Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/navraj007in/architecture-cowork-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/navraj007in/architecture-cowork-plugin/security-scan)<a href="https://agentmods.dev/commands/navraj007in/architecture-cowork-plugin/security-scan"><img src="https://agentmods.dev/badge/commands/navraj007in/architecture-cowork-plugin/security-scan/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/navraj007in/architecture-cowork-plugin/security-scan"><img src="https://agentmods.dev/badge/commands/navraj007in/architecture-cowork-plugin/security-scan.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00012 | $0.01113 |
| Opus 5 | $0.00006 | $0.00557 |
| Sonnet 5 | $0.00002 | $0.00223 |
| Haiku 4.5 | $0.00001 | $0.00111 |
Grade A, and why
security-scan scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 101 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/architect:security-scan
Trigger
/architect:security-scan
Purpose
After scaffolding projects with /architect:scaffold, this command validates that the generated code actually implements the security measures specified in the blueprint's security architecture (deliverable 4f). Checks auth middleware, CORS, rate limiting, helmet headers, input validation, and scans for hardcoded secrets.
Workflow
Step 1: Read Context
First, check for architecture-output/_state.json. If it exists, read it in full and extract:
project.name→ product name for the scan report headertech_stack→ auth provider (Clerk, Auth0, JWT, etc.), framework, ORM — used to tailor checklist items (e.g. Prisma → parameterized queries, Clerk → session token strategy)components→ which components to scan (names + types)
Also read from SDL (Grep for auth: section — check solution.sdl.yaml first; if absent, read sdl/README.md then sdl/security.yaml or sdl/auth.yaml):
auth.identityProvider— the external identity provider (Cognito, Auth0, Clerk, custom) — used to tailor auth middleware checks (e.g. Cognito → JWKS validation, Clerk → session token, custom → JWT verify)auth.serviceTokenModel— how backend services validate tokens (jwt | session | api-key) — used to verify the correct validation mechanism is implemented in each service's middleware
Then, check if a blueprint with a security architecture (deliverable 4f) exists earlier in the conversation.
If no security checklist exists, respond:
"I need a security checklist to scan against. Run
/architect:blueprintfirst to generate your security architecture, then come back here to validate your code."
Step 2: Ask for Project Path
"Which project should I scan?"
Provide the path to the scaffolded project directory. If multiple components were scaffolded, I can scan them all.
Step 3: Delegate to Security Scanner Agent
Pass the following to the security-scanner agent:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 101 lines · 12 tokens per session scan A a1f0af15a029
security-scan is a command published in the GitHub repository navraj007in/architecture-cowork-plugin (2 stars, last pushed 2mo ago), licensed Apache-2.0. It adds 12 tokens to every session and 1,113 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other commands, from other repositories
nyann:doctor
Run nyann's read-only hygiene + documentation audit on the current repo. Emits the same drift sections retrofit uses, but never offers remediation or writes to the filesystem. Use this on session start, in CI, or any time you want to sanity-check a repo without risking mutations.
nyann:retrofit
Audit an existing repo against a profile and fix what's drifted. Unlike doctor (read-only), retrofit detects missing hooks, misconfigured gitignore, documentation gaps, and non-compliant history, then offers to remediate via bootstrap. Idempotent — safe to re-run.
nyann:apply
Apply an Infrastructure-as-Code change — the highest-stakes mutator in nyann; it can change real cloud infrastructure. Re-runs the plan, shows it, confirms, then applies. Unmistakably opt-in: apply is never the default and destructive applies require a second explicit confirm. For IaC apply intent only (not "apply a…
nyann:hotfix
Create the branch topology for a patch release against a previously tagged version. Ensures release/ . exists from the source tag, then creates hotfix/ off it. After this, the user commits the fix and runs /nyann:release from the hotfix branch.
nyann:release
Cut a release: generate a CHANGELOG section from Conventional Commits, make a release commit, and create an annotated tag. Defaults to conventional-changelog strategy.
nyann:ship
Open a GitHub pull request AND merge it in one step. Default uses GitHub's native auto-merge (returns immediately with outcome:"queued"); --client-side polls for green CI in the foreground then runs gh pr merge. Requires gh installed + authed.