Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/jonase47/ccprWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/jonase47/ccpr/p8-security)<a href="https://agentmods.dev/commands/jonase47/ccpr/p8-security"><img src="https://agentmods.dev/badge/commands/jonase47/ccpr/p8-security.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01780 |
| Opus 5 | $0.00000 | $0.00890 |
| Sonnet 5 | $0.00000 | $0.00356 |
| Haiku 4.5 | $0.00000 | $0.00178 |
Grade A, and why
p8-security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 135 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/p8-security – Ongoing Security: Dependency Updates, Scans & Re-Tests
Keeps the security of the running system current: regular dependency updates, security scans, checking for new CVEs, and periodic re-tests of critical areas. Security is not a one-time task – it must be continuously maintained.
Argument: $ARGUMENTS = [Focus, e.g. "Dependencies", "full scan", "Re-Test Auth", "CVE check"]
If provided: Execute the specified security task. If not provided: Read TECH_STACK.md and SECURITY.md and conduct a complete security update review. If any context is missing, ask about the desired focus or recommend the standard procedure.
0. Work-item adoption guard (ADR-0002 §8)
Run python3 ~/.claude/scripts/workitems.py list.
- Non-empty array → the project uses the structured store. Use the CLI for the Critical findings in step 4 below (instead of appending BACKLOG.md prose).
[]and nodocs/workitems/directory → still on prose. Append Critical findings to BACKLOG.md as before. Emit one line: "Tip: runliftto adopt the structured work-item store."[]butdocs/workitems/exists → adopted store, just empty right now. Treat as adopted: use the CLI, not the prose fallback.
See handbook/WORKITEMS.md §8 for the full guard rationale and the status-verb mapping.
Execution
1. Read Context
Read the following files (if available):
- SECURITY.md (security architecture and requirements – reference document)
- TECH_STACK.md (all dependencies and versions)
- SECURITY_AUDIT_REPORT.md (most recent audit as comparison basis)
- PENTEST_REPORT.md (most recent pentest findings as re-test baseline)
2. Delegation to Security Master Agent (Lead)
Delegate security maintenance to the security-master agent:
Execute the following security measures: $ARGUMENTS Reference: SECURITY.md, TECH_STACK.md, most recent audit/pentest as comparison basis.
A. Dependency Audit
- Scan all direct and transitive dependencies for known vulnerabilities (CVE database)
- Prioritisation by CVSS score: critical (≥ 9.0) / high (7.0–8.9) / medium (4.0–6.9)
- For each critical and high vulnerability: affected package, CVE ID, available update, effort
- Are there packages without active maintenance or with announced end-of-life?
- Recommendation: what must be updated immediately, what can wait?
B. Update Plan
- Which updates are breaking changes (major version)?
- Which updates are low-risk (patch level)?
- Order: first critical security patches, then minor, then major
- Test strategy: which tests must remain green after the updates?
C. Security Scan (SAST & Configuration)
- Static code analysis: new vulnerabilities since the last scan?
- Configuration check: have any security-relevant configurations changed?
- Secrets scan: have any secrets accidentally ended up in the code or git history?
- Security headers: are all HTTP security headers still set correctly?
D. Periodic Re-Test (recommended: quarterly) Check whether known vulnerabilities from the last pentest are truly resolved:
- Take the fixed findings from PENTEST_REPORT.md
- Test each fix: is it still effective? Has an update reverted it?
- Are there new attack surfaces from new features since the last pentest?
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed 2bc7e630ead1
- 3d ago First seen · 135 lines · 0 tokens per session scan A 025eed6de4a2
p8-security is a command published in the GitHub repository jonase47/ccpr (1 stars, last pushed today), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,780 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other commands, from other repositories
stats
Show real token usage, delegation rate, and actual savings for the current Hydra session (parses Claude Code session JSONL — no AI estimation).
map
View, rebuild, or query the codebase dependency map.
debug
Systematic debugging with automated investigation and 4-phase methodology. Default: inline evidence gathering and diagnosis. --deep: spawns systematic-debugger agent for full autonomous debugging. Use for errors, stack traces, test failures, or unexpected behavior.
double-check
Comprehensive verification with automated quality gates, confession gathering, and confidence-based issue filtering. Default: self-review with gates. --deep: multi-agent review via code-reviewer agent. Use before committing, after fixing bugs, or to validate feature completeness.
checkpoint
Create, verify, or list lightweight workflow checkpoints — name + timestamp + git SHA + a metrics delta between two points.
harness-audit
Run the deterministic harness-audit scorecard (0-10 per category) over the MindForge tree, with an optional LLM soft-signal layer.