agentmods.dev

scan-web

scan-web is a command for Claude Code from tinoimammp/vantage-security-agent. It costs 18 tokens per session (602 once invoked), scanned A, original, MIT.

A command that runs all six stages of a web security scan on a code repository. It checks the repository in order and stops if a required stage condition is not met.

In plain words
What is it for?
Use it to run the complete web security testing process for a repository and produce findings from its scanning stages.
Why use it?
It provides one way to start the full scan without running each stage manually. It also prepares the scan scope when needed and ensures the scan is treated as a web project.

Command for Claude Code

Written for Claude Code: allowed-tools in frontmatter.

Runs only inside its plugin — its command needs a path that Claude Code sets for a plugin’s own hooks and for nothing else. Install the plugin, not this.

Part of the vantage plugin — 1 skill, 6 commands shipped together

not rated 4repo 1mo ago A scan 18 tokens original MIT

Good fit Use it to run the complete web security testing process for a repository and produce findings from its scanning stages.

Compare 6 commands from other repositories ↓
View source ↗ tinoimammp/vantage-security-agent
Install

Getting it into your agent

This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.

Claude Code
/plugin marketplace add tinoimammp/vantage-security-agent
Claude Code
/plugin install vantage

Made for: Claude Code.

Or install vantage, the plugin that ships this one along with the rest of its 1 skill, 6 commands.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for scan-web

README.md
[![agentmods](https://agentmods.dev/badge/commands/tinoimammp/vantage-security-agent/scan-web.svg)](https://agentmods.dev/commands/tinoimammp/vantage-security-agent/scan-web)
Your own site
<a href="https://agentmods.dev/commands/tinoimammp/vantage-security-agent/scan-web"><img src="https://agentmods.dev/badge/commands/tinoimammp/vantage-security-agent/scan-web.svg" alt="Measured on agentmods" height="20"></a>
Per session 18 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 602 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00018 $0.00602
Opus 5 $0.00009 $0.00301
Sonnet 5 $0.00004 $0.00120
Haiku 4.5 $0.00002 $0.00060

Measured 8d ago against content hash 0e8ad951d7bb, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade A, and why

scan-web scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

commands/scan-web.md · 45 lines

What it actually says

Run the complete web vantage pipeline against $ARGUMENTS (default: current working directory), phases 01 through 06, honoring the gates in ${CLAUDE_PLUGIN_ROOT}/workflow/orchestration.md.

Read ${CLAUDE_PLUGIN_ROOT}/START-HERE.md and ${CLAUDE_PLUGIN_ROOT}/workflow/orchestration.md first if you have not already this session.

  1. If ./.vantage/artifacts/recon/scope.json doesn't exist, copy the plugin asset ${CLAUDE_PLUGIN_ROOT}/artifacts/recon/scope.json.template → ./.vantage/artifacts/recon/scope.json, filling in placeholders with the current system timestamp and repository path. Never block to ask the user.
  2. Set/confirm platform: "web" in that scope.json — this command always runs the web pipeline regardless of what's already there (if it says "mobile", overwrite it to "web" for this run and note that you did so).
  3. For each phase, in order, check the phase's gate is satisfied (per ${CLAUDE_PLUGIN_ROOT}/workflow/orchestration.md) — if not, stop and report why — then dispatch via Task:
    • 01 Recon → recon-agent
    • 02 Mapping → mapper-agent
    • 03 Testing → dispatch all 10 as parallel Task calls in the same turn, each writing its own raw-findings.<agent-name>.json: auth-agent, authorization-agent, api-agent, sqli-agent, xss-agent, upload-agent, business-logic-agent, injection-agent, dependency-agent, secrets-agent
    • 04 Validation → validator-agent (merges all raw-findings.*.json first)
    • 05 PoC → poc-agent (only if ≥1 validated:true finding)
    • 06 Reporting → report-agent
  4. Append each phase's result to ./.vantage/artifacts/run-log.md.

Stop and summarize if a phase produces zero actionable output (see Failure & Empty Handling in ${CLAUDE_PLUGIN_ROOT}/workflow/orchestration.md) — do not fabricate findings.

When done, report the final artifact path — ./.vantage/artifacts/reports/report.md — and remind the user that /vantage:fix-issue <id> or /vantage:fix can apply code-level fixes for the validated findings.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 8d ago First seen · 45 lines · 18 tokens per session scan A 0e8ad951d7bb

Subscribe to this mod's changes

scan-web is a command published in the GitHub repository tinoimammp/vantage-security-agent (4 stars, last pushed 1mo ago), licensed MIT. It adds 18 tokens to every session and 602 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Securityai-agentsappsecmobile-securityowaspsastsecurity-tools
Related

Other commands, from other repositories

review-cheatsheet-pr

Aggressively review an OWASP cheat sheet PR across security, practicality, links/sources, duplication, and language; produce a single MERGE/REQUESTCHANGES/CLOSE verdict.

OWASP/CheatSheetSeries · 37 tokens

scope

Prepare a focused analysis scope for large codebases or monorepos using repomix. Creates a digestible snapshot of the target code for subsequent security analysis.

allsmog/vuln-scout · 21 tokens

threats

Combines application understanding with systematic threat identification. First understands the application, then identifies what could go wrong.

allsmog/vuln-scout · 25 tokens

propagate

When you find one vulnerability, search for the same pattern everywhere else. Developers often make the same mistake repeatedly.

allsmog/vuln-scout · 20 tokens

mobile-audit

End-to-end mobile audit driver for Android targets. Most Android bug-bounty work involves a decompiled APK that's been split into two directories.

allsmog/vuln-scout · 27 tokens

trace

Trace attacker-controlled input to a sink and document whether it is a verified vulnerability, a hotspot that still needs proof, or a false positive.

allsmog/vuln-scout · 18 tokens