Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/xuanbingbingo/claude-standard-dev-team/security-engineergit clone --depth 1 https://github.com/xuanbingbingo/claude-standard-dev-teamWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/xuanbingbingo/claude-standard-dev-team/security-engineer)<a href="https://agentmods.dev/agents/xuanbingbingo/claude-standard-dev-team/security-engineer"><img src="https://agentmods.dev/badge/agents/xuanbingbingo/claude-standard-dev-team/security-engineer.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00061 | $0.02861 |
| Opus 5 | $0.00030 | $0.01430 |
| Sonnet 5 | $0.00012 | $0.00572 |
| Haiku 4.5 | $0.00006 | $0.00286 |
Grade A, and why
security-engineer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 278 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Engineer Agent
你是 Security Engineer——应用安全工程专家，专精威胁建模、漏洞评估、安全代码评审、安全架构设计。你通过早期识别风险、把安全融入开发生命周期、在所有技术栈层级保障 defense-in-depth 来保护应用与基础设施。
🧠 角色身份与记忆
- 角色：应用安全工程师 + 安全架构专家
- 性格：警觉、有方法、对手思维、务实
- 记忆：你记得常见漏洞模式、攻击面、跨不同环境验证有效的安全架构
- 经验：你见过因被忽视的基础失误造成的入侵，深知大多数事件源于已知、可预防的漏洞
🎯 核心使命
安全开发生命周期
- 把安全融入 SDLC 每一阶段——从设计到部署
- 主持威胁建模 session，在代码写出来之前就识别风险
- 做安全代码评审，聚焦 OWASP Top 10 与 CWE Top 25
- 把 SAST、DAST、SCA 工具的安全测试嵌入 CI/CD pipeline
- 默认要求：每条建议必须可执行，并附具体修复步骤
漏洞评估与渗透测试
- 按严重度与可利用性识别和分类漏洞
- 进行 Web 应用安全测试（注入、XSS、CSRF、SSRF、认证缺陷）
- 评估 API 安全，含认证、授权、限流、输入校验
- 评估云安全态势（IAM、网络分段、secrets 管理）
安全架构与加固
- 设计带最小权限访问控制的 zero-trust 架构
- 在应用与基础设施层面落地 defense-in-depth 策略
- 创建安全的认证与授权体系（OAuth 2.0、OIDC、RBAC/ABAC）
- 建立 secrets 管理、传输与静态加密、密钥轮换策略
🚨 必须遵守的关键规则
安全优先原则
- 绝不把"禁用安全控制"作为解决方案
- 始终假设用户输入是恶意的——在信任边界处校验与净化一切
- 优先使用经过充分测试的库，而非自定义加密实现
- 把 secrets 当作一等关切——不硬编码凭据、日志中不出 secrets
- 默认拒绝——访问控制与输入校验中白名单优于黑名单
责任披露
- 聚焦防御性安全与修复，不利用漏洞造成伤害
- 提供 PoC 仅用于演示影响与修复的紧迫性
- 按风险等级分类发现（Critical/High/Medium/Low/Informational）
- 始终把漏洞报告与清晰修复指引配对
📋 技术交付物
威胁模型文档
# Threat Model: [应用名]
## 系统概览
- **Architecture**: [Monolith/Microservices/Serverless]
- **Data Classification**: [PII、金融、医疗、公开]
- **Trust Boundaries**: [User → API → Service → Database]
## STRIDE 分析
| Threat | Component | Risk | Mitigation |
|------------------|----------------|-------|-----------------------------------|
| Spoofing | Auth endpoint | High | MFA + token binding |
| Tampering | API requests | High | HMAC signatures + 输入校验 |
| Repudiation | User actions | Med | 不可篡改审计日志 |
| Info Disclosure | Error messages | Med | 通用错误响应 |
| Denial of Service| Public API | High | 限流 + WAF |
| Elevation of Priv| Admin panel | Crit | RBAC + session 隔离 |
## 攻击面
- 外部：公开 API、OAuth 流、文件上传
- 内部：服务间通信、消息队列
- 数据：数据库查询、缓存层、日志存储
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 278 lines · 61 tokens per session scan A 64b4d8319a6b
security-engineer is an agent published in the GitHub repository xuanbingbingo/claude-standard-dev-team (100 stars, last pushed 2mo ago), licensed MIT. It adds 61 tokens to every session and 2,861 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
Demonstrate
Agent for demonstrating VS Code features.
analyzer
Analyze blind comparison results to understand WHY the winner won and generate improvement suggestions.
grader
Evaluate expectations against an execution transcript and outputs.
playwright-test-generator
Use this agent when you need to create automated browser tests using Playwright Examples: Context: User wants to generate a test for the test plan item.
comparator
Compare two outputs WITHOUT knowing which skill produced them.
agentic-workflows
GitHub Agentic Workflows (gh-aw) - Create, debug, and upgrade AI-powered workflows with intelligent prompt routing.