Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/headyzhang/agent-audit/claude-mdgit clone --depth 1 https://github.com/HeadyZhang/agent-auditWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/headyzhang/agent-audit/claude-md)<a href="https://agentmods.dev/instructions/headyzhang/agent-audit/claude-md"><img src="https://agentmods.dev/badge/instructions/headyzhang/agent-audit/claude-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.03386 | $0.03386 |
| Opus 5 | $0.01693 | $0.01693 |
| Sonnet 5 | $0.00677 | $0.00677 |
| Haiku 4.5 | $0.00339 | $0.00339 |
Grade A, and why
agent-audit CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 208 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Agent Audit (Argus) — Project Context for Claude Code
Overview
Agent Audit is a security scanner for AI agent code, MCP configurations, and DeFi contracts. It detects agent-specific vulnerabilities that traditional SAST tools miss, mapped to the OWASP Agentic Top 10 (2026) with 10/10 coverage.
- Version: 0.19.0
- Python: 3.9-3.12
- License: MIT
- Entry point:
agent-audit = "agent_audit.cli.main:cli" - Metrics (v0.19.0, 2026-05-30, GT v2.2 / 81 samples / 236 positive + 2 negative labels): P 73.58% / R 82.63% / F1 0.778 (raw, reproducible) — TP 195 / FP 70 / FN 41. Test count: 1542 collected (1541 passing on dev env, 1 skipped). Reproduce:
python tests/benchmark/precision_recall.py. A post-hoc adjusted F1 of 0.84 (excluding FPs from post-v0.16 rules not yet labeled in GT) is documented indocs/F1_REPRODUCTION.mdbut is not used as a headline figure because it isn't directly produced by the script.
Repository Structure
agent-security-suite/
├── packages/audit/ # Main Python package
│ ├── agent_audit/
│ │ ├── __init__.py
│ │ ├── version.py # __version__ = "0.18.2"
│ │ ├── analysis/ # 21 analyzer modules (confidence scoring, taint, context)
│ │ │ ├── semantic_analyzer.py # 3-stage credential detection (regex → value → context)
│ │ │ ├── taint_tracker.py # Data flow: source → sanitizer → sink
│ │ │ ├── tool_boundary_detector.py # @tool entry point gate for AGENT-034
│ │ │ ├── ts_tool_boundary_detector.py
│ │ │ ├── confidence_matrix.py # Tier computation and adjustment rules
│ │ │ ├── context_classifier.py # File type detection (test/example/infra)
│ │ │ ├── dangerous_operation_analyzer.py
│ │ │ ├── framework_detector.py # Pydantic/LangChain/CrewAI internal suppression
│ │ │ ├── placeholder_detector.py
│ │ │ ├── value_analyzer.py
│ │ │ ├── identifier_analyzer.py
│ │ │ ├── tool_description_analyzer.py
│ │ │ ├── memory_method_detector.py
│ │ │ ├── env_tracer.py
│ │ │ ├── entropy.py
│ │ │ └── rule_context_config.py
│ │ ├── analyzers/
│ │ │ └── memory_context.py
│ │ ├── scanners/ # 14 scanner modules
│ │ │ ├── base.py # BaseScanner ABC
│ │ │ ├── python_scanner.py # 4017 LOC — AST-based Python analysis
│ │ │ ├── typescript_scanner.py # 952 LOC — TS/JS via tree-sitter
│ │ │ ├── go_scanner.py # 296 LOC — Go patterns
│ │ │ ├── solidity_scanner.py # 411 LOC — Solidity contracts
│ │ │ ├── secret_scanner.py # 855 LOC — Regex + semantic secret detection
│ │ │ ├── config_scanner.py # 390 LOC — YAML/JSON/ENV files
│ │ │ ├── mcp_config_scanner.py # 1369 LOC — MCP config auditing
│ │ │ ├── mcp_baseline.py # 530 LOC — MCP baseline drift (rug pull)
│ │ │ ├── mcp_inspector.py # 607 LOC — Live MCP server introspection
│ │ │ ├── privilege_scanner.py # 1138 LOC — OS privilege escalation
│ │ │ ├── skill_body_scanner.py # 402 LOC — OpenClaw skill instructions
│ │ │ ├── skill_meta_scanner.py # 352 LOC — OpenClaw skill metadata
│ │ │ └── __init__.py
│ │ ├── rules/
│ │ │ ├── engine.py # RULE_CWE_MAPPING (92 rules), PATTERN_TYPE_TO_RULE_MAP (60+ patterns)
│ │ │ ├── loader.py # YAML rule loader
│ │ │ └── builtin/ # YAML rule definitions (mirrored from monorepo)
│ │ │ ├── owasp_agentic_v2.yaml
│ │ │ ├── owasp_agentic.yaml
│ │ │ ├── asi_coverage_v030.yaml
│ │ │ ├── mcp_security_v030.yaml
│ │ │ └── langchain_security_v030.yaml
│ │ ├── models/
│ │ │ ├── finding.py # Finding dataclass, confidence_to_tier(), TIER_THRESHOLDS
│ │ │ ├── risk.py # Severity/Category enums, Location, RiskScore
│ │ │ ├── suppression.py # Suppression/ignore model
│ │ │ └── tool.py # ToolDefinition, PermissionType
│ │ ├── cli/
│ │ │ ├── main.py # @click group
│ │ │ ├── commands/
│ │ │ │ ├── scan.py # Main scan orchestration
│ │ │ │ ├── inspect.py # Live MCP inspection
│ │ │ │ └── init.py # Config init
│ │ │ └── formatters/
│ │ │ ├── terminal.py # Rich terminal output + calculate_risk_score()
│ │ │ ├── json.py # JSON output
│ │ │ └── sarif.py # SARIF v2.1.0 output
│ │ ├── profiles/
│ │ │ └── defi/ # DeFi profile (AGENT-090 to AGENT-109)
│ │ │ ├── rules.py
│ │ │ ├── scanners/ # solidity, js_ts, defi_secret, agent_payment
│ │ │ ├── analysis/ # llm_analyzer, rpc_analyzer, defi_taint
│ │ │ └── constants/ # defi_protocols, web3_apis, rpc_endpoints
│ │ ├── config/
│ │ │ └── ignore.py # .agent-audit.yaml loader
│ │ ├── utils/
│ │ │ ├── mcp_client.py
│ │ │ └── compat.py
│ │ └── parsers/
│ │ └── treesitter_parser.py
│ ├── tests/ # 1541+ tests
│ │ ├── test_agent004_semantic.py
│ │ ├── test_expanded_rules.py
│ │ ├── test_privilege_rules.py
│ │ ├── test_defi_profile.py
│ │ ├── test_go_scanner.py
│ │ ├── test_analysis/ # 17 analyzer test modules
│ │ ├── test_cli/ # 5 CLI test modules
│ │ ├── test_formatters/ # 4 formatter test modules
│ │ ├── test_config/ # 3 config test modules
│ │ ├── fixtures/ # Test fixture code
│ │ ├── benchmark/ # Layer 2 benchmark (91 projects)
│ │ ├── ground_truth/ # AVB oracle baseline
│ │ └── e2e/ # End-to-end tests
│ └── pyproject.toml # Poetry config, version = "0.18.2"
├── rules/builtin/ # Monorepo YAML rules (sync to packages/audit before publish)
│ ├── owasp_agentic_v2.yaml
│ ├── owasp_agentic.yaml
│ ├── asi_coverage_v030.yaml
│ ├── mcp_security_v030.yaml
│ └── langchain_security_v030.yaml
├── docs/
│ ├── RULES.md # Rule documentation
│ └── reports/ # Published scan reports
├── CHANGELOG.md
├── README.md / README_CN.md
└── CONTRIBUTING.md
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 208 lines · 3,386 tokens per session scan A 5a94e148e0a8
agent-audit CLAUDE.md is an instructions file published in the GitHub repository HeadyZhang/agent-audit (226 stars, last pushed 2mo ago), licensed MIT. It adds 3,386 tokens to every session, about $0.0169 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
CheatSheetSeries AGENTS.md
AGENTS.md instructions for OWASP/CheatSheetSeries, covering non-negotiable rules, 1. sources must be real, read, and supportive, 3. stay in scope — one topic, one pr, one branch, 4. don't duplicate — link instead and 5. architecture over code — for general topics.
CheatSheetSeries CLAUDE.md
Claude Code instructions for OWASP/CheatSheetSeries, covering claude.md and for maintainers.
violin AGENTS.md
AGENTS.md instructions for Strategic-Automation/violin, covering strategic-automation/violin — ai developer guidance, 1. stack & setup, 2. mandatory verification commands, 3. code conventions & architecture and 4. git & branching strategy.
aigis CLAUDE.md
Claude Code instructions for killertcell428/aigis, covering aigis — project guidelines, zenn記事管理（zenn cli + github連携）, ディレクトリ構成, 記事の作成 and プレビュー.
Agent-Security-Regression-Harness AGENTS.md
Instructions for OWASP/Agent-Security-Regression-Harness, covering ai agent guide: owasp agent security regression harness, project overview, architecture, contribution workflow and what needs doing.
mcp-security-scanner CLAUDE.md
Claude Code instructions for badchars/mcp-security-scanner, covering mcp-security-scanner — mcp security scanner, architecture, key rules, tool categories (43 tools) and commands.