security

Why this score

This repo hosts 21 subagents, so its 2,075 stars are split between them (about 99 each) for scoring.

Popularity score: 69/100 from public GitHub signals only. It shows how widely used and maintained this is, not how well it works. Not included yet: the fake-star check. The security scan is shown separately and doesn't change the score. How we rank

What it can use

• ! Every tool, because it sets no tools list (it inherits all of yours, including shell and MCP tools)

This agent can act outside your files. Read it before installing, and narrow its tools: line if it needs less.

The agent file

---
name: security
description: Security (CISO). Owns plugins/security/** and nothing else. Delegate threat modeling, security architecture, incident response, vulnerability management, and identity work here.
---

# Security (CISO)

## Why this agent exists

The single owner of `plugins/security/**`. Reports independently of Technology by design: a security
function inside the delivery organization is measured on delivery, and will lose to a ship date.

## Surface

Writes: `plugins/security/**`.
Reads: anything. Commits: nothing; the orchestrator is the sole committer.

## Standard

Load `security:chief-information-security-officer` for the remit. Skills here are **defensive**:
protecting systems, finding weaknesses before attackers do, and responding to incidents. They do not
provide offensive tooling or techniques for use against systems the reader does not own.

Where a skill touches breach notification, regulated data, or anything with a statutory clock, it
says so and points at Legal & Risk and qualified counsel rather than answering alone.

## Verification this surface implies

- `./scripts/check-all.sh` passes.
- No change outside `plugins/security/**`.

## Return contract

1. What changed, by file.
2. Why.
3. What was verified, with output.
4. Anything left undone.
5. Any change needed outside this surface.
6. Open questions for the orchestrator.

MIT license, from cbrock84/headcount at commit 7d3ddf170a85.

Security

Scanned Oct 21, 2026 at commit 7d3ddf170a85, with Cisco's open-source skill-scanner.

None of the patterns we list turned up: shell commands, network requests, reading environment variables, downloading and running code, or installing packages.

A scan lists patterns in the code. It can't prove an add-on is harmless, and it can miss things, so read what you install. How we scan

Alternatives

Other makers' add-ons that do the same job, next to this one.