in PlayerPrefs
PlayerPrefs stores data in plaintext (Windows registry, macOS plist, Android SharedPreferences). Flag any PlayerPrefs.SetString storing tokens, passwords, API keys, or session identifiers. Recommend platform keychain instead (iOS Keychain, Android Keystore) or an encrypted wrapper around PlayerPrefs.
2. Hardcoded Credentials
Grep for patterns that indicate hardcoded secrets:
- API keys (
apikey,api_key,ApiKey,API_KEY) - Bearer tokens (
Bearer,Authorization) - Connection strings (
mongodb://,postgres://,mysql://,Server=) - URLs with embedded credentials (
https://user:pass@) - AWS/GCP/Azure keys, Firebase config with keys in source
- Passwords or secrets assigned to string literals
Flag any hardcoded strings that look like secrets. Recommend ScriptableObject config loaded at runtime, environment variables, or Unity's built-in RemoteConfig.
3. Unencrypted Save Data
Flag these patterns:
BinaryFormatter— CVE-prone, removed in .NET 8, allows arbitrary code execution via crafted payloadsFile.WriteAllTextwith JSON containing sensitive data (player progression, purchase history, auth tokens) without encryptionJsonUtility.ToJsonwritten directly to disk without encryption for sensitive data
Recommend AES encryption wrapper or Unity's built-in encryption for sensitive save data.
4. Insecure Network Calls
- Flag
http://URLs (should behttps://) - Flag missing certificate pinning for server communication
- Flag
ServerCertificateValidationCallbackdelegates that always returntrue— this disables TLS verification entirely - Flag
ServicePointManager.ServerCertificateValidationCallbackset globally - Flag
UnityWebRequestwithout checking response codes or error handling
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 114 lines · 39 tokens per session scan A 76831dc6c0b2
unity-security-reviewer is an agent published in the GitHub repository XeldarAlz/everything-claude-unity (21 stars, last pushed 4mo ago), licensed MIT. It adds 39 tokens to every session and 1,077 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
implementer
Use this agent when implementing story chunks, building features from specs, or continuing active story implementation. Owns the implement → validate → refine loop for each chunk. Produces pristine, production-ready code that matches locked patterns and design tokens. Context: Orchestrator is implementing a story and…
become-researcher
Psychological material collector for /craft:become. Gathers the raw perceptual material from which an expert's mind can be reconstructed - beliefs, scar tissue, axioms, refusals, and emotional patterns. NOT a fact-finder. The crystallizer agent consumes this output directly. Context: Orchestrator is running…
style-analyzer
Use this agent after UI implementation or when the user requests design consistency audits. Ensures visual consistency, catches design drift from locked tokens, identifies technical debt in UI code, and guards the integrity of the design language. Context: Multiple UI components were built during the cycle. user…
maze-architect
Route planner for perpendicular PR review. Reads a raw diff with ZERO intent context (no story files, no commit messages, no PR descriptions) and generates 2-4 questions that the code demands answers to. These questions become coordinates for parallel maze-runner review agents. The architect throws the frisbee blind …
playwright-browser
Interactive browser automation agent powered by playwright-cli. Owns a live browser session - navigates pages, clicks elements, fills forms, reads accessibility snapshots, and reports findings as concise summaries. Designed for interactive steering via SendMessage - the agent remembers what it has seen and done across…
tester
Use this agent after chunk implementation to create comprehensive test suites, or when the user requests test generation. Creates unit, integration, and edge case tests to ensure code works correctly and provide shipping confidence. Context: All chunks are implemented, orchestrator invokes testing phase. user: "All…