What is agentic-security-reviewer?

A specialist rule for reviewing security risks specific to AI agents, their prompts, tools, plugins, and MCP connections. It covers issues such as prompt injection, tool poisoning, excessive permissions, exposed credentials, and unsafe supply chains.

Use it to audit agentic features, MCP or skill changes, plugins, hooks, tool access, credentials, and supply-chain dependencies, with findings mapped to relevant OWASP categories.

These risks differ from ordinary application vulnerabilities such as SQL injection, cross-site scripting, or weak login controls. A separate review keeps the agent-specific threat checklist focused and independently verified.

agentic-security-reviewer — Cursor rule for Cursor by ulises-jeremias: A specialist rule for reviewing security risks specific to…

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add rules/ulises-jeremias/agent-toolkit/agentic-security-reviewer

Clone the repo

git clone --depth 1 https://github.com/ulises-jeremias/agent-toolkit

Made for: Cursor.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/rules/ulises-jeremias/agent-toolkit/agentic-security-reviewer.svg)](https://agentmods.dev/rules/ulises-jeremias/agent-toolkit/agentic-security-reviewer)

Your own site

<a href="https://agentmods.dev/rules/ulises-jeremias/agent-toolkit/agentic-security-reviewer"><img src="https://agentmods.dev/badge/rules/ulises-jeremias/agent-toolkit/agentic-security-reviewer.svg" alt="Measured on agentmods" height="20"></a>

Per session 1,726 This file is loaded in full into every session.

When invoked 1,726 The same file — it is already loaded in full.

Security scan A 1 finding. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.01726	$0.01726
Opus 5	$0.00863	$0.00863
Sonnet 5	$0.00345	$0.00345
Haiku 4.5	$0.00173	$0.00173

Measured 6d ago against content hash 4d23aededd82, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-06, from the pricing page.

Security

Grade A, and why

agentic-security-reviewer scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

LLM02 Insecure Output Handling — LLM output concatenated into bash/curl/npx without allowlist

plugins/agent-toolkit-agents/rules/agentic-security-reviewer.mdc · 103 lines

How it starts

The opening of the file, as written. The whole thing — 103 lines — stays where its author put it; the contents beside it link to each section on GitHub.

name: agentic-security-reviewer description: Agentic security review specialist — prompt injection, tool poisoning, excessive agency, credential exposure, supply-chain, MCP/plugin hardening with OWASP LLM01-10 + AGNT01-06. Use when security-engineer delegates agentic surface or skill/MCP/hook changes warrant isolated audit; opt-in via holistic caller. tools: Read, Grep, Glob, Bash kind: specialist

You are agentic-security-reviewer at agent-toolkit. Identify agentic vulnerabilities before they reach production — distinct from security-reviewer (app code: SQLi, XSS, auth).

Agent vs skill rule — why agent (cite clause)

Disjoint threat surface + unique expertise/permissions + explicit handoff: Agentic surface (prompt injection, tool/MCP poisoning, excessive agency, supply-chain) is orthogonal to appsec; mixing risks checklist dilution. Benefits from narrow, independent hardening lifecycle distinct from holistic security-engineer's STRIDE/app+agentic coordination. Decision: KEEP AS SPECIALIST.

When to use vs holistic

Use this specialist when security-engineer delegates per agentic-security/* (mcp-audit, supply-chain-audit, owasp-agentic-review, threat-modeling with specialist_justified: true) or change touches skills/**/SKILL.md, agents/**, mcp/registry/*.yaml, hooks/plugins. Chain: Assistant → Security Engineer → Agentic Security Reviewer (docs/AGENT_TAXONOMY.md §5 #9–10).
Use security-engineer directly for scoping STRIDE, coordinating app vs agentic findings, or when agentic checklist is not warranted.

Caller / skills / handoff

Caller (holistic owner): security-engineer (canonical) via agentic-security/mcp-audit, agentic-security/supply-chain-audit, agentic-security/owasp-agentic-review, agentic-security/threat-modeling; assistant routes to security-engineer first. See capabilities/skills/registry.yaml specialist_agents: [agentic-security-reviewer].
Skills used: agentic-security/owasp-agentic-review (template + severity rubric), agentic-security/mcp-audit, agentic-security/supply-chain-audit, agentic-security/threat-modeling.
Expected handoff: Returns severity-ranked findings (file:line + OWASP ID + CVE + impact×likelihood + mitigation + residual risk) to security-engineer; security-engineer synthesizes with app findings and delegates craft to reviewer as needed.

Read the full file on GitHub · 103 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

6d ago First seen · 103 lines · 1,726 tokens per session scan A 4d23aededd82

Subscribe to this mod's changes

agentic-security-reviewer is a cursor rule published in the GitHub repository ulises-jeremias/agent-toolkit (16 stars, last pushed today), licensed MIT. It adds 1,726 tokens to every session, about $0.0086 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Security agent-toolkit ai-agents ai-tools claude-code cursor github-copilot

test-maintenance

Maintain and evolve a Katalon True Platform/TestOps regression suite as the application changes. Use when you need to detect which tests broke or became flaky from stability and result history, diagnose whether a case needs repair vs regeneration, repair test assets (update, move, reorganize cases), refresh coverage…

katalon-labs/true-skills · 131 tokens

test-review

Review Katalon True Platform/TestOps test quality and coverage before tests enter the delivery pipeline. Use when you need to check whether a suite is ready to run, review requirement and configuration coverage, assess test-case quality and flakiness/stability, spot weak or unreliable cases, and produce a review…

katalon-labs/true-skills · 126 tokens

agentic-security-reviewer