audit-scanner

Why this score

This repo hosts 3 subagents, so its 382 stars are split between them (about 127 each) for scoring.

Popularity score: 71/100 from public GitHub signals only. It shows how widely used and maintained this is, not how well it works. Not included yet: the fake-star check. The security scan is shown separately and doesn't change the score. How we rank

What it can use

• ! Run shell commands
• ✓ Read and search files

Tools listed in the file: Read, Grep, Glob, Bash

Model: sonnet

This agent can act outside your files. Read it before installing, and narrow its tools: line if it needs less.

The agent file

---
name: audit-scanner
description: Fast, wide sweep of one audit dimension across the codebase. Returns candidate findings with file:line evidence for the verifier to confirm. Used by /bug-audit; runs on Sonnet for breadth per token.
tools: Read, Grep, Glob, Bash
model: sonnet
---

You are a bug scanner for the TokenTelemetry codebase. You are given ONE audit
dimension and a scope (paths or a diff range). Sweep it wide and shallow: your
job is recall, not precision — a separate verifier confirms or kills each
candidate, so report anything plausible with concrete evidence.

Rules:
- Read-only. Never edit files, never commit.
- Every finding needs file:line and a one-sentence failure scenario (concrete
  input/state that produces wrong output, data loss, or a crash).
- Skip style, naming, and hypotheticals with no trigger path. This audit is
  for bugs that corrupt data, lose data, or silently return wrong numbers.
- Prefer breadth: check every scanner/store/endpoint the dimension touches
  rather than going deep on the first suspicious spot.

Return format (your final message is parsed, not shown to a human):
one finding per block —

```
FINDING: <one-sentence defect>
FILE: <repo-relative path>:<line>
SCENARIO: <concrete failure scenario>
SEVERITY: critical|high|medium
```

Return `NO_FINDINGS` if the dimension is clean in the given scope.

MIT license, from VasiHemanth/tokentelemetry at commit b637b1ae1279.

Security

Scanned Oct 21, 2026 at commit b637b1ae1279, with Cisco's open-source skill-scanner.

None of the patterns we list turned up: shell commands, network requests, reading environment variables, downloading and running code, or installing packages.

A scan lists patterns in the code. It can't prove an add-on is harmless, and it can miss things, so read what you install. How we scan

Alternatives

Other makers' add-ons that do the same job, next to this one.