Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/deepbitstechnology/claude-plugins/find-cvesgit clone --depth 1 https://github.com/DeepBitsTechnology/claude-pluginsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00025 | $0.00510 |
| Opus 5 | $0.00013 | $0.00255 |
| Sonnet 5 | $0.00005 | $0.00102 |
| Haiku 4.5 | $0.00003 | $0.00051 |
Grade A, and why
find-cves scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Find Android Kernel CVEs
Query the remote Dr. Binary CVE database for Android/AOSP kernel vulnerabilities. Interpret the user's request and route it to the right MCP tool.
Usage
/find-cves <query>
The query is free-form. Examples:
/find-cves CVE-2024-12345— look up a specific CVE/find-cves CVEs in 5.10— CVEs affecting kernel version 5.10/find-cves unpatched in android13-5.15— unpatched CVEs in a branch/find-cves exploitable in android13-5.15 as of 2024-06-01— exploitable CVEs for a branch at a date/find-cves list all— browse the database
Routing
Choose the tool that matches the user's phrasing:
| User intent | Tool | Required args |
|---|---|---|
| Names a specific CVE id | get_cve_info |
cve_id |
"in / affecting version <v>" |
query_cves_by_version |
aosp_version |
"built on / as of <date>" (no branch) |
query_cves_by_date |
commit_date |
"unpatched in <branch>" |
query_cves_by_branch |
branch |
"exploitable in <branch> as of <date>" |
find_exploitable_cves |
commit_date and branch |
| "list / show all" | list_all_cves |
— |
Important
find_exploitable_cvesneeds both a branch and a date. If the user asks for "exploitable" CVEs but supplies only one, ask for the missing value before calling the tool — do not guess.- After listing results, offer to drill into any specific CVE with
get_cve_info.
Output
Summarize results as a concise table — CVE id, severity, subcomponent, and affected range / patch status — then a short narrative on the most significant findings. Call out any exploitable CVEs explicitly.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 44 lines · 25 tokens per session scan A 9380b2a710a9
find-cves is a command published in the GitHub repository DeepBitsTechnology/claude-plugins (47 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 25 tokens to every session and 510 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
review
Run the rigorous arkana-code-reviewer agent on uncommitted changes (or a specified scope).
fold
Run tracefold on the currently-bound trace to produce a block-collapsed derivative trace (typically 99 % compression on hash-loop-heavy traces) and bind to that instead.
status
Show the current algokiller session state — bound trace, mode, outputdir, ledger summary, artifacts written.
case
Manage forensic investigation cases.
welcome
Post-install verification and onboarding for full Valhuntir.
git
Git operations with intelligent commit messages and workflow optimization.